Muhammad Usman Vs The State etc.

Form No.HCJD/C-121

ORDER SHEET

LAHORE HIGH COURT, LAHORE

JUDICIAL DEPARTMENT

Crl. Misc. No. 76474-B/2025 Muhammad Usman Vs. The State and another

Crl. Misc. No. 20288-B/2026 Muhammad Atif Vs. The State and another

S.No. of Order/ Date of order/ Order with the signature of the Judge and that of the parties or counsel, where Proceeding proceeding necessary

17.06.2026 Mian Khadim Hussain, Advocate, assisted by Mr. Ibraz Anwar Ramday, Advocate, for Petitioner Muhammad Usman in Crl. Misc. No. 76474-B/2025.

Mr. Amjad Farouck Bismil Rajput, Advocate, for Petitioner Muhammad Atif in Crl. Misc. No. 20288-B/2026.

Mr. Muhammad Nasim Saqlain, Assistant Attorney General with Najam Ashraf Bajwa, S.I., NCCIA.

Barrister Hamza Basharat and Ch. Muhammad Umar, Advocate, for Pakistan Telecommunication Authority (PTA).

Tariq Saleem Sheikh, J. – Muhammad Usman has filed Crl. Misc. No. 76474-B/2025, while Muhammad Atif has filed Crl. Misc. No. 20288-B/2026, seeking post-arrest bail in case FIR No. 316/2025 dated 18.11.2025 registered at Police Station NCCIA, Lahore, for offences under sections 3, 4, 13, 14, 16 and 17 of the Prevention of Electronic Crimes Act, 2016 (“PECA”), read with sections 419, 420, 468, 471 and 109 PPC. During the investigation, section 409 PPC was also added. Since both applications arise from the same FIR, they are being decided through this consolidated order.

2.Brief facts of the case are that the Zonal Director, Pakistan Telecommunication Authority (“PTA”), lodged a complaint with the NCCIA, Lahore, stating that PTA had received two complaints, one from Sultan Masood Malik and the other from Shabbir Hussain, alleging that duplicate SIMs had been fraudulently issued against their CNICs and, after activation, used for unauthorized transfer of money from their UBL accounts. PTA stated that the activity was traced to Jazz Franchise ID No. 6561, operating under the name Fine Telecom at Bahawalpur Road, Yazman, where the complainants” CNICs and fingerprints had been fraudulently used. PTA further stated that, according to the BVS sale record, a duplicate

Crl. Misc. No. 20288-B/2026

SIM for Sultan Masood Malik was issued on 09.11.2025 through Nadeem Super Store, after which Rs.555,000/- was transferred from his account. Similarly, a duplicate SIM for Shabbir Hussain was issued on 06.11.2025 through Muhammad Mumtaz, after which Rs.422,500/- was transferred from his account. Both retailers were linked to Jazz Franchise ID No. 6561 and BVS device bearing IMEI No. 867332036305067. Based on the said complaint, the NCCIA registered Enquiry No. 6312/2025 dated 13.11.2025, and thereafter FIR No. 316/2025 dated 18.11.2025.

3.On 18.11.2025, after obtaining a search warrant from the competent court, a joint team of the NCCIA and PTA raided the premises of Fine Telecom. The team recovered two SIM scanners, one BVS device, one CPU, one laptop and 150 SIM cards described as suspicious, besides mobile phones. Muhammad Usman was apprehended at the spot along with Nayyar Abbas, Sales and Distribution Manager, and Muhammad Riaz. The franchise is in the name of Muhammad Usman”s father, Dilawar Hussain. The prosecution maintains that Muhammad Usman was operating it, while he disputes any operational role.

4.During the investigation, four additional affected account holders were identified. The prosecution alleges that an aggregate amount of Rs.10,458,500/- was fraudulently transferred from the UBL accounts of six victims. It further alleges that the victims” confidential banking information, including their registered mobile numbers, was unlawfully obtained and exploited. Their original SIMs were blocked, duplicate SIMs were issued through the BVS system, new devices were registered to access mobile banking services, and funds were transferred to beneficiary accounts.

