Islamabad: The security of digital banking has come under renewed scrutiny after two UBL customers reported major unauthorized transactions, including one case involving PKR 21 million in transfers and another involving suspicious POS deductions while the customer still had physical possession of the debit card.
The incidents, which surfaced on social media, have raised serious concerns over digital banking safeguards, transaction limits and the effectiveness of account-blocking mechanisms. Customers are now seeking intervention from regulators and law-enforcement authorities.
Abbottabad Customer Reports PKR 21 Million in Unauthorized Transfers
The most serious case involves a customer from Abbottabad.
According to the account shared publicly, the customer noticed a suspicious transfer of PKR 1,000 to an Easypaisa account at 12:25 AM on October 8. The customer immediately contacted the UBL helpline and called the bank three times, requesting that the app and online banking access be fully blocked.
The customer said UBL representatives assured them that the account had been secured.
However, around 15 hours later, at 3:51 PM, a series of large transactions allegedly began appearing on the account.
The customer started receiving email alerts showing deductions of PKR 1 million at a time and contacted UBL again. According to the complaint, the customer remained on the phone with support staff for around an hour while the transfers continued.
In total, 21 separate transfers of PKR 1 million each were processed, moving PKR 21 million into five different recipient accounts.
The customer said no One-Time Password, or OTP, was received for any of the transfers. The complaint also states that the transactions exceeded the standard PKR 5 million daily transfer limit.
UBL has reportedly told the customer that its investigation could take up to 10 business days.
The customer is seeking immediate intervention from the State Bank of Pakistan and the NCCIA to trace the transfers and freeze the recipient accounts.
Multan Customer Reports POS Deductions While Card Was in Possession
A separate case involves a customer from Multan who reported four unauthorized VISA Point of Sale transactions totalling Rs. 127,199.99.
According to the customer, the deductions occurred while they were having dinner with family.
The four transactions were reported as Rs. 20,000, Rs. 49,999.99, Rs. 47,000 and Rs. 10,200.
The customer said the physical debit card remained in their possession at the time and that the UBL Digital App was securely logged in on their mobile phone.
The customer maintains that none of the transactions was authorized and is seeking an explanation as well as an immediate refund from the bank.
Social Media Users Raise Questions Over Banking Security
The two cases have triggered strong reactions on social media, with users questioning whether account-blocking features are functioning as intended and how large transactions could be processed without OTP verification or apparent adherence to transfer limits.
Some users have also raised suspicions of possible internal involvement, citing the scale and nature of the reported transactions.
Others have urged the affected customers to pursue complaints beyond the bank’s internal process, including with the Banking Mohtasib Pakistan and the NCCIA.
The incidents have also prompted renewed discussion around risks associated with modern payment technology.
Some social media users suggested that scammers may exploit wireless POS devices and NFC-based payment methods to trigger unauthorized deductions in certain circumstances.
Customers are therefore being urged to remain vigilant, avoid handing cards to unknown individuals at restaurants or petrol stations and ensure that any card transaction is carried out in front of them.
As digital banking adoption continues to grow, the two cases have intensified public concern over the security of customer funds and the mechanisms banks use to prevent unauthorized access and fraudulent transactions.