Check Your Debit Card Rights in Pakistan: SMS on Every Payment, Tap Without PIN to Rs 3,000

Under State Bank of Pakistan rules, your bank must send you an SMS or email for every card payment, let you switch your card on or off by channel in its app, and keep a 24/7 line open for fraud reports. Tap payments can skip the PIN only up to Rs 3,000 a time. Refunds must be credited to you as soon as the bank receives the money.

Most cardholders have never read these rules. They sit in two State Bank documents addressed to banks, not to customers. We read both on sbp.org.pk on 14 October 2026 and pulled out what each one means for you. If your bank does not do these things, you now know what to quote.

Your bank must message you after every card payment

The State Bank's 2016 card security regulations say a customer shall immediately receive an SMS on the registered mobile number, or an email, whenever a transaction is made with a payment card. Receipts must also be generated for card transactions.

That rule covers ATM cards, debit cards, credit cards and prepaid cards. It applies to banks, microfinance banks and payment companies that issue or process cards. One group is left out: government social transfer cards, which the regulations exclude.

The message is your cheapest fraud alarm. If a payment alert arrives and you did not spend, you know within seconds. If you never get alerts at all, your registered number is probably wrong or your bank has switched alerts off. Ask the branch to check the number against your CNIC.

You can switch your card on or off by channel in the app

A 2021 State Bank circular says banks must let you activate, enable and disable your card in the mobile app and internet banking. You must also be able to switch ATM, shop terminal (POS) and online use on or off, and the bank must use at least two-factor authentication.

Two-factor authentication means two different proofs, such as your app login and a one-time code. In practice this is the card control screen in your bank app. Our step by step on how to turn off online and international payments on your debit card shows how the switches look at three banks.

The same circular says banks may turn online payments on by default, but only after they have set up 3D Secure. That is the extra check where your bank sends a code before an online payment goes through. Banks that do this must tell customers the risks of using a card on foreign websites.

The circular also says magnetic stripe cards, and the fallback to the stripe on chip cards, must be blocked at the bank's end. If you travel abroad, the bank can switch the fallback on again, but only if you ask.

Tap payments can skip the PIN only up to Rs 3,000

The 2021 circular lets banks drop the extra authentication step for card-present payments, including contactless taps by card or phone, up to Rs 3,000 per transaction. It is optional for banks. They must tell customers and protect them from undue liability if the facility is misused.

So a tap of Rs 2,500 may need no PIN, while Rs 3,500 should. The word "may" matters, because this is a limit banks are allowed to use, not a number every bank has chosen. Some banks set a lower no-PIN amount.

Refunds, complaints and new cards follow set rules

Banks must credit a card refund to your account as soon as they receive the funds. They must let you lodge a complaint or dispute in the app or online banking, without visiting a branch. And they cannot send you a card you never asked for.

The 2016 regulations add more. A bank needs your consent, in writing or through a registered channel, before issuing a card. It must send an inactive card by registered courier to your address, and activate it only when you ask in person or call from your registered number. The bank cannot charge you for the switch to chip (EMV) cards. Its call centre must speak English and Urdu, and it must give you your transaction data when you ask.

If a refund from a shop is slow, the delay is usually the shop's bank. But once the money reaches your bank, it should show up straight away.

Use these rules when a card payment goes wrong

Act in the first few minutes. Block the card, note every alert, and file the complaint in writing. The rules above give you the lever for each step, and the bank's own deadlines then start running.

1. Block or disable the card in the app, or call the bank's 24/7 line. The steps to block a lost card list what banks must do.
2. Screenshot the payment alert, with the time, amount and shop name.
3. Lodge the dispute in the app or online banking, and keep the complaint number.
4. Ask for your transaction data in writing if the bank is slow.
5. If the bank does not fix it, take it to the State Bank through the Sunwai complaint portal.

For money already taken, the deadlines are in how to claim a digital fraud refund from your bank or wallet.

Common questions about your debit card rights

Must my bank send an SMS for every card payment?

Yes. The 2016 State Bank regulations say the customer shall immediately receive an SMS on the registered number, or an email, for each card transaction. If you get none, check your registered number with the bank.

Can I use my card without a PIN?

Yes, for taps up to Rs 3,000 per transaction, if your bank allows it. The State Bank lets banks relax the extra authentication step up to that amount. Above it, expect a PIN.

Can I switch my card off in the app?

The State Bank requires it. Banks must let you activate, enable and disable the card, and switch ATM, POS and online use, in the mobile app and internet banking. Whether your app shows the switches is a question for your bank.

Can a bank send me a card I did not ask for?

No. The 2016 regulations say banks shall not issue unsolicited cards and must take your consent first. Report an unrequested card to the bank and then to the State Bank if needed.

Do these rules cover wallets and prepaid cards?

They cover all payment cards, including prepaid cards, issued by banks, microfinance banks and payment companies. Government social transfer cards are excluded from the 2016 regulations.

Does my bank have to pay me back for a fraud?

These two documents do not set a refund amount. They require fraud monitoring, a dispute process and fast refunds. Your claim rights are in the State Bank's fraud refund rules.

How we verified this

What we checked, where we read it, and what we could not confirm.

Last checked 14 October 2026. We read the State Bank's Regulations for Payment Card Security (PSD Circular No. 05 of 2016, dated 10 June 2016) and PSD Circular Letter No. 02 of 2021 (19 February 2021) in full. We did not test any bank's app, and banks may apply the rules differently. Check your own bank's current card terms.