5.UBL”s Fraud Risk Management Division (“FRMD”) conducted an in-house inquiry into the disputed transactions and prepared reports dated 30.12.2025 and 29.05.2026, which were furnished to the Investigating Officer. The first report related to the six accounts involved in the present case, while the second examined a broader set of complaints. According to these reports, confidential

Crl. Misc. No. 20288-B/2026

customer information had been leaked or otherwise compromised through insider access, and account-access logs showed suspicious activity by bank staff in relation to the affected accounts.

6.Muhammad Atif was nominated as an accused during the investigation, and section 409 PPC was added to the case.

7.The record also refers to Muhammad Ahsan Khalidi in relation to access to customer accounts, but no bail application on his behalf is before this Court. Muhammad Mumtaz and Muhammad Umar Khan are stated to be absconding, while the beneficiary account holders identified during the investigation have not yet joined the proceedings. Co-accused Muhammad Riaz and Nayyar Abbas were admitted to post-arrest bail by the Additional Sessions Judge vide orders dated 20.01.2026 and 29.01.2026, respectively.

Submissions on behalf of Muhammad Usman

8.Mian Khadim Hussain, Advocate, submitted that Muhammad Usman is a student and neither the owner nor an employee of Fine Telecom, which stands in the name of his father, Dilawar Hussain. Muhammad Usman”s mere presence at the franchise when it was raided, he argued, does not establish that he managed or controlled it, or that he had any involvement in the alleged offences. Counsel further submitted that the two duplicate SIMs referred to in the FIR were issued through Nadeem Super Store and Muhammad Mumtaz, not by Muhammad Usman. According to him, the mere fact that those retailers were linked with Jazz Franchise ID No. 6561 does not establish Muhammad Usman”s complicity in the disputed SIM activations.

9.Mr. Mian further argued that the BVS device bearing IMEI No. 867332036305067, allegedly used for the issuance of the duplicate SIMs, was not recovered from the Petitioner. It was the prosecution”s own case that it had remained with Muhammad Mumtaz and was later returned to Jazz. Counsel submitted that a BVS device functions only within a limited radius and requires biometric verification. He argued that the duplicate SIMs were activated while

Crl. Misc. No. 20288-B/2026

the device was in Jhang, whereas the CDR of the Petitioner and his father does not show their presence there. Mr. Mian further submitted that the articles recovered during the raid, namely SIM scanners, one BVS device, a CPU, a laptop and SIM cards, were ordinary franchise stock. According to him, there is no forensic report to show that the recovered SIM cards were illegally activated or used in the commission of the offence. He added that no proceeds of crime have been traced to the Petitioner.

10.Mr. Mian finally submitted that the provisions of the PPC could not be invoked alongside PECA, and placed reliance upon Sheraz Khan v. The State and others (2022 PCr.LJ 203) and Javad Khan v. The State and others (2023 PCr.LJ 1092). He further argued that none of the offences invoked in the FIR falls within the prohibitory clause of section 497(1) Cr.P.C. and that, in any case, the Petitioner is entitled to the benefit of the rule of consistency because co-accused Muhammad Riaz and Nayyar Abbas have already been admitted to post-arrest bail. Reliance was placed, inter alia, upon Tariq Bashir and others v. The State (PLD 1995 SC 34), Shahzad v. The State and another (2023 SCMR 679), Syed Muhammad Ali Jaferi v. The State and another (2025 SCMR 838), and Abdul Mateen Mehboob v. The State (2026 SCMR 135).

Submissions on behalf of Muhammad Atif

11.Mr. Amjad Farouck Bismil Rajput, Advocate, counsel for Muhammad Atif, submitted that the Petitioner was not named in the FIR and was nominated during the investigation without any independent incriminating evidence. He contended that there was no basis to connect the Petitioner with the persons who issued the duplicate SIMs or with those who received the proceeds of the fraud. No CDR, chat record or other connecting evidence has been produced in that regard. Nor, according to counsel, is there any evidence that the Petitioner himself received any benefit from the alleged fraud.

12.Referring to the FRMD reports, Mr. Rajput submitted that the access logs, even if taken at face value, show only access to

Crl. Misc. No. 20288-B/2026

certain customer accounts. Standing alone, they do not show disclosure of information, participation in the SIM-swap process, or sharing in the proceeds of crime. Counsel maintained that the Petitioner had explained that the accounts were accessed for verification of contact numbers at the request of Muhammad Fayyaz, who dealt in UBL Omni services.

