“Hello!”
“I’m calling from the Saddar Police Station.
Are you Faheem Siddiqui?”
I was about to leave for the office when a call from an unknown number startled me. The voice on the other end asked sternly, in a typical police-like tone. After I confirmed, he continued, “Your nephew is currently in our custody at Saddar Police Station. An FIR has been filed against him. He, along with two other boys, met a girl and gave her something that caused her death. Now, we need to present him before the SSP.”
He paused for a moment, likely to gauge my reaction, but I remained silent. After a brief pause, the man resumed and said, “If you send us some money, we won’t present your nephew before the SSP, and we’ll put the blame entirely on the other two boys.”
This wasn’t a new story for me. Two or three colleagues at my office had received similar calls and ended up transferring large sums of money to “save” their nephews from appearing before the SSP. By the time they realized it was a fraud, it was already too late, and they shared their experiences with me later.
My continued silence probably gave the caller the impression that I was terrified, which is likely what happens with most victims. This time, his tone softened, sounding a bit empathetic. “Don’t worry,” he said. “Kids make mistakes. Just transfer two lakh rupees immediately, and everything will be fine.”
To push the conversation forward, I asked, “Which nephew of mine do you have in custody?”
People usually don’t ask this question because they’re so scared at this point.
The caller was caught off guard but quickly changed tactics and responded rudely, “Hey, don’t you understand what I’m saying? Talk to your nephew yourself.”
At that moment, a trembling voice came on the line, pleading, “Uncle, please save me! They’ve beaten me up badly.” A loud slap followed, and the voice broke into uncontrollable sobbing.
The original caller returned, saying, “Satisfied now? It’s your nephew, right? What’s his name?”
This is where most people unknowingly provide a name themselves, and the fraudster uses that name to advance the scam. I decided to play along and gave him the name of my three-year-old nephew, who was playing nearby.
The man replied confidently, “Yes, that’s the name he gave us.”
Such tactics are often enough to intimidate unsuspecting citizens into complying with the demands. Most don’t even bother verifying the claims by calling the supposed nephew or their parents. The fabricated stories usually prey on people’s fear of disgrace, pushing them to fulfill the fraudsters’ demands.
Since I was in a hurry to get to work and well aware of such scams, I hung up the call. However, I kept receiving calls from this number and others throughout the day.
The first case of this kind occurred months ago with a senior colleague at my office. He transferred a total of 800,000 rupees in three installments before realizing it was a scam. He, too, had received a call claiming to be from the Saddar Police Station. Interestingly, most cities have an area called Saddar with a police station, making it easier for scammers to sound credible. My colleague was told the incident occurred in Hyderabad, so I contacted DIG Hyderabad, Pir Muhammad Shah, and shared the caller’s number with him. Within moments, the number’s location was traced to Bahawalpur.
On the DIG’s advice, I asked my colleague to call his nephew, only to find out the boy was safely at home.
In Pakistan, thousands of people, including politicians and judges, have fallen victim to such phishing scams. Yet, the performance of law enforcement agencies in tackling this issue remains abysmal.
Phishing is a scam used to steal personal or financial information through deceptive means, often over the internet.
Read More: Why Most People in Pakistan Fail the Driving Test: A Complete Guide to Acing It
But the question arises: How did such personal data of citizens become accessible online?
Whenever a phishing call is made, the scammer often addresses the victim by their full name and even uses their CNIC number as proof of legitimacy. This tactic is frequently employed in banking frauds, where people are asked for their ATM card number and the three-digit CVV or CVC code on the back, under the pretext of account verification. With these details, scammers can easily use the card online.
Regardless of the method, scammers need three key pieces of information: the victim’s name, phone number, and CNIC number. With these, they can easily convince the victim they’re from a legitimate institution. Unfortunately, this sensitive data of Pakistanis is readily available online.
This might sound shocking to many readers, but it’s true. Websites and Android apps store this data, which is invaluable to phishing scammers.
By entering a CNIC number, these platforms can reveal the associated phone numbers, or vice versa. With this trifecta of information, scammers can easily impersonate officials or bank representatives.
When I raised this issue with NADRA Chairman Tariq Malik, he categorically denied that this leaked data came from NADRA. According to him, NADRA’s data is secure and cannot be stolen. Instead, he claimed the data had been stolen from mobile companies.
He explained that while mobile companies verify customers’ information through NADRA’s system, they shouldn’t retain the data. Yet, they do.
Similarly, banks also access NADRA’s database for verification purposes. The personal data circulating online likely originates from mobile companies or banks and has been sold on the black market. Websites and apps then purchase this data and host it on their servers.
The PTA (Pakistan Telecommunication Authority) has the authority to block such websites and apps, but so far, only a handful have been identified and acted upon. Even when websites are blocked in Pakistan, they often remain accessible from abroad, enabling scammers to continue their operations.
The FIA Cybercrime Wing holds the authority to go a step further by prosecuting these scammers and dismantling their networks. However, their actions remain negligible despite countless complaints from citizens.
Interestingly, when tracing the location of phishing calls, they often originate from remote areas in southern Punjab, near rivers or forests. Conducting operations in these areas to recover a few thousand or lakhs of rupees seems unlikely.
This situation highlights the urgent need for better enforcement and updated systems to protect citizens from phishing and cybercrime. If ignored, as the popular tagline from the Indian Netflix series Jamtara warns, “Sab ka number aayega” (Everyone’s turn will come).
Follow Day News on Google News, Instagram, YouTube, Facebook, Whats App, and TikTok for latest updates
