People usually discover it sideways. A tax notice for a business you have never run. A recovery call about a loan you never took. A police enquiry about a SIM used in a crime. A company appearing in your name with directors you have never met.

Your CNIC is the key to almost everything in Pakistan, and when it is misused the consequences arrive in every direction at once.

First: find out what exists in your name

Before complaining, establish the scope.

SIMs. PTA operates a mechanism to check how many SIMs are registered against a CNIC, and to request blocking of those you did not authorise. Check it. The legal limit exists precisely because SIMs registered to strangers are used for fraud and worse.

Bank accounts. Ask your banks, and raise it with the State Bank's complaint mechanism where an account has been opened without you.

Companies and firms. SECP's public company search shows companies and the persons associated with them. Search your own name and CNIC.

Tax. Check your FBR profile for registrations, returns and notices you did not file. See FBR audit notices.

Vehicles and property. Excise records for vehicles; the registry for property.

NADRA record itself. Confirm your own record is correct, and that no duplicate or altered entry exists. See a blocked CNIC and NADRA problems.

How it usually happens

  • A photocopy of your CNIC given for a routine purpose — a rental, a job application, a courier, a society form — and reused
  • Biometric capture at a franchise or agent, where a second transaction is run while your thumb is on the scanner
  • Data taken by someone with legitimate access — an employer, a shop, an agent
  • A relative or former partner who had your documents
  • A forged CNIC using your number

The biometric point matters. When you give a thumb impression, ask exactly what is being processed, and check the confirmation message before you leave.

The complaints to file

PTA — for SIMs issued without your authorisation. Block them, and record the complaint numbers.

FIA Cyber Crime Wing — where the misuse is electronic: accounts, digital wallets, online loans, impersonation. This is also the route where a SIM in your name has been used to commit an offence. See reporting online fraud and cybercrime and an FIA notice.

Police FIR — for forgery, cheating and impersonation where you can identify what was done. See how to file an FIR.

NADRA — to correct your record and to raise a duplicate or fraudulent entry.

SECP — where a company has been incorporated using your identity, or you have been shown as a director or subscriber without consent. This needs to be dealt with formally: an unwitting "director" carries filing obligations and potential liability while the record stands.

The bank or lender — in writing, disputing the account or facility and requiring it to be reported as disputed while investigated.

FBR — where registrations or returns exist in your name.

Keep a single file with every complaint number and every response. You will be asked for the same chronology by each authority.

Undoing the consequences

Blocking the misuse is only half of it. The damage tends to persist in records:

A company in your name. Application to SECP, supported by evidence, to rectify the register — and, where forged documents were filed, a criminal complaint. Do not ignore this: penalties for non-filing accrue against the company and its recorded officers. See registering a company with SECP.

A tax registration or unpaid demand. Dispute it formally rather than paying to make it go away; an unchallenged demand becomes an enforceable liability. See withholding tax and FBR obligations.

A loan or credit record. Dispute in writing with the lender and require the entry to be marked disputed with the credit bureau. Unresolved entries block your own borrowing for years.

A criminal case arising from a SIM or account. Take it seriously and early — you may be summoned as the registered holder. Evidence that you reported the misuse before the enquiry is the strongest thing you can have, which is another reason to file complaints as soon as you discover anything.

A blocked CNIC or travel difficulty as a knock-on effect. See a blocked CNIC.

For overseas Pakistanis

Identity misuse against people living abroad is common, because you are not here to notice. The recurring versions: a SIM taken on your NICOP, a company formed in your name by a "business partner", or an old power of attorney used long after the transaction it was given for.

Two habits: check your SECP and PTA position once a year, and revoke powers of attorney in writing the moment the purpose is served, with notice to the sub-registrar and any society or authority. See powers of attorney from abroad and property scams against overseas Pakistanis.

Reducing exposure

  • Write the purpose and date across any CNIC photocopy you hand over
  • Do not send CNIC images over WhatsApp to people you have not verified
  • Watch what is processed when your biometrics are taken, and read the confirmation SMS
  • Keep phone numbers registered to you actually in your possession — an unused SIM in a drawer is a liability
  • If you are a business holding customers' CNIC data, secure it and restrict access. Leaked customer identity data is a serious matter. See data protection for Pakistani businesses

How the firm can help

We map what actually exists against a client's identity, file and follow the complaints across PTA, NADRA, FIA, SECP, FBR and the banks, apply to rectify company and tax records, and defend clients drawn into proceedings because something was registered in their name.

See regulatory and compliance, or contact the firm. The earlier a misuse is reported, the easier every later step becomes.