Increase font size Decrease font size Reset font size

Who bears liability in financial fraud?

2026-05-04
AS Pakistan moves steadily towards digital banking and mobile-based financial services, convenience has become the defining feature of everyday transactions.

This transformation has also exposed citizens to a growing form of financial crime: SIM swap fraud. In several reported cases, individuals have abruptly lost mobile network access, only to discover hours later that substantial sums have been transferred out oftheirbank accounts.

Such incidents raise a pressing question; who bears the legal responsibility for these losses: the customer, the bank or the telecommunication operator? SIM swap fraud typically occurs when afraudstersucceedsin obtaininga duplicate SIM card issued in the victim`s name. Once the original SIM is deactivated, the criminal gains control of onetime passwords (OTPs) and banking alerts.

This enables unauthorised transactions to be completed swiftly, often before the victim becomes aware of the breach.

At first glance, responsibility appears diffused. Banks frequently point out that transactions were authenticated through OTP verification, implying that the system functioned as designed. Telecommunication operators maintain that SIM reissuance follows biometric verification protocols mandated by regulators. If both safeguards are well in place, how then do such frauds continue to occur? The answer may lie in systemic weaknesses rather than individual negligence.

Customers undoubtedly have obligations: safeguarding personal information, exercising caution in sharing identity documents, and promptly reporting suspicious activity. However, it is unrealisticto expectan ordinarybank user to anticipate sophisticated schemes that may involve identity misuse, compromised retail outlets, or internal collusion. When a SIM is reissued without the genuine subscriber`s knowledge, the customer is placed ata structuraldisadvantage.

Telecommunication operators form a critical link in this chain. SIM issuance and reissuance are subject to biometricverification requirements intended to prevent identity abuse. If duplicate SIMs are issued without strict compliance, it raises concerns regarding oversight, internal controls, and accountability of franchise operators. Weak enforcement mechanisms or gaps in verification procedures can directly facilitate financial harm.

Banks, too, operate under a duty of care.

Modern financial institutions employ risk-based monitoring systems designed to detectunusualtransaction patterns, rapid fund transfers, or device changes.

Where large sums are transferred within a short span without triggering effective intervention, questions inevitably arise about the robustness of fraud detection frameworks.

Comparative practice offers useful guidance. In several jurisdictions, consumer protection frameworks recognise that digital banking systems are controlled and designed by institutions, not customers.

Where unauthorised transactions are promptly reported, the burden often shifts to the financial institutions to demonstrate customer negligence. This reflects a broader principle: liability should correspond with control over the system.

Pakistan`s cybercrime and banking regulations criminalise unauthorised access and electronic fraud. However, criminalisation alone does not resolve the question of civil liability or compensation.

Clearer regulatory standards may be required to determine responsibility where institutional safeguards fail. Coordination among banking regulators, tele communication authorities, and investigative agencies is essential to establish predictable accountability me chanisms.

Beyond individual cases, the broader concernis the erosion of digitaltrust.

Pakistan`s policy direction increasingly emphasises financial inclusion and digital payments. Such ambitions depend upon public confidence.

If citizens perceive that losses arising from technological vulnerabilities will leave them entangled in prolonged disputes over liability, adoption of digital platforms may slow down. The issue, therefore, is not merely about assigning blame, but about strengthening accountability.

Waqar Ali Mahar Karachi