Pakistan's National Cyber Crime Investigation Agency has arrested 39 suspects in Lahore after raiding a call centre that investigators allege was linked to instant-loan applications used to obtain access to borrowers' personal data and threaten people over repayments.
The 39 suspects include 38 men and one woman. Authorities also seized 40 laptops and 41 mobile phones during the operation, according to details reported by Dawn.
The allegations are serious, but the arrests do not establish guilt. Investigators are examining the seized devices, and the case remains subject to investigation and legal proceedings.
Beyond the raid itself, the case highlights a broader consumer question: how can someone looking for quick credit tell the difference between a regulated digital lender and an unauthorized loan app?
What investigators allege happened in Lahore
According to investigators, the instant-loan applications linked to the alleged operation sought access to borrowers' phone galleries and contact lists.
Investigators allege that when borrowers failed to repay within the required period, staff used artificial intelligence tools to manipulate photographs into explicit images. Borrowers were then allegedly threatened that the images would be sent to relatives and other contacts unless payments were made.
Authorities seized 40 laptops and 41 phones
The NCCIA seized 40 laptops and 41 mobile phones during the Lahore operation. Officials said the devices were sealed and will be examined by forensic experts as investigators seek further evidence about how the alleged operation worked.
Investigators are also examining the amounts allegedly received through the operation and whether the network had connections outside Pakistan, according to the published account.
Those questions remain unresolved. No verified total victim count, amount allegedly collected or confirmed foreign connection has been established publicly in the information reviewed for this report.
Why access to contacts and photos matters
The allegations in the Lahore case are particularly relevant because Pakistan's regulatory framework for digital lending places restrictions on how regulated lenders can access personal data stored on a borrower's phone.
The Securities and Exchange Commission of Pakistan has stated that digital lenders should not access a borrower's phone book, contact list or photo gallery, even with the borrower's consent. The framework also restricts lenders from contacting people in a borrower's contact list except specifically authorized guarantors who have provided consent, according to SECP's digital lending guidance.
That makes requests for access to contacts or photo galleries particularly important for borrowers to examine when assessing a digital lending application.
Consumers can also review an app's requested permissions before signing up and compare the lender with SECP's current approved-app information.
Not every digital lending app in Pakistan is illegal
The Lahore investigation should not be interpreted as evidence that all digital lending applications operating in Pakistan are illegal.
Pakistan has regulated digital lenders operated by licensed non-banking finance companies, or NBFCs. The SECP maintains an official White List of Digital Lending Apps operated by duly licensed lending NBFCs.
The current SECP list is dated September 11, 2026, making it an important verification point for borrowers considering a digital lending service.
The distinction is important: an app offering quick credit is not automatically unauthorized simply because it operates digitally, but consumers should verify its regulatory status rather than relying on advertising, branding or the fact that an application can be downloaded.
How to check a loan app before borrowing
The simplest first step is to compare the application with the SECP's current whitelist before accepting a loan or providing sensitive information.
Borrowers should use the regulator's current approved-app information rather than relying only on older lists of applications previously reported as illegal. SECP states that its list of reported illegal personal loan apps is not exhaustive, meaning an app's absence from that list should not automatically be interpreted as approval.
This creates an important distinction for consumers: the question should not simply be, "Is this app on an illegal-app list?" A stronger question is, "Can I verify this lender through the regulator's current information?"
Be cautious with loan apps sent through unofficial links
Illegal lending activity has also moved beyond conventional app stores.
SECP has warned that some illegal loan-app operators shifted to Android Package Kit, or APK, files distributed through websites, WhatsApp and other alternative channels instead of relying on conventional app stores.
An APK received through WhatsApp, a website or another unofficial link should therefore not be treated as evidence that a lender is approved. Borrowers can check the application against SECP's current whitelist before proceeding.
Consumers should independently verify the lender before installing an unfamiliar lending application or sharing personal and financial information.
What protections apply to regulated digital lending?
Pakistan's digital-lending framework is designed to address more than whether a lender holds a licence.
SECP has introduced digital-lending standards addressing areas including data privacy, cybersecurity, disclosure requirements, grievance handling and recovery practices. Restrictions involving access to contacts and photo galleries form part of the wider consumer-protection framework.
The regulator has also introduced requirements addressing the pricing of digital personal loans offered by regulated NBFCs.
These safeguards do not mean every dispute involving a licensed lender is automatically resolved, but they create regulatory requirements that distinguish licensed digital lending from unauthorized operations outside the framework.
Warning signs borrowers should take seriously
The Lahore case and SECP's wider warnings point to several issues consumers can check before proceeding with a digital loan.
Borrowers should examine requests for access to contacts or photo galleries, verify whether the lender appears in SECP's current approved-app information, be cautious about APK files or loan links distributed through messaging services and review important lending terms before accepting credit.
Threats, harassment or attempts to use personal information to pressure a borrower should not be treated as ordinary loan-recovery practices.
What remains unknown about the Lahore investigation
The investigation is still developing, and several important questions remain unanswered publicly.
Authorities have not established in the information reviewed for this report how many borrowers were allegedly affected, the total amount collected, how long the alleged operation had been running or whether investigators have confirmed links outside Pakistan.
Forensic examination of the seized laptops and mobile phones may provide investigators with additional evidence, but the seizure of a device should not itself be treated as proof of the allegations against an individual.
Verification is the first safeguard
The Lahore investigation shows why digital lending involves more than the cost and speed of obtaining a loan. The personal information an application requests, how that information can be used and whether the lender operates within Pakistan's regulatory framework are also important considerations.
As investigators examine the devices seized in Lahore, borrowers have a more immediate safeguard available: check a digital lender against the SECP's current approved-app information before installing an unfamiliar loan application or accepting credit.
The 39 people arrested in Lahore remain suspects. The allegations against them are subject to investigation and legal proceedings, and any determination of guilt is a matter for the courts.