13.Mr. Rajput finally submitted that the offences alleged fall outside the prohibitory clause of section 497(1) Cr.P.C. and that the Petitioner”s case is, in any event, one of further inquiry within the meaning of section 497(2) Cr.P.C. Reliance was placed, amongst others, upon Ahmad Khalid Butt v. The State (2021 SCMR 1016), Zeeshan v. The State (2024 SCMR 1716) and Muhammad Tanveer v. The State (PLD 2017 SC 733).

Submissions on behalf of the State

14.Mr. Muhammad Nasim Saqlain, Assistant Attorney General (AAG), opposed both applications. He submitted that the case relates to an organized cybercrime in which confidential banking information was allegedly obtained, genuine SIMs were blocked, duplicate SIMs were issued, new devices were registered for mobile banking, and funds were transferred through beneficiary accounts. According to him, these acts were not isolated but formed part of a coordinated scheme in which different individuals performed distinct yet interdependent roles. He maintained that the evidence collected during the investigation connected both Petitioners to that scheme. He further submitted that, in white-collar and cybercrime cases, the proceeds are often disbursed in cash or routed through multiple accounts. Therefore, the absence of a complete money trail was not, by itself, sufficient to justify the grant of bail.

15.As regards Muhammad Atif, the AAG submitted that UBL”s inquiry and the NCCIA investigation show that he accessed confidential customer information relating to the affected accounts and leaked it. He contended that, by virtue of section 27(2) of PECA, customer data constitutes “property” for the purposes of section 405

Crl. Misc. No. 20288-B/2026

PPC. Since Muhammad Atif allegedly had access to, and dominion over, such data in the course of his banking functions, he submitted that section 409 PPC was attracted, which brings the case within the prohibitory clause of section 497(1) Cr.P.C.

16.Insofar as Muhammad Usman is concerned, the AAG submitted that, although the franchise stood in the name of his father, the investigation showed that Muhammad Usman was managing its affairs. According to him, the two points of sale from which the duplicate SIMs were issued, as well as the relevant BVS device, were linked with Jazz Franchise ID No. 6561. He further submitted that Muhammad Usman had either provided the disputed BVS device to Muhammad Mumtaz or arranged for its use. On that basis, he argued that Muhammad Usman was connected with the SIM-swap component of the alleged scheme and that section 109 PPC was attracted.

17.Barrister Hamza Basharat, counsel for PTA, supplemented the submissions of the AAG. He submitted that the sale and activation of SIMs is governed by a regulatory framework that requires verification of the subscriber”s antecedents and biometric authentication through the NADRA database before a duplicate SIM is issued. According to him, the allegations in the present case show that these safeguards were circumvented. He argued that the BVS device bearing IMEI No. 867332036305067 had been tampered with, operated at a reduced frequency, or used through a VPN or other technological means to defeat territorial restrictions. He maintained that the evidence collected during the investigation was sufficient, at least tentatively, to connect both Petitioners with their respective roles in the alleged scheme.

18.I have heard counsel for the parties and have gone through the record with their able assistance. A court hearing a bail application makes only a tentative assessment of the factual record. It does not undertake a detailed appraisal of the evidence or return findings that may prejudice the trial. Where, however, the decision

Crl. Misc. No. 20288-B/2026

turns on statutory interpretation, the court must undertake that exercise to the extent necessary.

Statutory scheme

19.The Petitioners are being prosecuted under sections 3, 4, 13, 14, 16 and 17 of PECA, read with sections 409, 419, 420, 468, 471 and 109 PPC. PECA was enacted to prevent electronic crimes and to provide for related mechanisms of investigation, prosecution and trial. It creates special offences pertaining to unauthorized access, copying or transmission of data, electronic forgery, electronic fraud, misuse of identity information and unlawful issuance of SIM cards. The original statute was amended by the Prevention of Electronic Crimes (Amendment) Act, 2025, which came into force on 29.01.2025. As the occurrence from which the present case arises took place in October- November 2025, the amended Act applies. Under section 43 of PECA, as amended, the offences under sections 13 and 14, and abetment thereof, are non-bailable, non-compoundable and cognizable. Except for section 409 PPC, none of the offences invoked carries a punishment attracting the prohibitory clause of section 497(1) Cr.P.C. It is thus necessary to examine whether section 409 PPC is prima facie attracted in either case. Before doing so, the objection that the PPC cannot be invoked alongside PECA may be addressed.

