Every bank, however modern its technology, rests on an old and fragile promise: that money handed over today will be returned tomorrow, whenever its owner asks for it. Marble halls, armed guards and sleek mobile applications are simply different ways of dressing that promise. In the early hours of Monday, 2 November, that promise broke for millions of people in Paraguay. The Central Bank revoked the licence of Ueno Bank, the country's largest digital lender, and placed it under resolution. By sunrise, its app had gone dark, cards were being declined and payment gateways had fallen silent. Roughly three million customers, about six in ten Paraguayan adults, suddenly found that the money they had trusted to their phones was out of reach.
Within a week, the crisis had toppled the central bank governor, produced criminal charges against 27 people and removed an elected president. It was not a cyberattack, yet few recent events reveal more clearly how fragile a digital society can become. Ueno's rise had been spectacular. Rooted in a small finance company founded in 1976, it obtained a full banking licence in late 2023 and expanded at astonishing speed. It offered cashback on groceries, opened more than seventy branches, sponsored the national football team and put its name on the main stadium. In 2024, it absorbed Visión Banco, and in March 2026, it sold $350 million in bonds abroad.
For young Paraguayans who had never felt welcome in traditional banks, an account opened in minutes on a smartphone represented modernity itself. Beneath the shine, however, lay serious concerns. According to reports based on central bank findings, Ueno had lent around $146 million to companies linked to its controlling shareholder, Grupo Vázquez, with some loans reportedly beyond legal limits, poorly documented or inadequately secured. The accused are entitled to the presumption of innocence, but the pattern is familiar: rapid growth, generous lending to insiders and reliance on public confidence until that confidence disappears.
What turned a bank failure into a national political crisis was the web of connections between Ueno and the state. President Santiago Peña had previously held shares in a company that later merged into Ueno's holding structure. He also appointed Carlos Carvallo, who had chaired Ueno's predecessor company until 2023, to lead the central bank responsible for supervising it. Meanwhile, public money flowed into Ueno. By August 2026, state agencies and pension bodies had deposited roughly $850 million there, including around $380 million from the Social Security Institute. Peña denies wrongdoing, but the perception of a regulator too close to the regulated proved politically devastating once the bank collapsed.
The political fallout was swift. Carvallo resigned, prosecutors charged 27 bank directors and associates, and crowds of anxious depositors gathered outside closed branches. Within days, Congress impeached President Peña and the Senate voted unanimously to remove him. Vice President Pedro Alliana was sworn in as his replacement. Behind the political drama lay considerable human suffering. Pensions for more than 32,000 retirees were reportedly linked to reserves held at the bank. Small businesses dependent on Ueno for payments struggled to pay suppliers and staff, while government programmes were disrupted. The deposit guarantee fund began reimbursing customers, but for many families, the frozen account did not contain wealth. It contained their means of survival.
Nothing reported so far suggests that hackers caused Ueno's collapse. Yet the crisis exposed the same structural weakness that cybercriminals exploit: the concentration of a nation's daily life in a handful of digital platforms. When a single app serves a majority of a country's adults, switching it off—whether by a regulator, a criminal or a technical failure can have the same immediate effect. Wages, pensions, shopping and other daily transactions can stop at once. Digital banking brings millions into the formal economy, but it can also remove the physical buffers, such as cash reserves or access to a local branch, that once softened the impact of institutional failure.
Convenience can become collective vulnerability overnight, and the speed that makes digital finance attractive also makes its failures spread faster. Paraguay was already familiar with digital shocks. In 2025, a group calling itself Brigada Cyber offered for sale personal data covering about 7.4 million records. The government refused to pay the ransom, and the data was later published. Researchers traced part of the breach to malware on the device of a Health Ministry employee, whose stolen credentials opened a door into state systems.
The consequences quickly spread beyond government databases. Citizens reported malicious messages and calls designed to steal access to bank accounts and digital wallets. Other official websites were defaced, while the president's account on X was hijacked to announce falsely that Bitcoin had become legal tender. These incidents demonstrate how a data breach can quickly become a financial threat to ordinary households. Paraguay's experience also suggests that weak cyber defence and weak financial governance often grow from the same problems: limited oversight, political patronage and insufficient accountability.
