• IO highlights complex electronic fraud schemes devised by the suspect in interim charge sheet in data theft case
• Says Armaghan planned to shift call centre operations to Lahore and Islamabad
• Seeks more time to file final report as record from crypto exchanges still awaited

KARACHI: The investigating officer (IO) of the National Cyber Crime Investigation Agency (NCCIA) has informed a judicial magistrate that the prime suspect in the credit card data theft case, Armaghan Qureshi, had rented two properties to set up call centres in Lahore and Islamabad after the murder of Mustafa Amir.

The IO of the case, Ameer Ali Khoso, submitted this information in an interim charge sheet before the judicial magistrate (South), stating that more time was needed to file the final report as records from Binance and Coinbase were still awaited. He added that some documentary and digital evidence also remained to be collected.

Regarding the call centre operations, the IO claimed that during interrogation, the suspect revealed that he had decided to shift his operations after Mustafa’s killing. He allegedly paid rent to set up two call centres — one near PIA Society in Lahore for a monthly rent of Rs300,000, for which he the paid amount in advance.

In Islamabad, he allegedly acquired a facility on Data Khan Ganj Bakhsh Road, for which a total advance of Rs1.9 million was paid through a combination of cash and a servant’s bank account used under the tenant’s name.

Regarding the modus operandi of “illegal” call centre, the NCCIA explained in the report that the agents — who were hired by using multiple job seeking platforms — collect the sensitive personal information of victims’ through spoofed caller IDs while impersonating representatives of legitimate entities.

After collecting the data, agents were instructed to store the data in a software, which was under control of Armaghan, the report said, adding that later the suspect used that information to initiate unauthorised transactions by using various payment gateways, including Authorize.net, Stripe, Maverick Payment and others.

“All of these gateways were linked to US based LLC accounts registered under the name of Armaghan, his father and his father’s friends in different banks such as Bank of America and Wells Fargo,” the NCCIA claimed. “After the transaction the amount was converted into cryptocurrency including Bitcoin by using digital wallets.”

The report alleged that the suspect had masterminded and operated a transnational cybercrime racket involved in financial fraud, electronic theft, forgery, unauthorised fund transfers, digital identity misuse, cryptocurrency laundering, and international scams.

It added that his use of digital wallets, dark web transactions, and identity fraud indicated premeditated and systematic criminal activity.

The NCCIA claimed that the digital forensics analysis report confirmed that incriminating evidences were available on these digital devices like VoIP software, VPN software, access to United States Patent and Trademark Office (USPTO) portals and extraction of registered trademark serials.

The case was registered against Armaghan under Sections 3 (unauthorised access to information system or data), 4 (unauthorised copying or transmission of data), 13 (electronic forgery), 14 (electronic forger), 16 (unauthorised use of identity information), 24 (cyber stalking) and 26 (spoofing) of the Prevention of Electronic Crimes Act, 2016 read with Sections 468 (forgery for purpose of cheating), 471 (using as genuine a forged document) and 109 (abetment) of the Pakistan Penal Code.

It may be noted that Armaghan has also been facing a case pertaining to the murder of Mustafa Amir.

The police had already filed an interim charge sheet against him, stating that Mustafa was allegedly murdered by Armaghan and his accomplice Sheraz, alias Shavez Bukhari, in a house in the Defence Housing Authority (DHA) on Jan 6. The suspects allegedly stuffed Mustafa’s body into the trunk of his own car and torched it in the Hub area of Balochistan.

The charge sheet stated that CCTV footage obtained from the Rangers allegedly shows the suspects travelling from Karachi to Hub in the victim’s car on the day of the incident. Another video purportedly shows them returning to Karachi in a Suzuki pickup.

Published in Dawn, July 20th, 2025