Abdullah Kamran
Pakistan is rushing into the digital age. It is not protecting the road it travels on. A recent joint assessment by the IMF and the World Bank estimates that cyber-enabled financial fraud now costs the country about 2.5 percent of its GDP. That is the highest share in Asia. The figure is not merely an economic statistic. It is a verdict on how the state has approached digitisation: with enthusiasm for expansion and neglect for protection.
The nature of cybercrime has changed. Artificial intelligence, deepfakes, instant payment systems and refined methods of social engineering have given criminals tools that grow sharper every month. Pakistan has expanded mobile banking, digital wallets and online services at speed. It has not invested in security, accountability and regulation at the same pace. The gap between the two is where citizens are losing their money, their privacy and, in many cases, their dignity.
Consider what happened to two members of parliament. Farhan Chishti and Shaharyar Mahar reportedly lost Rs1.5 million and Rs2 million respectively through fraud linked to duplicate SIM cards and weaknesses in banking systems. In Chishti’s case, a SIM was issued without his consent, and criminals used it to enter an online banking account he had never even activated. If lawmakers cannot protect themselves, what chance does an ordinary citizen have?
The trouble goes deeper. A Karachi businessman lost Rs8.5 million in a scheme in which a bank insider obtained customer information and passed it to others. These are not isolated accidents. They point to failures in the system itself: weak biometric verification, poor oversight of SIM issuance, leaked customer data and fragile internal controls inside financial institutions. Each case is a symptom. The disease is institutional.
The Pakistan Telecommunication Authority did impose heavy fines on the cellular operator involved. Yet the breaches keep recurring. This raises a simple question: if penalties do not deter, what purpose do they serve? Punishment after the theft is not protection. Recovering stolen money, when it happens at all, cannot replace a system that stops the theft in the first place.
The damage of this complacency is not limited to bank accounts. A Unicef study estimates that around 1.5 million Pakistani children between 12 and 17 who use the internet faced at least one form of technology-facilitated sexual exploitation within a single year. The abuse includes sexual threats, blackmail, exposure to unwanted sexual material and the sharing of intimate images without consent. Artificial intelligence has made this danger graver still. Fabricated sexual images and deepfakes can now be produced with ease, and children are the most defenceless targets.
Let us be clear. A country cannot claim digital progress while millions of its children remain open to online predators. Progress that leaves the young unprotected is not progress. It is exposure.
Responsibility is shared across the regulatory landscape. The PTA, the State Bank of Pakistan and the Securities and Exchange Commission of Pakistan cannot limit themselves to issuing directives and imposing fines once harm is done. Regulation must become preventive. Regulators, telecom companies, banks and digital businesses must hire capable cyber security professionals. They must adopt stronger authentication, real-time fraud detection, strict access controls and systems that flag suspicious transactions before the money vanishes. Security is not a cost to be minimised. It is the foundation of trust.
The deeper failure is legislative. Pakistan still has no dedicated and comprehensive personal data protection law. There is no clear framework defining what institutions owe citizens in handling their data, how that data must be safeguarded and what remedy a citizen has when it is misused. Without such a law, every database is a potential leak and every leak goes largely unanswered.
Cybercrime laws and their enforcement also need serious reform. They must be fit for purpose, properly resourced and centred on victims. Too often, it appears that these powers move faster against critics of those in authority than against the criminals who prey on ordinary people. This is a distortion of priorities. The state must decide whom its cyber laws exist to protect: the powerful from criticism, or the public from crime. Its answer should be obvious.
Children need particular attention. Pakistan should study age-appropriate limits on social media access, as Australia and several other countries have started to do. Such measures must come with stronger accountability for platforms, wider digital literacy and reporting channels that a frightened child or parent can actually use. Leaving children to face online dangers alone is a failure of the state’s most basic duty.
Digitisation is not an achievement in itself. Its value lies in whether people can use technology without fear. Until cyber security, data protection and child safety are treated as core national infrastructure, Pakistan’s technology will keep racing ahead of the institutions meant to protect its people. The state must close that gap. It must do so now.
The best-selling books of Republic Policy Think Tank, including the landmark book The Bureaucratic Coup, are available at Vanguard Books, Liberty Books, Readings, Kitab Sarai, Sang-e-Meel, Saeed Book Bank Islamabad, National Book Foundation, and others across Pakistan. Contact for home delivery: 0300 9552542.
