KARACHI: Following a spate of cyberattacks on Pakistan’s banks, several account holders said on Thursday that they were forced to take precautionary measures to secure their savings.
“I have closed my online account because of the ongoing cyber-attacks. The banks are not sharing details of what is happening, so I’ve decided to close the accounts having experienced the trouble of dealing with banks,” Abdul Samad Memon, a 35-year-old businessman, told Arab News.
Samad is not the only account holder to opt out. Dozens of individuals have either voluntarily closed their accounts or requested their banks to block access as a precautionary measure. “I have asked my bank to close my online account and now I will withdraw cash through checks to be on the safer side,” Muhammad Salahuddin, a retired government employee said. 
Authorities from several banks also said that they had notified their customers about the move. Muhammad Rehan, a school teacher, said he had received the notification from his bank and did not have an issue with the standard operating procedure as it is a “good step under the current circumstances”.
In the news recently, major financial institutions reported losing billions of rupees through fraudulent activities. Prime among these were transactions involving identify theft, whereby hackers would create fake accounts using the details of another person, mostly from an underprivileged background. Case in point was an incident reported by the Federal Investigation Agency (FIA) whereby it had seized the bank account of an ice-cream vendor who had Rs2.25 billion in his savings account.
“The hacking incidents show that nothing is reliable. Even though withdrawing cash by using fake checks has been the practice in the past, I still believe it is safer as compared to online banking,” Baber Sharif, a shopkeeper, said.
Adding insult to injury was the case of Pakistan’s BankIslami which reported that its security system had been breached on October 27, resulting in major losses for the company.
The extent of the online hacking came to light on Monday, when FIA’s cyber-crime chief, Captain (retd) Mohammad Shoaib said that customers’ data from almost all major Pakistani banks had been stolen in a recent security breach.
The State Bank of Pakistan (SBP), however, rejected the FIA’s findings, clarifying that the data of only one bank had been compromised. “SBP categorically rejects such reports. There is no evidence to this effect nor has this information been provided to the SBP by any bank or law enforcement agency,” the central bank said in a statement.
However, officials from the Pakistan Computer Emergency Response Team (PakCERT), a cybersecurity services provider, reported that on October 26, a data dump was posted on the Internet highlighting the details of more than 9,000 debit cards, out of which 8,864 belonged to customers of Pakistani banks. 
“The [security details of the] compromised cards were sold at a price ranging from between $100 and $160. The second dump was posted on October 31 with over 12,000 cards on darknet comprising 11,000 cards from Pakistani banks,” the report added.
According to the PakCERT, security details of a total of 19,864 cards from 22 Pakistani banks were compromised.
Experts believe that the breach was not the act of any one individual but rather a group of individuals as the fraud was carried out in a sophisticated and organized manner. “The pattern of infiltration clearly shows that there was more than one entity involved,” S M Arif, a financial expert and banking technologist, told Arab News.
“We have to evaluate whether only the data which was available in the dark web was compromised or other data was used as well,” Arif said, adding that in circumstances where the data from one country is used for withdrawal purposes in another country while a third individual is the beneficiary “could only be done by those who have access to the data”. “The withdrawals have taken place through a financial system which means it is the failure of multiple entities on multiple points,” he said.
A B Shahid, a senior banker, told Arab News that the recent incidents of cyber-fraud have exposed the loopholes in the financial system and shaken the confidence of customers. “The customers believed that the banking systems was most reliable and secure for their savings but their confidence has been shaken to a large extent,” he said.
Holding the SBP and the management of various banks responsible for the infiltration and hacking, Shahid said that the financial bodies could have taken a cue from Wikileaks which had “exposed the system’s weaknesses”.
“Wikileaks clearly demonstrated that data can be downloaded and used for various reasons. In the race to promote electronic banking in Pakistan, neither the regulator nor the banks’ management took steps to install an anti-hacking system which is clearly evident from the recent incidents,” he said.