Your phone buzzes: “Your account has been temporarily blocked. Verify now to restore access.” It looks official, it is urgent, and it wants your PIN. This is how most digital payment frauds actually play out. It is rarely sophisticated hacking that empties accounts; it is a well-timed message that makes someone skip the one question that would have stopped it; is this really who they say they are?
The scale is bigger than most people realise. Phishing attempts like this sit behind close to 40 percent of all online fraud losses worldwide, and in Pakistan, where digital channels now handle more than 90 percent of retail transactions, the opportunities have never been greater.
Pakistan’s Banking Mohtasib recently resolved close to 28,000 digital fraud complaints in a single year, refunding victims over PKR 1.46 billion; which is a proof both of the scale of the problem and that recourse exists if you act fast.
Most scams start with a message that looks almost right: an email or text from “your bank,” asking you to verify your account through a link built to steal whatever you type. The logo might be exact, but the web address rarely is and importantly a genuine bank never needs a link to prove who you are.
Phone calls carry the same trick, dressed differently. Someone from “customer service” says your account is compromised and needs your OTP right now to stop it. A caller claiming to be police or FIA cybercrime staff says there is a “case” against you and demands money to close it. Real law enforcement never collects fines or bribes over a phone call. No legitimate institution asks for your PIN, password or OTP by phone, text or email. If unsure, hang up and call the number on your card yourself.
A newer version asks you to install a screen-sharing app like AnyDesk so a “technician” can fix an account issue. Once running, that person can see everything you type, including OTPs, and sometimes take over the device entirely. There is no legitimate reason a bank employee needs to control your phone.
Courier scams follow the same script wearing a different uniform: a text claims your parcel is stuck at customs or that delivery failed over an incomplete address, asking you to click a link and pay a small “clearance fee.” The amount is kept small so you pay without thinking; the link exists to harvest your card details, not release any parcel.
QR codes cause confusion because people assume scanning one only brings money in when at times it can do the opposite. A “buyer” asking you to scan a code to “receive” payment may actually be authorising money to leave your account. The same logic applies to “you’ve won a prize” messages asking for a small fee upfront: if receiving money or a reward requires you to scan, click or pay something first, treat that as a warning sign, not a formality.
If you have already shared something you should not have, speed matters most. Change your password, freeze the account if possible, and contact your bank through its official app or the number on your card and never one from a suspicious message. Report unauthorised transactions immediately; most providers have a limited window to reverse them.
None of this requires technical expertise, just a habit of pausing before you act. Verify who is asking, question anything wrapped in urgency, and remember that legitimate institutions are never in as much of a hurry as a scammer wants you to be.
By Zubair Yaqoob
