NCCIA Arrests Bank Manager for Selling NADRA Verisys Records to Fraudsters
NCCIA Lahore says an Arifwala bank manager sold NADRA Verisys records of elderly and dead citizens to fraudsters, paid via JazzCash. Check your own CNIC now.
The National Cyber Crime Investigation Agency (NCCIA) in Lahore has arrested a bank operations manager accused of pulling citizens' identity records from NADRA's Verisys system and selling them to online fraudsters. NCCIA Lahore Zone Additional Director Atif Ameer announced the arrest to the media on Saturday 10 October 2026. The suspect worked at a bank branch in Arifwala.
This one matters to ordinary account holders. Verisys is the system banks use to confirm who you are. If someone inside a bank sells those records, a fraudster gets your name, CNIC details and family data without ever touching your phone.
According to the NCCIA official, the records were mostly those of elderly and deceased citizens. Those are the people least likely to notice a new account or SIM opened in their name.
NCCIA says the manager sold Verisys records for a few hundred rupees each
The NCCIA says the suspect used his authorised access to the verification system to take citizens' records and pass them to online fraudsters. Payment was a few hundred rupees per record, according to the agency's account given on 10 October.
Three further details came from the same briefing:
- The suspect reportedly started after seeing a Facebook advertisement for a "verification officer" job.
- He never met the people who bought the data in person.
- A technical check of his phone found WhatsApp chats holding thousands of Verisys records of Pakistani citizens.
Reports of the daily volume and the exact price per record differ. One figure circulating on 10 October put it at about 130 records a day at Rs 150 each. The NCCIA statement we could trace says only "a few hundred rupees per record", so we are not treating the higher-detail figure as confirmed. The bank has not been named by the agency, and we do not name it here.
The payments ran through a JazzCash account in an elderly person's name
Investigators say the suspect was paid through JazzCash. The money reportedly came through a JazzCash account registered in the name of an elderly person. The NCCIA says it is now examining that account holder's role, and the role of the people who sent the payments.
That detail fits the pattern the agency described. Data of older and dead citizens is useful to fraudsters because it can open "parking" accounts: wallets and SIMs that receive stolen money and move it on. A wallet in a 75-year-old's name, which the real person has never seen, is hard to trace back to the criminal using it.
The NCCIA says it is still working out who received the data, how it was used in online fraud, and who else belongs to the network.
Verisys is supposed to need your consent before anyone checks you
NADRA describes Verisys as a web portal for citizen consent, OTP based verification, which lets banks and other clients instantly verify a CNIC, NICOP or POC number. NADRA's verification page also lists two-factor authentication for users who access its ID verification services. In plain words, a bank employee should need a login, a second code and a valid reason before pulling your record.
The case shows the weak point is not the database itself. It is a person with a real login who uses it for the wrong reason. That is why the checks you can run on your own CNIC still matter, even if you never shared anything.
| What happened | What is confirmed | What is not yet known |
|---|---|---|
| Arrest | A bank operations manager in Arifwala, announced 10 October 2026 | Charges filed and court date |
| Data taken | Verisys identity records, mostly of elderly and deceased people | Exact number of people affected |
| Payment route | JazzCash, through an account in an elderly person's name | Who controlled that account |
| Buyers | People involved in online fraud, never met in person | Their names and how many |
Check your own CNIC and your parents' records this week
You cannot find out from NADRA whether your record was in this batch. You can check whether anything has been opened in your name. Do it for elderly parents too, because they were the main target.
- Check how many SIMs are on your CNIC and block any you did not buy. The steps are in checking SIMs registered on your CNIC.
- If a parent or grandparent has died, get their CNIC cancelled with NADRA so the record cannot be reused. Cancelling a CNIC after a death is free.
- Read your bank and wallet SMS alerts for any account or card you do not recognise.
- Never read out a code from an SMS to a caller, even one who says he is from a bank or NADRA.
- If money has already moved, call your bank first, then complain to the NCCIA.
We have set out the full set of checks, with the NADRA helpline and what to do if you find a wallet you never opened, in protecting your CNIC from misuse.
The arrest is part of a wider NCCIA push this month
This is not an isolated case. In the same week the NCCIA announced raids on several call centres, including 281 arrests at 7 Lahore call centres announced on 9 October. The Interior Minister has told the agency to treat online fraud faster, and the agency's leadership is publicly briefing on arrests almost daily.
An arrest is not a conviction. The suspect has not been tried, and everything above is the agency's account of its preliminary investigation. We will add the outcome when the NCCIA or a court publishes it.
Common questions
Was my CNIC data sold in this case?
Nobody can tell you yet. The NCCIA has not published a list, and NADRA has not said whose records were taken. Check your SIMs and accounts instead of waiting.
What is NADRA Verisys?
It is NADRA's portal that lets banks and other approved clients verify a CNIC, NICOP or POC instantly. NADRA says it works on the citizen's consent through an OTP.
Which bank did the suspect work for?
The NCCIA did not name the bank in its statement. It said only that he was an operations manager at a branch in Arifwala.
Why were elderly and deceased people targeted?
Their identities are less likely to be watched. A wallet or SIM opened in their name can receive stolen money for months before anyone notices.
Where do I report CNIC misuse?
Report to the NCCIA through its complaint portal, and to your bank or mobile network if an account or SIM was opened in your name. NADRA's helpline is 1777.
How we verified this
What we checked, where we read it, and what we could not confirm.
We checked on 10 October 2026. The arrest, the Arifwala branch, the JazzCash payments and the focus on elderly and deceased citizens are from the statement by NCCIA Lahore Zone Additional Director Atif Ameer to the media on 10 October 2026, carried by the state news agency. We could not read it on the NCCIA's own site, which blocked our request. The description of Verisys as consent and OTP based, and two-factor authentication for users, is from NADRA's verification services page. NADRA's 1777 helpline is from NADRA's own site.
About the author
Technology Journalist & Multimedia Producer
Ahmad Ali is a technology journalist and multimedia producer at Pakistan Era, joining the team in October 2026. He covers consumer technology and digital life for Pakistani readers, combining research with hands-on product testing.
