Illegal SIM sites: How the Scam Works [2026]

illegal sim sites promise the impossible: type any number and get its owner’s name, address and live location. No such legal service exists in Pakistan. This post names the pattern, the law and the cases, linking to none of them.

The Promise vs the Law

The pitch never changes: a search box over a claimed database of verified telecom registration records, promising name, network, city of registration, even live location and call history. One observed page claims a reverse lookup across 150 million numbers.

Against that stands PTA’s statement of 9 September 2025: it does not hold or manage subscriber data, which remains solely with licensed operators, having blocked 1,372 websites, apps and social media pages selling personal data. The record behind a number moves lawfully only through legal process, under section 54 of the Pakistan Telecommunication (Re-organisation) Act 1996. An insider who leaks it instead faces PECA section 41: up to 3 years and/or Rs 1,000,000.

Five Faces of the Scam

Five patterns do the work; most pages combine several.

Pattern	What it really does
Fake lookup sites	The result is bait; the form harvests your CNIC
“NADRA database” sellers	Social media and WhatsApp sellers charging for leaked or invented data
Malicious apps and APKs	Installs that steal data while promising SIM records
Copycat portals	Lookalike pages imitating NADRA, PTA and official services
CNIC harvest forms	Your own details collected for SIM fraud against you

Underneath sits the harvest. As one investigation of a branded template family put it, “the search box is the collection tray”: every typed number and CNIC is bundled and resold, and a blocked domain reskins onto a new address within a day. In October 2026 the National CERT detected phishing domains impersonating NADRA, PTA, the FIA, BISP and other bodies.

The Red Flags: 12 Checks

Twelve flags, all visible on the page:

• A name, CNIC or address promised for any typed-in number.
• Live location, call history or CDR data.
• Your CNIC demanded to reveal someone else’s record.
• Results locked behind a reveal fee.
• An APK install, or apps pushed by message links.
• A name or design imitating an official body.
• No official domain: real portal cnic.sims.pk; government sites end .gov.pk.
• WhatsApp-only contact, with no accountable owner.
• Countdowns and urgency pressure tactics.
• An OTP, PIN, password or bank details demanded.
• A public database no official channel links to.
• A price list by record type, or bulk data.

The positive test: send your own CNIC to 668 for an operator-wise count; the cnic.sims.pk portal returns the same count free. 667 answers only for the SIM in your hand, masked; 76367 returns a network name only, and a network is not an identity.

The Enforcement Record (and the Buyer’s Risk)

In July 2026 the NCCIA arrested three men in Lahore after a written PTA complaint (FIR No. 146/2026): alleged sales of CDRs, SIM ownership records and location data. APP and The News reported seizures of 14 phones, nine BVS devices, 38 SIMs and 60 fingerprint copies; a second account lists fewer, never blended here. September 2026 brought two more arrests over a website trading as Mini NADRA, its 3 terabytes said to cover more than 10 million citizens, plus the Khoji platform. October 2026: a bank operations manager arrested for allegedly selling NADRA Verisys records to fraudsters found through a Facebook ad.

The buyer is not safe either. PECA section 16 covers obtaining, possessing or using another’s identity information without authorisation (up to 3 years and/or Rs 5,000,000), buyer no less than seller. Section 17 adds unauthorised issuance (3 years and/or Rs 500,000). Sellers often vanish with the money, or send invented data.

Already Used One? Damage Control

Typed your CNIC into one, or paid? Act now. Keep dated screenshots and the payment reference, then run the 668 check regularly. Disown any SIM you do not recognise, watch your bank and wallet for unrequested codes (the bank fraud guide covers the first hour), and uninstall any APK you installed. Report the site to PTA and the seller to the NCCIA on 1799.

If your own details surface on one, do not pay for removal. Keep the evidence, check your record as above, and use the NCCIA route; Section 16(2) lets you apply to have it secured, blocked or destroyed.

FAQs

Can I check SIM owner details online?

Only your own count, via 668 or the portal; never another’s name or location.

Is it legal to check someone’s SIM owner details in Pakistan?

No. PECA section 16 covers obtaining or using identity information without authorisation: 3 years and/or Rs 5,000,000.

Are websites offering SIM databases or SIM owner searches legitimate?

No. PTA holds no data; 1,372 such pages were blocked by September 2025.

What happens to a CNIC typed into one of these pages?

It becomes the product: bundled and resold. Run the 668 check every few months.

Can 667 tell me who owns another mobile number?

No. 667 answers only from the SIM in your hand, masked.

What should I do if an unknown number is harassing me?

Complain to the NCCIA or police; investigators can obtain it under Telecom Act section 54.

What if I find a SIM on my CNIC that I never bought?

Visit the operator’s franchise with your original CNIC; have it blocked and disowned.

Where can I report illegal telecom data sales or a suspected data leak?

The NCCIA on 1799 or its portal; PTA through its Complaint Management System.

Can I track my SIM card location?

Not through any public service, only in illegal sellers’ lists.

Kisi aur ke number ke malik ka naam online mil sakta hai?

Nahi. Sirf apne CNIC ka count milta hai, 668 ya portal se; baqi sab scam hai.

Conclusion

No public SIM database exists, and none can legally exist. Test any lookup page against the real checks (your own count, a masked record, a network name) and the promise collapses. For the record behind a harassing number, the route is a complaint, not a website: see how to file a PTA complaint and the PECA guide.