20.The objection is founded principally on Sheraz Khan v. The State and others (2022 PCr.LJ 203) and Javad Khan v. The State and others (2023 PCr.LJ 1092). The contention, so stated, is too broad. Section 50(1) of PECA provides that the Act shall have effect “not in derogation of” the Pakistan Penal Code, the Code of Criminal Procedure and the Qanun-e-Shahadat, 1984, amongst other laws. Section 27(1) further provides that an offence under PECA or any other law shall not be denied legal recognition and enforcement merely because it was committed in relation to, or through the use of, an information system. Section 28 applies the provisions of the PPC, to the extent not inconsistent with PECA, to offences under the Act. Section 50(2) gives PECA overriding effect against other laws on the same subject, but makes that effect expressly subject to

Crl. Misc. No. 20288-B/2026

sub-section (1). The cumulative effect of these provisions is that PECA does not exclude the substantive application of the PPC where the ingredients of an offence under the PPC are otherwise disclosed.

21.In Sheraz Khan, the petitioner had sought post-arrest bail in a case registered under sections 13, 14 and 16 of PECA read with sections 109, 419, 420, 468 and 471 PPC. The application was ultimately allowed because none of those offences fell within the prohibitory clause of section 497(1) Cr.P.C. and the petitioner was no longer required for investigation. The extended discussion on the relationship between PECA and the PPC was not essential to that conclusion. Importantly, paragraph 11 of that judgment observed that the applicability of the PPC offences along with PECA would be determined by the trial court after recording evidence. Sheraz Khan, therefore, does not lay down an absolute rule that the PPC is excluded whenever PECA is attracted. In that case, section 26 of the General Clauses Act, 1897, was relied upon for the view that offences falling under different enactments should be tried separately. With respect, section 26 does not, by itself, require separate trials. It permits prosecution and punishment under any of the relevant enactments, while prohibiting double punishment for the same offence. In any event, for the purposes of the present bail applications, it is unnecessary to decide the forum or manner in which PECA and PPC offences may be tried together, for that question does not arise here.

22.Javad Khan was decided by the Islamabad High Court on a constitutional petition seeking quashing of an FIR registered by FIA under section 14 of PECA read with sections 419 and 420 PPC. The questions considered there were whether FIA, as the investigation agency designated under section 29 of PECA, could investigate offences under the PPC; whether the addition of cognizable PPC offences could enable FIA to register an FIR in respect of a non- cognizable PECA offence without prior permission of the court; and whether a court designated under section 44 of PECA could jointly try offences under PECA and the PPC. The ratio of the judgment was, therefore, confined to the authority of FIA under the then existing

Crl. Misc. No. 20288-B/2026

statutory framework, the cognizance of a non-cognizable PECA offence, and the forum of trial. It did not decide that the same acts may not, in substance, constitute offences both under PECA and under the PPC where the ingredients of each offence are otherwise disclosed. Indeed, paragraph 20 of the judgment expressly recognizes that the acts attributed to the petitioner also constituted offences under the PPC and that the complainant could approach the police for registration of an FIR under the Code of Criminal Procedure. The judgment thus does not support the proposition that the substantive applicability of the PPC is excluded merely because the same acts also attract PECA. Importantly, Javad Khan did not examine the effect of section 27(2) of PECA upon an offence concerning property.

23.The statutory framework has since undergone material change through the Prevention of Electronic Crimes (Amendment) Act, 2025. Sheraz Khan and Javad Khan were decided before that amendment. They do not advance the Petitioners” objection in the present case.

Does customer data constitute “property”

24.Criminal breach of trust is, in its essence, an offence concerning property. Section 405 PPC defines the offence. It is attracted where a person entrusted with property, or having dominion over it, dishonestly misappropriates, converts, uses or disposes of that property in violation of a direction of law prescribing the mode in which the trust is to be discharged, or of a legal contract, express or implied, touching the discharge of that trust. “Dishonestly”, as defined in section 24 PPC, requires an intention to cause wrongful gain or wrongful loss.

