KARACHI: A sessions court on Wednesday directed the National Cyber Crime Investigation Agency (NCCIA) to investigate an alleged “unauthorised” transaction of Rs4.8 million from the bank account of a Gul Plaza fire-affected shopkeeper and submit a report within 45 days.

Shopkeeper Muhammad Shahzad filed an application under Sections 22-A and 22-B of the Code of Criminal Procedure before Additional District and Sessions Judge (South) Abdul Zahoor Chandio, seeking registration of an FIR over an unauthorised transaction from his account in a private bank.

The applicant claimed that he had a shop at Gul Plaza, which was destroyed in the fire.

He stated that the Sindh government had provided Rs7 million in financial assistance to help him re-establish his business.

SBP directed to examine whether banks complied with digital banking security requirements; reports sought within 45 days

However, he claimed that on June 26, Rs1 million was transferred to the bank account of Muhammad Safdar and, the very next day, Rs3.8 million was transferred to the account of Samiullah without his authorisation or knowledge.

He denied sharing his bank account credentials or password with anyone.

On the other hand, the private bank informed the court that the disputed transactions were executed through its digital app and that its internal investigation found that the activity had originated from the applicant’s own device.

The bank also took the position that the “transactions occurred through the use of confidential credentials”.

After hearing all sides, including representatives of the private bank, NCCIA and the complainant, the court directed the director general of the NCCIA to conduct a comprehensive investigation in accordance with the Prevention of Electronic Crimes Act (Peca) and all other applicable laws and submit a report within 45 days.

The court directed the investigating officer (IO) to preserve all records relating to the disputed or alleged “unauthorised” transactions from the applicant’s account.

It also directed the private banks holding the beneficiary accounts, as well as the bank where the applicant maintained his account, to preserve all records related to the alleged transactions.

The court ordered the State Bank of Pakistan to examine the matter from a regulatory perspective and determine “whether the concerned banks complied with the applicable digital banking security requirements and whether any regulatory proceedings have been initiated or are warranted” and submit a report within 45 days.

“The object of these directions is not merely recovery of the applicant’s money. The banking system operates upon public confidence and the protection of customers against unauthorised electronic transactions is an essential component of that confidence. The regulatory framework itself recognizes the need for effective security controls in digital banking and provides mechanisms for regulatory enforcement where those controls are not properly implemented,” the court observed.

Published in Dawn, September 18th, 2026