Paraguay's experience suggests that weak cyber defence and weak financial governance often grow from the same problems: limited oversight, political patronage and insufficient accountability.
For Pakistan, the Paraguayan story is not distant news but a mirror. Pakistan is moving rapidly towards a cashless economy. The State Bank has licensed a new generation of digital banks, while mobile wallets serve tens of millions of customers. Raast has transformed instant payments, and digital financial services have brought millions of people, including women and rural workers, into the formal economy. This is genuine progress. But it also concentrates risk.
If a major wallet or digital bank were to fail, freeze or be crippled by a cyberattack, millions of households could lose access to wages, remittances and welfare payments within hours. Pakistan's history should encourage caution. The collapse of cooperative finance societies in Punjab during the early 1990s wiped out the savings of countless small depositors and demonstrated how politically connected institutions can betray public trust when supervision is weak.
The more immediate danger in Pakistan, however, may be fraud on an industrial scale. The Global State of Scams Report 2025 estimated that scams cost Pakistan around 2.5 per cent of GDP, or roughly $9.3 billion annually. Many losses occur not because a bank's systems are hacked, but because customers are tricked into sharing PINs and one-time passwords. Criminals impersonate bank officials, telecom staff and even family members. Fake applications mimic popular services, while stolen personal data provides criminals with the information needed to make their scams more convincing. Insider threats can make the problem worse, while large-scale data leaks create fresh opportunities for fraud.
Every leaked record can become raw material for the next scam. Pakistan's state institutions face threats of their own. Cyberattacks, ransomware and espionage campaigns have exposed weaknesses in both public and private systems. Yet the danger does not lie only in sophisticated foreign hackers. Ordinary negligence can be just as damaging: unpatched servers, shared passwords, pirated software and officials clicking on malicious links. Pakistan also shares some of Paraguay's institutional vulnerabilities. Regulators' independence is often questioned, public funds can be influenced by political considerations, and organisations have a tendency to conceal embarrassing breaches rather than disclose them. A country that keeps its failures secret cannot learn from them, and a country that cannot learn from them risks repeating them at a greater cost.
How can Pakistan avoid a Paraguayan moment?
The first safeguard is institutional. Regulators must be genuinely independent of the institutions they supervise, with strict conflict-of-interest rules for political leaders, ministers and central bankers. Lending to related parties should be capped, audited and publicly disclosed. Public pension and welfare funds should never be excessively concentrated in a single private institution, however fashionable or technologically advanced it may be. Deposit insurance must also be widely understood and capable of paying customers quickly when a financial institution fails.
On the cyber front, resilience strategies and information security frameworks must be implemented with clear deadlines and penalties rather than left as policy documents. Pakistan also needs a strong data protection law and rules requiring organisations to disclose serious breaches. Banks, digital wallets, telecom companies, regulators and cybercrime authorities should have a single rapid-response mechanism capable of freezing stolen money before it disappears through multiple accounts.
Citizens also have a role to play. No genuine bank or wallet should ask customers for a PIN, password or one-time code over the phone. Such requests should be treated as fraud. Applications should be downloaded only from official stores, and two-factor authentication should be enabled wherever possible. Unexpected calls about prizes, blocked accounts or relatives in trouble should be verified independently before money is transferred. Households should also avoid keeping all their savings in a single bank or digital wallet, maintain an alternative account where possible and keep a modest emergency cash reserve.
Most importantly, awareness campaigns must reach people in Urdu and regional languages through television, radio, schools and mobile networks. The newest users of digital finance should not become its easiest victims. Paraguay must now rebuild confidence in its banks, regulators and digital institutions at the same time. The deeper damage, however, will take longer to repair than a broken application.
For a few days in November, millions of Paraguayans stared at phone screens that refused to open and discovered how much of their lives depended on systems they could neither see nor control. That experience is the hidden condition of every digital society, including Pakistan's. Money and information increasingly live in code, governed by institutions whose integrity determines whether that code serves citizens or betrays them. The old promise on which every bank rests has not changed; only its packaging has. Technology can open the doors of opportunity, but only honest, capable and accountable institutions can ensure that those doors do not suddenly lock with everyone's savings inside.