Check If Someone Used Your CNIC to Take a Loan or Card in Pakistan: 7 Warning Signs
SBP lists 7 warning signs that someone is using your CNIC for loans or cards. See the credit report check, the 15 day eCIB notice and how to dispute an entry.
Seven signs on SBP's list suggest someone may be using your identity: a loan or credit refused for no clear reason, credit card statements that stop arriving, a card you never applied for, calls about debts you do not know, bills from places you never visited, missing mail, and a credit report showing a loan you never took. If you see one, check your credit report first.
Your CNIC is the key to almost every bank door in Pakistan. A copy left with the wrong person can open an account or a loan in your name. The State Bank of Pakistan (SBP) publishes a short guide on this, "Protect Yourself From Identity Theft". We read it on 14 October 2026 on SBP's consumer protection page, along with the rules that govern what a bank must do when it reports an overdue loan.
Seven warning signs that your identity may be in use
SBP lists these signals. None proves theft on its own, but each is a reason to look closer.
- You are denied credit or a loan for no apparent reason.
- Your monthly credit card statements stop arriving.
- You receive a credit card you did not apply for.
- You get collection calls about debts you do not know.
- You receive bills from places you never spent at, or from a collection agency.
- Some of your mail is missing.
- Your consumer credit information report shows a financial facility you did not take.
The last sign is the strongest, because it comes from a record and not from a guess. Do not wait for a collection call before you look at the report.
Three types of identity theft that SBP describes
SBP names three types. Knowing them helps you tell your bank and the police what happened.
| Type | What SBP says it is |
|---|---|
| Character identity theft | Someone pretends to be you and commits a crime, leading to warrants, arrests or jail time in your name |
| CNIC identity theft | Someone steals your CNIC and uses it for account opening, cards, property papers or a mortgage |
| Credit identity theft | Someone uses your details to get loans, goods or services and never pays, so the unpaid bills go to collection and hurt your credit standing |
Check your credit report to see what is in your name
SBP says private credit bureaus can show you your credit information report, let you dispute inaccuracies and let you take part in your credit profile. The two licensed private bureaus are Aequitas Information Services Limited (tasdeeq.com, helpline 0308 8273337) and Data-Check Limited (datacheck.com.pk, helpline 021 35642320), as listed on SBP's page.
Our guide on how to check your credit report with Tasdeeq and Data-Check shows the steps and how to fix a wrong entry. A loan you never took is the kind of wrong entry to dispute. SBP's framework also says banks are responsible for getting erroneous information sent to eCIB or another approved bureau reversed within a reasonable time once a complaint is settled in your favour.
A bank must warn you before reporting an overdue loan
Under the Business Conduct and Fair Treatment of Consumers Regulatory Framework (BPRD Circular No. 04 of 2025), a bank must send an intimation letter and an SMS or email before it reports an overdue against your name to eCIB. The notice must explain what the report means and allow at least 15 days to settle.
If you had no loan at all, such a notice is itself a sign. Do not ignore it as spam. Call the bank on its official number, not the one in the message. For fake bank calls, see how to check a fake PTA, NCCIA or bank call.
Safety habits SBP recommends to protect your identity
SBP's guide groups its advice into internet, personal information, banking, and mail and trash. The main points are short.
- Use difficult passwords with letters, numbers and special characters on bank, card and phone accounts.
- Verify any caller before giving personal data. SBP says your bank will not call and ask for personal information, because it already holds it.
- Never give your CNIC to someone who calls with a credit card, prize or other offer. Ask for a written request.
- Check each monthly bank and card statement, and keep statements and cheques for one year in case of a dispute.
- Cover your PIN, and report anything unusual on an ATM, since thieves may use skimming devices or cameras.
- Shred receipts, card offers, bank statements and expired cards. Do not write account details on the outside of a bill envelope.
What to do if you find a loan or card in your name
SBP's guide says to report identity theft to your credit issuer as soon as possible so steps can be taken to control the damage. In practice, write to the bank named in the report, say you never took the facility and ask for its complaint tracking number. If the bank is slow, SBP's consumer page sends you to the Banking Mohtasib Pakistan after 45 days.
Also check how many mobile numbers are registered on your CNIC. The guide on checking SIMs registered on your CNIC covers it. A police report may help your case, but SBP's guide does not require one, so ask the bank what it needs.
Common questions about identity theft and your CNIC
How do I know if someone took a loan in my name?
Check your credit report. SBP lists a facility you never availed on your consumer credit report as a warning sign, and the report is the clearest record.
Will my bank ask for my personal details on a call?
SBP says a bank will not call and ask for personal information, because it already has it on record. Treat such a call as a risk and hang up.
Who runs the credit bureaus in Pakistan?
SBP runs eCIB. It has also licensed two private bureaus, Aequitas Information Services Limited and Data-Check Limited, under the Credit Bureaus Act, 2015.
How long should I keep my bank statements?
SBP's guide says to keep copies of monthly statements and cheques for one year. It will help if you ever need to dispute a financial matter.
Must a bank warn me before reporting a missed payment?
Yes. The 2025 framework says the bank must send a letter and an SMS or email before reporting an overdue to eCIB, and allow at least 15 days to settle.
How we verified this
What we checked, where we read it, and what we could not confirm.
Last checked 14 October 2026. The warning signs, types and safety advice are from SBP's guide Protect Yourself From Identity Theft, linked from its consumer protection page, which also lists the private credit bureaus. The eCIB notice and reversal duties are in section 3.2.3.2 and section 5.1.1.5 of SBP's Business Conduct and Fair Treatment of Consumers Regulatory Framework. We did not file a dispute with any bureau. Helpline numbers are as SBP lists them and may change.
About the author
Global Affairs & Political Economy Writer
Muhammad Hatim is a book lover who started writing because he enjoys it. At Pakistan Era he writes about international relations, geopolitics and the global economy, with a particular interest in South Asia and the forces behind current events.
