Biometric identity theft: Pakistan blocks 18.2M SIM cards

A woman in Rajanpur was told she'd get help buying food. All she had to do was press her thumb on a scanner. Officials say that thumbprint was later used to open a phone line, and that phone line was linked to terrorist activity.

Most of us will never lose a fingerprint at a

Now, most of us will never lose a fingerprint at a ration line in Pakistan. But if you've ever unlocked your phone with your face, or scanned your thumb to board a flight, this story is about the thing you can't change. You can reset a password. You cannot reset your fingerprint. Pakistani authorities say they blocked more than eighteen million illegal SIM cards over roughly two and a half years. In just the first seven months of this year, they blocked nearly two million more. And yet the scammers kept working. So here's the question that runs under all of it, if the fingerprints were supposed to stop the fraud, why didn't they?

The answer starts with a single police raid. Investigators with Pakistan's National Cyber Crime agency say they recovered the biometric records of around six hundred thousand people, in one operation. Six hundred thousand people's fingerprints. Sitting in a criminal's hands, ready to register phone lines in their names. That's the part regulators got wrong. They treated the fingerprint scan as the lock on the door. But once those prints were stored in a database, the database became the door. For the rest of us, that means the very system built to protect your identity became the biggest place to steal it.

And where were these prints coming from? Officials point to airports, driving license centers, passport offices, the everyday government counters where you hand over a thumbprint without thinking twice. The same infrastructure that collected the data leaked the data. It's not a hacking-genius story. It's a filing-cabinet-left-open story.

Here's a number that reframes the whole thing. Security researchers found that the vast majority of SIM swap attacks, around ninety-six out of a hundred, don't involve clever code at all. They rely on social engineering. Someone lies. Someone on the inside gets paid. So this was never only a technology problem. It's a people problem wearing a technology costume. For anyone who's ever gotten a two-factor code by text, that matters. If a scammer controls your phone number, they can walk right into your bank.