An unprotected digital frontier

EDITORIAL: A new report by the IMF and the World Bank has put a startling figure on the price Pakistan is paying for its digital vulnerabilities, with losses from cyber-enabled financial fraud amounting to an estimated 2.5 percent of GDP, the highest proportion in Asia. It is a damning indictment of a country hurtling towards a digital future without adequately securing the path there. As technology advances at breakneck speed, the safeguards meant to protect citizens are being left far behind.

With AI, deepfakes, instant payments and sophisticated social engineering reshaping cybercrime, Pakistan’s digital expansion has outpaced investment in security, accountability and regulation.

Consider the cases of parliamentarians Farhan Chishti and Shaharyar Mahar, who reportedly lost Rs1.5 million and Rs2 million, respectively, to fraud involving duplicate SIMs and banking vulnerabilities. In Chishti’s case, a SIM issued without his authorisation enabled criminals to access online banking he had never even used.

Another victim, a businessman from Karachi lost Rs8.5 million in a scheme involving a bank insider who accessed customer information and shared it with others. These instances cannot simply be treated as isolated lapses, as they exposed far-reaching systemic failures: weaknesses in biometric verification, inadequate monitoring of SIM issuance, compromised customer data and insufficient internal controls within financial institutions.

The PTA imposed substantial fines on the cellular operator involved, but repeated breaches raise an obvious question: why have penalties failed to deter violations? Recovering stolen funds is no substitute for preventing theft in the first place.

The consequences of this regulatory complacency extend far beyond financial fraud. A Unicef study estimates that approximately 1.5 million Pakistani internet-using children aged 12 to 17 experienced at least one form of technology-facilitated sexual exploitation in a single year.

The reported abuses include sexual threats, blackmail, unwanted sexual content and the non-consensual sharing of intimate images.

AI has made this already grave problem more dangerous, enabling the creation of fabricated sexual imagery, deepfakes, and other forms of abuse. It goes without saying that a country cannot claim meaningful digital progress while millions of its children remain exposed to online predators and its protection systems struggle to respond.

Responsibility rests across the regulatory and institutional landscape. The PTA, the State Bank of Pakistan, and the Securities and Exchange Commission of Pakistan must do more than issue directives and penalise violations after the damage is done. These regulatory authorities, as well as telecom operators, banks and other businesses must invest in highly qualified cyber security personnel, stronger authentication, real-time fraud detection, tighter access controls and systems capable of identifying suspicious transactions before funds disappear. The troubling aspect here is the legislative vacuum compounding these failures.

Pakistan still lacks a dedicated, comprehensive personal data protection law that establishes clear obligations, safeguards citizens’ information and provides effective remedies when it is misused.

Cybercrime laws and enforcement mechanisms must also be fit for purpose, adequately resourced and focused on protecting victims. It often seems that these powers are more readily mobilised against critics of authority than against the pervasive threats ordinary citizens face, and the state must realise that there is an urgent need to recalibrate its priorities when it comes to dealing with cybercrime.

Pakistan must also examine age-appropriate restrictions on children’s access to social media, as Australia and some other countries have begun doing, alongside stronger platform accountability, digital literacy and accessible reporting mechanisms. The state cannot leave children to navigate online risks without meaningful protection.

Digitisation is not an end in itself. Its promise depends on whether people can use technology safely. Until Pakistan treats cyber security, data protection and child safety as essential infrastructure rather than afterthoughts, technological progress will continue to outpace the institutions responsible for protecting citizens.

Copyright Business Recorder, 2026