Protect Your CNIC From Misuse in Pakistan: 6 Free Checks After the Verisys Data Case

To protect your CNIC from misuse in Pakistan, run six free checks: count the SIMs on your CNIC, block any you did not buy, never share a verification OTP, get a dead relative's CNIC cancelled, watch your bank and wallet alerts, and check your credit record through a licensed bureau. NADRA's helpline is 1777. If something was opened in your name, report it to the operator or bank and to the NCCIA on the same day.

On 10 October 2026 the NCCIA said a bank operations manager in Arifwala had sold citizens' NADRA Verisys records to online fraudsters, mostly records of elderly and dead people. None of those victims shared a password. Their data simply left through someone with a real login.

You cannot stop an insider. You can make sure anything opened with your CNIC gets noticed fast, which is what makes stolen data worth less to a fraudster. Every check below costs nothing and takes a few minutes.

Your CNIC can be misused without your phone or fingerprint

A fraudster with your CNIC details wants a "parking" account: a SIM or wallet in your name that receives stolen money and passes it on. Your identity becomes the front for someone else's crime. The investigation, when it comes, starts with the name on the account.

Verisys is NADRA's portal for banks and other approved clients to verify a CNIC, NICOP or POC instantly. NADRA describes it as consent based, using an OTP, and says users accessing its verification services now need two-factor authentication. Those controls protect the database. They cannot stop a person who already has access from copying records, which is what the NCCIA alleges happened in Arifwala.

So the useful question is not "was my data leaked?" Nobody will tell you that. It is "has anything been opened in my name?" That one you can answer.

Six checks to run on your own CNIC

Do these once now and again every few months. Put a reminder on your phone, the same way you would for a bill.

1. Count your SIMs. Use the official SIM count check described in checking the SIMs on your CNIC. It gives a count per network, not the numbers.
2. Block any SIM you did not buy. Go to that operator's own franchise with your original CNIC and verify by fingerprint. Ask for the numbers on your CNIC and block the strangers.
3. Treat every verification code as your signature. Never read an OTP to a caller, even one who says he is from NADRA, a bank or the PTA.
4. Read your alerts. A welcome SMS from a wallet you never opened is the clearest warning you will get.
5. Check your credit record through a licensed private credit bureau for loans or cards you did not take. The route is explained in checking your credit report in Pakistan.
6. Cancel the CNIC of a relative who has died, so the record shows the person is dead and cannot be reused.

A verification OTP is the same as signing your name

NADRA's own description says Verisys checks rely on the citizen's consent through an OTP. That code exists so nobody can check you without you. The moment you read it out to a stranger, the consent is his.

Scammers know this. A common script is a caller saying your CNIC is "blocked" or your SIM needs "re-verification", then asking for the code that just arrived. No genuine NADRA, PTA, bank or wallet staff member will ask you for that code on a call. Hang up and call the official number yourself. If the call showed an official-looking number, read how to check a spoofed PTA, NCCIA or bank call.

We would add one more habit. Do not send a photo of both sides of your CNIC on WhatsApp to anyone you have not met, including "job agents" and "loan officers". The NCCIA says the Arifwala suspect himself was recruited through a Facebook advertisement for a verification job.

Elderly parents and dead relatives need these checks most

The NCCIA said the Arifwala records were mainly of elderly and deceased citizens. That is no accident. An 80-year-old rarely reads wallet SMS, and a dead person's CNIC sends no alerts to anyone.

For a living parent, run the six checks with them, on their phone, at their pace. Set the SIM PIN on their phone too. A locked SIM stops someone who picks up the phone from receiving their codes.

For a relative who has died, NADRA issues a cancellation certificate under section 17(3) of the NADRA Ordinance 2000, which records that the identity document is cancelled because of death. The steps and the free fee are in cancelling a CNIC after a death. If the person had a SIM the family still uses, move it into a living person's name rather than leaving it on the dead person's CNIC.

Found a wallet, SIM or loan you never opened? Act the same day

Speed decides how much damage a parking account does. Work through these in order, and keep every reference number you are given.

• SIM: visit the operator's franchise, verify by fingerprint and block it. If the operator will not help, use PTA's route for an unknown SIM on your CNIC.
• Wallet or bank account: call the provider's helpline from its official app or website, say the account was opened without your consent, and ask for it to be blocked and closed. Get a complaint number.
• Loan or card: dispute it with the institution that reported it and with the credit bureau.
• Crime report: complain to the NCCIA through its complaint portal, attaching screenshots of every SMS and the reference numbers above. The process is set out in reporting a cybercrime in Pakistan.

If a bank does not resolve the complaint, the Banking Mohtasib takes it for free. Do not pay anyone who offers to "clear" your CNIC for a fee. No such service exists.

Common questions

Can I check whether my CNIC was in the Verisys data sold in Arifwala?

No. Neither the NCCIA nor NADRA has published whose records were taken. Check what is open in your name instead.

Is there one place that shows every account on my CNIC?

No single public service does that. SIMs, wallets, bank accounts and loans are checked separately, through the routes in the table above.

Will NADRA ever call me for an OTP?

You should treat any call asking for a code as a scam. NADRA describes the Verisys OTP as your consent, so the code is for you to use, not to read out.

Does cancelling a dead relative's CNIC cost anything?

It is free. Apply at a NADRA centre with the death certificate, as explained in our step-by-step on cancelling a CNIC after a death.

What is NADRA's helpline number?

1777. NADRA's site also lists +92 51 111 786 100 and the complaint email csd@nadra.gov.pk.

How we verified this

What we checked, where we read it, and what we could not confirm.

We checked on 10 October 2026. The Verisys description, consent through OTP and two-factor authentication for users are from NADRA's verification services page. The cancellation certificate under section 17(3) and the helpline 1777, +92 51 111 786 100 and csd@nadra.gov.pk are from NADRA's cancellation page. The Arifwala case is the NCCIA Lahore Zone statement of 10 October 2026, covered in our news on the bank manager's arrest. Fingerprint verification for SIM replacement is from Jazz's own help FAQ. We did not test any wallet helpline for an account opened without consent, so ask the provider for its current process.