25.Section 2(1)(xiii) of PECA defines “data” to include content data, and section 2(1)(viii) defines “content data” to include any representation of fact, information or concept for processing in an information system. Customer records maintained in a bank”s core banking system, including account particulars and registered mobile numbers, fall within the statutory concept of data. Section 27(2)

Crl. Misc. No. 20288-B/2026

provides that “references to “property” in any law creating an offence in relation to or concerning property shall include information system and data.” Therefore, by force of section 27(2), such data constitutes “property” for the purposes of sections 405 to 409 PPC.

26.It follows that where customer data is entrusted to a bank employee, or is under his dominion, and he dishonestly discloses or uses it without authority in furtherance of a fraudulent scheme, such conduct may, in an appropriate case, amount to criminal breach of trust. It would also be contrary to the duties of confidentiality and fidelity arising from banking employment and reinforced by section 33A of the Banking Companies Ordinance, 1962.

27.Section 41 of PECA may also be noticed. It punishes unauthorized disclosure of material or data containing personal information by a person, including a service provider, who has secured access to it while providing services under a lawful contract or otherwise in accordance with law, or by an authorized officer. The provision applies where such disclosure is made, otherwise than where required by law, without the consent of the person concerned or in breach of a lawful contract, and with the intent, or knowledge of likelihood, to cause harm, wrongful loss or gain, or to compromise the confidentiality of such material or data. Section 41 of PECA addresses an offence distinct from criminal breach of trust under section 405 PPC. The latter requires entrustment with property, or dominion over it, followed by dishonest misappropriation, conversion, use or disposal of that property in violation of law or contract. Section 41 of PECA does not exclude the application of section 405 PPC where the ingredients of that offence are otherwise disclosed.

Can a bank employee fall within section 409 PPC?

28.This is the central question in Muhammad Atif”s application. Chapter XVII of the PPC calibrates the punishment for criminal breach of trust by reference to the capacity in which the offender is entrusted with property or with dominion over it. Section 406 punishes the offence simpliciter with imprisonment which may

Crl. Misc. No. 20288-B/2026

extend to seven years. Section 408 punishes a clerk or servant entrusted in such capacity with imprisonment which may extend to seven years. Section 409 punishes a public servant, and a person entrusted with property or with dominion over property “in the way of his business as a banker, merchant, factor, broker, attorney or agent”, with imprisonment for life or imprisonment which may extend to ten years. Of the three, only section 409 attracts the prohibitory clause of section 497(1) Cr.P.C.

29.Muhammad Atif is stated to be an employee of a private banking company and not a public servant. The issue is whether an employee who deals with banking business and, by virtue of his functions, is entrusted with customer data or has dominion over it, falls within section 409 PPC, or whether his case would instead attract section 408 PPC as that of a clerk or servant. The answer cannot rest on designation alone. It turns on the meaning of the expression “in the way of his business as a banker” in section 409 PPC.

30.The word “banker” is not defined in the PPC. Black”s Law Dictionary, 12th Edition, p.178, defines a banker as “(i) someone who engages in the business of banking, (ii) an officer or owner of a bank; less commonly, anyone employed at a bank in a nonmenial position.” The qualifying words “less commonly” are important. They indicate that employment in a bank alone is insufficient. An employee may fall within the description of a banker only where, having regard to the nature of his position and functions, he is engaged in the business of banking in a meaningful sense. Section 3(b) of the Negotiable Instruments Act, 1881, defines a “banker” as a person transacting the business of accepting, for lending or investment, deposits of money from the public, repayable on demand or otherwise withdrawable by cheque, draft, order or otherwise, and includes any Post Office Savings Bank. This definition is enacted for the purposes of that Act. It cannot be imported into the PPC because, under a settled rule of interpretation, a word defined in one statute ordinarily bears that meaning only for that statute, unless the other statute expressly adopts that definition or the context necessarily requires

Crl. Misc. No. 20288-B/2026

such adoption. That definition may, nevertheless, be noticed as reflecting the ordinary legal conception of banking business. In United Dominions Trust Ltd v. Kirkwood, [1966] 2 Q.B. 431, Lord Denning M.R. identified three characteristics usually found in bankers: they accept money from customers and collect cheques for them, placing the proceeds to their credit; they honour cheques or orders drawn on them by customers and debit their accounts accordingly; and they maintain current accounts, or something of that nature, in which credits and debits are entered. The decision shows that the mere receipt of money is not sufficient. The essential character of the banking business lies in maintaining accounts through which customers” payment instructions are carried out.

