Almost every online fraud in Pakistan runs on one trick: convincing you to share a code, install an app, or send a small fee. Banks, the State Bank, PTA and wallet companies never ask for OTPs or PINs. Learn the scripts once and they stop working on you.

The five scripts scammers use

  1. Prize / lottery: you won a car, plot or cash — pay a fee or share a code to claim. Real prizes never ask for money first.
  2. Fake bank officer: your account will be blocked unless you confirm the OTP just sent. That OTP is them logging into your account.
  3. Fake courier / parcel: a small payment link to release a parcel, harvesting card details.
  4. Account verification on WhatsApp: a friend (hacked account) or support asking for the 6-digit code — that code hands over your WhatsApp.
  5. Too-good jobs and investments: small first profit, then a bigger deposit that vanishes.

The golden rules

  • Never share any OTP, PIN or password — with anyone, for any reason. No exceptions exist.
  • Never install apps or screen-sharing tools a caller sends. That is remote control of your phone.
  • Cut and call back officially: if a bank call feels urgent, hang up and call the number printed on your bank card or the official app yourself.
  • Check the sender: official SMS come from your bank registered sender ID, not a random mobile number.
Family shield: Fraud targets parents hardest. Set their phones up with spam filtering (see our spam calls guide), warn them about these five scripts by name, and agree one family rule: any money or code request gets verified by a call to a known number first.

If money already left your account

  1. Immediately call your bank or wallet helpline from the official app/card and ask to freeze/block the account and dispute the transaction — minutes matter.
  2. Change passwords and PINs from a clean device, and check linked sessions.
  3. Save everything: screenshots, numbers, transaction IDs and times.
  4. Report to the FIA Cybercrime reporting channels and your bank in writing as they direct — keep the complaint reference.
No recovery agents: People on social media charging a fee to recover scammed money are usually a second scam on the victim. Only your bank, wallet provider, police and FIA are real channels.
Read also: Also protect your wallets: Easypaisa and JazzCash safety guide →

Frequently asked questions

My bank is really calling me — how do I know?

You often cannot tell from the call alone, because numbers can be spoofed. The safe habit: never act inside an incoming call. Hang up and dial the official number yourself — a real bank accepts this happily.

I only shared an OTP but no money left yet. Am I safe?

Act as if not: change your passwords and PINs now, check active sessions in banking/wallet apps, and call the provider to flag the account. An OTP shared is an account opened.

Can a scammer take money just from my account number?

An account number alone is not enough — fraud needs your codes, PIN, card details with CVV, or your approval inside the app. That is exactly why protecting codes matters more than hiding the number.