CNIC Details by Number Pakistan

CNIC Details by Number in Pakistan — Legal Methods and Limits

Finding CNIC details from a phone number sounds simple, but PTA’s privacy rules limit reverse lookup tightly. You can see the CNIC linked to a SIM you currently hold by texting MNP to 667 from that SIM. You can see every CNIC-to-number binding on your own identity via 668 SMS or cnic.sims.pk. You cannot publicly query another person’s CNIC from their number — that requires a court order or formal PTA process. This page covers what’s actually possible and how to use each method correctly. For a broader overview of Pakistan’s SIM verification system, see SIM information Pakistan.

Can you find someone’s CNIC from their phone number?

The direct answer is that you cannot publicly query someone else’s CNIC from their number. PTA does not expose any service that takes a phone number and returns the registered owner’s CNIC unless you’re the owner. This was tightened further in 2024 when PTA added OTP protection to the cnic.sims.pk portal, blocking the previous pattern where anyone with a CNIC number could pull the full record without the owner’s involvement.

The services that exist work in the legitimate direction: you can see your own CNIC’s records, and you can see the registered owner of a SIM you physically hold. Both are designed around the assumption that the person querying is the rightful CNIC holder or SIM possessor. For a full breakdown of what the official database exposes to the public, see SIM database online Pakistan.

The remaining lawful paths run through documented processes: police FIR for cases involving the number in suspected criminal activity, court orders for civil disputes, and FIA Cyber Crime Wing for online harassment or fraud. PTA can release ownership records to these channels with proper authorisation. It does not release them to private individuals.

The one number → CNIC lookup that works: 667 MNP

If you want the CNIC bound to a SIM you’re currently holding, the 667 service does exactly that. From the SIM in question, type MNP (uppercase or lowercase, both work) and send to 667. The reply confirms the registered owner’s name and a partially masked CNIC.

The masking pattern in the response varies slightly by operator but typically shows the first three and last two digits of the CNIC with the middle eight digits replaced by asterisks. This is enough to confirm a binding when you already know the owner’s CNIC — you can match the visible digits — but it doesn’t expose the full CNIC for use elsewhere.

Critically, 667 only returns information for the SIM that sent the SMS. You can’t query a different number this way. This is by design: the service exists to confirm whose name your hand-held SIM is registered under, not to investigate someone else’s number.

For the full 667 walkthrough including sample responses per network, see the dedicated 667 method page. For a direct comparison of what 667 returns versus what 668 returns, see 667 vs 668 Pakistan.

Number to CNIC for SIMs you own

If you want to know which CNIC is bound to a specific SIM you own — but you don’t have that SIM in your hand right now — the 668 service shows you the full picture across your CNIC.

Text your 13-digit CNIC straight (no dashes, no spaces) to 668. The reply lists how many SIMs are registered on your CNIC across the five operators. For the actual numbers, log into cnic.sims.pk and verify via the OTP sent to one of your registered numbers. The portal then displays each individual mobile number alongside its network, activation date, and verification status.

This is the “reverse” lookup that actually works at scale: not phone-number-to-someone-else’s-CNIC, but my-CNIC-to-all-my-phone-numbers. For most users running an audit, this is what they actually need. If the count is higher than expected and you need to remove unused SIMs, see how to deactivate extra SIMs in Pakistan.

When you need someone else’s CNIC from their number — legal paths

Several legitimate reasons exist for needing to identify the owner of a number that isn’t yours, and Pakistan has lawful channels for each:

• Police with an FIR can request CNIC details for a number involved in a reported offence. PTA processes these requests directly with operators and returns the bound CNIC to the investigating officer.
• Civil or criminal lawyers can subpoena ownership records through court order. This is the standard path in cases like contract disputes where a phone number is the only contact, or estate matters where a deceased person’s phones need to be identified.
• FIA Cyber Crime Wing handles online harassment, blackmail, fraud, and stalking. They have authority to trace SIM ownership without the case first going through the regular court system, making them the right venue for time-sensitive harassment or fraud cases.
• Banks and other regulated businesses can verify customer phone numbers against CNIC bindings through regulatory data-sharing arrangements with PTA. This isn’t open access; it’s specific to KYC and anti-money-laundering use cases.

None of these involves public reverse lookup. Each one runs through documented institutional channels with audit trails.

Why public “number to CNIC” sites are unreliable

Sites offering reverse lookup of arbitrary numbers fall into three categories, all of them unreliable:

• Most run on copies of the 2013 NADRA/PTA biometric leak. That dataset is twelve years stale, missing any SIM activated after 2013, and wrong about most current ownership bindings — because of re-verifications, releases, reassignments, and MNP. The leaked CNIC for a number may belong to someone who hasn’t held that SIM for years. See fresh SIM database Pakistan for a detailed breakdown of the accuracy gap.
• Some sites fabricate data outright. The “CNIC” returned is generated to look plausible (correct format, valid check digit) but doesn’t correspond to a real person. Premium-paid lookups on these sites are particularly likely to fabricate, because the user has already paid and won’t return to complain. For full context on why leaked-data sites keep cycling in and out of existence, see Pak SIM Data official.
• All of them carry privacy risk for you. Submitting your own phone number to a reverse-lookup site tells whoever runs it that you exist, that you’re searching for that number, and often reveals details about you via your IP address. Several such sites have been observed reselling their inbound query data to data brokers.