31.The above discussion explains what banking business is, but it does not answer who, in a modern banking organization, may be regarded as a person entrusted “in the way of his business as a banker.” For that purpose, the operative words of section 409 PPC must be read as they stand. The section does not say “whoever, being a banker”. It applies to a person “being in any manner entrusted with property, or with any dominion over property, in his capacity of a public servant, or in the way of his business as a banker, merchant, factor, broker, attorney or agent”. The inquiry, therefore, is not merely whether the accused is employed by a bank, but whether the entrustment or dominion alleged against him arose from functions through which banking business is conducted. The word “banker” has long been construed in this practical sense. In Hira Lal, [(1907) PR No. 19 of 1908], it was held that the word “banker” includes a cashier or a shroff. That early construction, rendered by a court whose jurisdiction this Court has succeeded to, is entitled to due weight.

32.The above approach accords with the present statutory and institutional structure of banking. Section 27(1) of the Banking Companies Ordinance, 1962, provides that no individual, association or body of individuals, not being a company, shall carry on banking business in Pakistan and that, save as otherwise provided, no company

Crl. Misc. No. 20288-B/2026

shall carry on such business unless it holds a licence issued by the State Bank. The individual banker and the unincorporated private banking firm can no longer carry on banking business in Pakistan. A banking company is a juristic person that necessarily acts through its officers and employees. If the expression “in the way of his business as a banker” in section 409 PPC were confined to a person carrying on banking business in his own name, the reference to a banker in that provision would have little practical application. The expression must receive a functional construction.

33.The rationale for the enhanced punishment prescribed by section 409 PPC also supports this construction. A banker is placed in a position of confidence and exercises substantial control over property entrusted in the course of banking business. Modern banking is conducted substantially through information systems. Customer funds are accessed, transferred and protected electronically. Whoever controls the customer”s critical data may, in practical terms, control access to the customer”s money. This is precisely why section 27(2) of PECA provides that references to property in any law creating an offence concerning property shall include information systems and data.

34.I, therefore, hold that the expression “banker” in section 409 PPC is not confined to the president or other executives of a banking company. At the same time, it does not extend to every employee of a bank merely by reason of his employment, for such a reading would efface the distinction between sections 408 and 409 PPC. The test is functional and two conditions must be satisfied. First, the property concerned must be property with which, or by means of which, banking business is transacted, such as customer funds and, by force of section 27(2) of PECA, customer data used for access, verification, authentication or operation of bank accounts or banking transactions. Secondly, the employee must be entrusted with that property, or have dominion over it, by virtue of the banking function assigned to him. His functions must confer upon him authority to access, use or control it in the course of banking business, as distinct

Crl. Misc. No. 20288-B/2026

from bare custody, casual exposure or incidental access. Where an employee has only bare custody or incidental access, without entrustment or dominion of that character, section 409 PPC is not attracted. His case may, if the remaining ingredients are established, fall for consideration under section 408 PPC.

Abetment of an offence under section 409 PPC

35.Section 107 PPC defines abetment. A person abets the doing of a thing if he instigates another person to do that thing, engages with one or more persons in a conspiracy to do it and an act or illegal omission takes place in pursuance of that conspiracy, or intentionally aids its doing by an act or illegal omission. Section 109 PPC provides the punishment where the act abetted is committed in consequence of the abetment and no express provision is made for its punishment. Where the offence abetted is criminal breach of trust punishable under section 409 PPC, the entrustment or dominion required by that provision must be attributable to the person whose breach of trust is alleged. The abettor need not himself be a banker. His own conduct, however, must fall within one of the modes of abetment recognized by section 107 PPC. Where abetment by conspiracy is alleged, it is not necessary that every participant should know every other participant, provided the evidence shows that the accused was privy to the common design and that an act or illegal omission took place in pursuance of it. In a cyber-banking offence, the fact that several roles may have been necessary for the commission of the offence does not, by itself, identify the person who performed any particular role. The evidence must connect the alleged abettor with instigation, conspiracy, or intentional aid referable to the offence under section 409 PPC, including the dishonest use of banking property or customer data deemed to be property under section 27(2) of PECA.

