I WISH to draw public attention to a largely overlooked form of cybercrime and data theft that may be taking place at physical points of sale (POS) across Pakistan. At some of the supermarkets, shopping malls, grocery stores and petrol stations, customers are sometimes asked to process their debit or credit cards through an additional private machine before or alongside the regular bank POS terminal.

While multiple terminals can have legitimate purposes, any unauthorised device that captures, copies, stores or transmits payment-card information potentially creates a serious cybersecurity threat.

This is not simply a matter of banking or consumer inconvenience. Unauthorised acquisition or copying of electronic financial data can constitute a cybercrime, depending on what information is collected, how it is processed, whether authorisation exists, and whether it is subsequently misused. Internationally, POS-terminal compromise and card skimming are well-established forms of cyber-enabled financial crime. More importantly, the State Bank of Pakistan (SBP) has previously warned about the theft of customers’ card data, and advised banks to discourage card- swiping at merchants’ non-POS terminals.

There is also a separate financial and tax-compliance concern. A card payment does not automatically mean that the corresponding sale has been properly recorded or reported to the Sindh Revenue Board (SRB) and the Federal Board of Revenue (FBR). Where required by law, the sale should be invoiced and reflected through the applicable POS or e-invoicing system. Any deliberate concealment of taxable sales would require separate investi- gation and evidence.

The relevant authorities should, therefore, examine whether all card-scanning devices being used by merchants are authorised, traceable, secure and connected to legitimate payment infrastructure, and whether customers’ financial data is being collected and processed lawfully.

The public also needs greater awareness. A cybercrime does not necessarily begin with merely some card-swiping incidents.

Qazi Fahad Ahmed
Karachi

Published in Dawn, November 8th, 2026