Cyber fraud has become one of the most pervasive forms of financial crime in Pakistan, and the state is still struggling to build a response commensurate with its scale. More than 227,000 people reported being defrauded of Rs8.32 billion over the past three years. The figures are staggering even before accounting for the thousands who never report smaller losses. For many victims, the loss of a few thousand rupees may not justify the time and effort involved in pursuing a complaint. For the fraudster, however, thousands of such transactions constitute a highly profitable business.
The sophistication of these crimes has also changed the nature of the threat. Fraudsters routinely impersonate bank officials and other trusted institutions, while WhatsApp accounts and telephone numbers provide convenient tools for establishing credibility. The victim is often manipulated into authorising the transaction personally, leaving institutions with a difficult question of where responsibility begins and ends. The institutional response to this has been weak, and it can only be meaningful when it changes the risk calculation for criminals. There is a policy issue here that deserves greater attention. Pakistan is actively promoting digital payments and greater financial inclusion. The State Bank has introduced a technology risk management framework for payment institutions, requiring stronger controls against cyber risks, while its consumer protection framework has also been strengthened.
The next step should be to measure these policies by outcomes. How quickly are suspicious transactions detected? How rapidly can a compromised account be frozen? How much stolen money is recovered? How many repeat offenders are identified across different complaints? Public awareness remains necessary, but telling citizens to recognise suspicious calls cannot become a substitute for institutional safeguards. Pakistan cannot expect public confidence in its digital economy to grow while cyber criminals continue to treat citizens’ accounts as easy targets.