Principles governing bail

36.Section 497 Cr.P.C. distinguishes between offences falling within the prohibitory clause and those outside it. For offences

Crl. Misc. No. 20288-B/2026

punishable with death, imprisonment for life, or imprisonment for ten years, bail is ordinarily refused where reasonable grounds exist for believing that the accused is guilty. Where such reasonable grounds are absent, but the case calls for further inquiry into guilt, section 497(2) mandates release on bail. In Tariq Bashir and others v. The State (PLD 1995 SC 34), the Supreme Court held that, in offences outside the prohibitory clause, grant of bail is the rule and refusal an exception, ordinarily justified only by extraordinary circumstances, such as likelihood of abscondence, tampering with prosecution evidence, repetition of the offence, or a previous conviction. This principle was reaffirmed in Muhammad Tanveer v. The State and another (PLD 2017 SC 733), and followed in later cases, including Shahzad v. The State and another (2023 SCMR 679) and Syed Muhammad Ali Jaferi v. The State and another (2025 SCMR 838).

37.Modern banking is conducted within a regulated electronic environment and ordinarily leaves a digital trail. In a cyber- banking case, the accusation may rest largely on access logs, system- generated records, audit trails, internal fraud-risk reports, technical analysis and statements recorded during an institutional inquiry. At the bail stage, such evidence is neither to be accepted uncritically nor tested by the standard applicable at trial. It must instead be examined tentatively, together with the other evidence collected during the investigation, to determine whether reasonable grounds exist for believing that the accused has committed the alleged offence or whether the case calls for further inquiry within the meaning of section 497(2) Cr.P.C.

Case of Muhammad Atif

38.The case against Muhammad Atif is primarily based on documentary and electronic evidence. The record describes him as Branch Services Supervisor posted at UBL”s District Courts Jhang Branch. His job description shows that the post was supervisory in character and concerned branch operations, teller supervision, control and compliance, customer due diligence, and supervision of financial and non-financial transactions. This is relevant because, for the

Crl. Misc. No. 20288-B/2026

reasons already stated, the question under section 409 PPC is not his designation alone, but whether his functions involved entrustment with, or conferred dominion over, customer data in the course of banking business.

39.The evidence against Muhammad Atif must be viewed cumulatively. The first UBL report, dated 30.12.2025, pertained to the six accounts involved in the present case. It stated that the controls relating to digital-banking activation and device registration had operated successfully, including NADRA biometric verification. It also noted leakage or breaches of customers” confidential information through insider access and contained account-access logs relating to those accounts. The second UBL report, dated 29.05.2026, which considered a larger set of complaints, identified three UBL employees, including Muhammad Atif, in connection with suspicious access to customers” accounts. Insofar as Muhammad Atif is concerned, the report states that customer information was accessed through the CRS system using a user ID linked to him. His explanation that he had accessed the accounts for verification of contact numbers at the request of Omni staff member Muhammad Fayyaz was found to have no rational basis. The report under section 173 Cr.P.C. also implicates Muhammad Atif. It alleges that he, along with Muhammad Ahsan Khalidi, disclosed the registered mobile numbers of the customers concerned at the request of Muhammad Fayyaz, who then transmitted the information to Muhammad Umar Khan.

40.Mr. Rajput is right that access to a customer account, by itself, would not necessarily establish disclosure of information or participation in the SIM-swap process. The prosecution case against Muhammad Atif, however, rests on the cumulative effect of the evidence discussed above, and not on access logs alone.

41.Upon a tentative assessment of the record, there is sufficient incriminating material against Muhammad Atif. Section 409 PPC is prima facie attracted, which brings the case within the prohibitory clause of section 497(1) Cr.P.C. Mr. Rajput has been unable to demonstrate that the case requires further inquiry within the

Crl. Misc. No. 20288-B/2026

contemplation of section 497(2) Cr.P.C. Accordingly, Crl. Misc. No. 20288-B/2026 filed by Muhammad Atif is dismissed.