Find phone number by CNIC — the reverse direction

The “find phone number by CNIC Pakistan” search is usually somebody trying to do exactly what the 668 service does: identify which numbers are registered on a particular CNIC.

For your own CNIC, this is fully supported. Text your CNIC to 668 for a count by network. Log into cnic.sims.pk for individual numbers, activation dates, and statuses.

For someone else’s CNIC, the same restrictions apply as for number-to-CNIC: not available publicly. If you have a legitimate need to identify someone’s numbers (lost relative, deceased family member, documented investigation), the route is through PTA and the relevant operator with proper authorisation. For the full CNIC-keyed audit workflow, see the CNIC SIM check page.

CNIC details by mobile number for emergencies

Two specific scenarios occur often enough to warrant their own walkthrough:

• A lost relative’s phone with an unknown SIM, where you don’t know whose CNIC the SIM is registered to: the path is a police FIR for the missing person, then PTA’s law-enforcement liaison provides the CNIC binding to police. Trying to identify the SIM yourself through scraper sites delays the actual investigation and may produce wrong information that misleads the search.
• A deceased relative’s phone where the family needs to identify and close out the SIMs: the procedure runs through NADRA’s family-tree verification (which you can establish as a legal heir) plus the operator’s bereavement desk. Each major operator has a process for handling deceased customers’ accounts, including releasing SIMs from the CNIC and transferring numbers where appropriate. The family member acting needs their own CNIC, the deceased’s CNIC, the death certificate, and an FIR documenting the death. The operator franchise handles the rest. Network-specific procedures are covered on the Jazz, Zong, Telenor, and Ufone pages.

Neither path involves public reverse lookup.

Privacy and the legal framework

The relevant statute is the Prevention of Electronic Crimes Act 2016 (PECA), particularly Section 6 (unauthorised access to information system or data) and Section 21 (covering cyber-stalking, strengthened by the 2025 amendments). These sections cover the act of obtaining another person’s identity data through unauthorised means — which includes querying leaked databases — regardless of why you’re doing it.

PTA’s own privacy framework reinforces this. The cnic.sims.pk OTP requirement, introduced in 2024, exists specifically to block unauthorised CNIC-to-records access. The previous gap — where anyone with a CNIC could pull a full record — was exploited at scale by leaked databases and is now closed. For context on how the SIM limit interacts with your exposure surface, see PTA SIM limit per CNIC Pakistan.

Violations are tracked. FIA’s Cyber Crime Wing has investigated and prosecuted misuse of leaked databases in cases ranging from stalking to identity-theft fraud. The defence of “the data was already leaked” doesn’t hold up in court — possession and use are separate offences from the original leak.

If your concern is a specific number rather than a CNIC audit, the full treatment of what official channels return for number-based queries is at SIM details by number. For a quick check of which network any Pakistani number belongs to, the live SIM tracker covers that use case.

Frequently asked questions

Can I find a CNIC from a phone number for free?

Only for SIMs you own. Text MNP to 667 from that SIM to see the bound CNIC (masked), or use 668 or cnic.sims.pk for all numbers on your CNIC.

Is reverse lookup legal in Pakistan?

Looking up your own records is legal. Looking up another person’s CNIC from their number through leaked datasets may violate Section 6 of PECA 2016.

Does 667 show the full CNIC?

No. 667 typically shows a masked CNIC with the middle digits replaced by asterisks. The full CNIC is available via cnic.sims.pk for SIMs on your own CNIC. See the 667 method page for a sample of the exact reply format per network.

What does the masked CNIC in 667 mean?

Masking is a privacy measure. The visible digits are enough to confirm a binding you already know, but insufficient to use the CNIC elsewhere.

How does the police get CNIC details from a number?

Through PTA’s law-enforcement liaison, with a documented FIR. PTA directs the relevant operator to release the binding to the investigating officer.

Can I sue someone using their CNIC found via leaked data?

Using leaked data to identify someone is itself a Section 6 PECA exposure for you. A lawsuit should start with a lawyer and a lawful identity request, not with scraper-site data.

How do I check the CNIC linked to my own SIM?

Text MNP to 667 from that SIM. The reply shows the registered owner name and a masked CNIC. For full CNIC details, log into cnic.sims.pk.

Can I find someone’s address from their phone number?

No. Address fields are not in PTA’s SIM records. NADRA holds CNIC addresses but does not expose them through PTA channels. Address retrieval requires a court order routed through NADRA.

What about WhatsApp’s profile name — does that show the CNIC owner?

No. WhatsApp displays whatever profile name the user set, which is unrelated to the underlying SIM’s PTA registration.

Last updated: May 2026 · Verified against current PTA notifications and PECA 2016.