Case of Muhammad Usman

42.Muhammad Usman stands on a different footing. Fine Telecom, with which the relevant retailers, including Nadeem Super Store and Muhammad Mumtaz, and the BVS device bearing IMEI No. 867332036305067 were associated, is registered in the name of his father, Dilawar Hussain. The prosecution alleges that Muhammad Usman was operating the franchise and held himself out as its owner. Even if that allegation is accepted at this stage, it does not, by itself, connect him with the disputed SIM activations, the handling or alleged misuse of the relevant BVS device, or abetment of the dishonest use of banking property or customer data.

43.The case against Muhammad Usman, insofar as the SIM- swap component is concerned, rests primarily on the technical analysis of his phone, which revealed a WhatsApp Business account styled “Jazz franchise”, communications with a contact saved as “Ts Hammad Moin”, and an email snapshot dated 13.11.2025 regarding unauthorized activity relating to the BVS device bearing IMEI No. 867332036305067, tagged to Muhammad Mumtaz. These circumstances are relevant, but their evidentiary value is limited at this stage. The technical report neither reproduces the complete communications nor provides their context. Significantly, the communications are dated 13.11.2025, after the disputed duplicate SIM activations of 06.11.2025 and 09.11.2025, and on the same date on which PTA lodged its complaint. A later communication may, in an appropriate case, support an inference of an earlier arrangement, but the present record does not yet provide the contents or context necessary to draw that inference.

44.The prosecution and PTA have further alleged that the BVS device was tampered with, configured to operate at a reduced frequency to permit the use of paper fingerprints, used through a VPN, or otherwise manipulated to circumvent regulatory safeguards. These

Crl. Misc. No. 20288-B/2026

allegations are serious. However, the present record contains no technical report or other evidence connecting Muhammad Usman with that manipulation.

45.The scanners, CPU, laptop and SIM cards recovered from the franchise may assume relevance when read with other circumstances. Standing alone, however, those articles are not incriminating in character. A franchise may possess equipment and SIM cards for legitimate business purposes. The description of the recovered SIM cards as suspicious is not presently supported by a forensic report showing that they were illegally activated or used in the commission of the offence.

46.The prosecution describes the fraud as a coordinated scheme involving several persons performing different but interdependent roles. That circumstance may explain the manner in which the offence was allegedly committed, but it cannot substitute proof of Muhammad Usman”s own role. No direct communication has been shown between Muhammad Usman and Muhammad Atif, Muhammad Fayyaz, or Muhammad Umar Khan. Section 109 PPC does not create vicarious liability merely because several acts were necessary for the completion of the offence. The record must show that he instigated, conspired in, or intentionally aided the dishonest use of banking property or customer data. Muhammad Usman is not a bank employee and is not alleged to have been entrusted with, or to have had dominion over, customer data in the course of banking business. The allegation under section 409 PPC, therefore, depends on abetment. The evidence presently available may indicate his association with Fine Telecom, but it does not identify the act by which he allegedly abetted the offence under section 409 PPC.

47.Consequently, the allegation under section 409 PPC read with section 109 PPC, insofar as Muhammad Usman is concerned, calls for further inquiry within the meaning of section 497(2) Cr.P.C. The remaining offences attributed to him do not fall within the prohibitory clause of section 497(1) Cr.P.C. He has been incarcerated since 18.11.2025, the report under section 173 Cr.P.C. has been

Crl. Misc. No. 20288-B/2026

submitted, and he is no longer required for investigation. The prosecution case rests substantially on documentary and technical evidence, as well as institutional records, already in the custody of the NCCIA. No recognized exception to the rule governing grant of bail in offences outside the prohibitory clause has been shown.

48.The rule of consistency does not advance Muhammad Usman”s case because the allegations against Muhammad Riaz and Nayyar Abbas are different. His entitlement to bail rests on the tentative assessment of the evidence discussed above rather than on the orders granting bail to those co-accused.

49.For the foregoing reasons, Crl. Misc. No. 76474-B/2025 is allowed. Muhammad Usman shall be released on bail, subject to furnishing bail bonds in the sum of Rs.1,000,000/-, with one surety in the like amount, to the satisfaction of the trial court.

50.The determinations of law recorded in this order are limited to the questions necessary for the disposal of these applications. The observations on the facts are tentative and shall not influence the trial court, which shall decide the case independently on the basis of the evidence brought before it, in accordance with the law.

(Tariq Saleem Sheikh) Judge Ahsan

Approved for reporting

Judge