Your phone rings. The caller introduces himself as an officer from your bank. He sounds professional and urgent: “Sir, your account has been blocked due to suspicious activity. To unblock it, please read out the OTP code that just arrived on your phone.”
The moment you share that code, money starts leaving your account. This is bank impersonation fraud — one of the most common financial scams in Pakistan — and it works because the caller uses fear and urgency to stop you from thinking.
How the scam works
The fraud follows a simple script, usually in four steps:
- The urgent call. You get a call from a private mobile number. The caller claims to be from your bank’s helpline or fraud department. He may say your account or debit card has been blocked, or that it needs “verification” because of suspicious activity.
- Fear and pressure. He warns that your account will be closed or frozen if you do not act immediately. This artificial urgency is deliberate — it is meant to stop you from pausing and checking whether the call is real.
- The OTP request. He asks you to read out the one-time password (OTP), PIN, or password that just arrived on your phone. Sometimes he also asks for your CNIC number or debit card details.
- The money moves. With your OTP, the scammer completes a mobile banking transaction or wallet transfer. The funds move instantly, and are often pushed through branchless banking accounts (Easypaisa, JazzCash) in small steps to make them hard to trace.
Some fraudsters add extra touches to look real. They send you an SMS that mimics your bank’s message format, claiming an amount has been debited from your account, then call and say they can reverse it. Others already know your name and account number — customer data leaked or sold by insiders has been linked to these gangs.
What the State Bank of Pakistan says
The State Bank of Pakistan (SBP) has issued public warnings about exactly this trick. According to the central bank:
- Fraudsters call or message pretending to be bank representatives and ask for OTPs, PINs, passwords, or mobile numbers under the pretext of account verification.
- Their real aim is to access your mobile banking and steal money.
- Banks never ask for sensitive information through phone calls or text messages.
- Anyone who receives such a call should verify through the bank’s official helpline or by visiting a branch directly — and victims should immediately inform their bank and report the fraudulent number.
The SBP also requires all banks and microfinance banks to record information about attempted and completed fake-call frauds at their call centers, and to get the fraudsters’ numbers reported to PTA for SIM and device blocking.
Red flags that expose the call
Watch for these signs — any one of them means you should hang up:
- The number is a private mobile number. Genuine bank alerts come from the bank’s designated SMS short code (usually a four-digit number), never from a personal 03xx number.
- They ask for an OTP, PIN, or password. A real bank never asks for these on a call or in a message. Any caller who asks is, by definition, not your bank.
- They create panic. “Your account will be closed in ten minutes,” “your card is already blocked” — urgency is the main weapon. Real bank procedures never force an instant decision on a phone call.
- They ask you not to tell anyone or to keep the call secret “for security reasons.”
- They already know some details about you. Leaked customer data is commonly used by these gangs, so partial knowledge proves nothing.
A related trick: the “accidental transfer” call
A variation of this scam is the call from someone claiming he mistakenly sent money to your account and asking you to send it back — sometimes after sending a fake SMS that mimics a bank debit alert. The SBP’s advice is clear: always check your actual account statement first before believing him. Never return money to a stranger’s demand.
What to do if you already shared your OTP
If you realize you have been tricked, the first hour matters most. Stolen money moves fast.
- Call your bank’s official helpline immediately and ask them to freeze the transaction and block the receiving account. Banks are required to acknowledge fraud complaints quickly, but the freeze request itself needs to happen within hours.
- Report to the NCCIA (National Cyber Crime Investigation Agency) cybercrime helpline 1799, or online — the agency specifically handles online financial fraud.
- Report the number to PTA (helpline 0800-55055 or the PTA CMS app) so the SIM used by the fraudster can be blocked.
- Save everything — the caller’s number, screenshots of messages, and transaction details with timestamps.
- If the fraud involved unauthorized debits from your account, you can also approach the Banking Mohtasib, the independent ombudsman for banking complaints, alongside your bank’s own complaint process.
How to protect yourself
- Never share an OTP, PIN, password, or card details with anyone on a call — no exceptions, even if the caller sounds official or knows your name.
- Hang up and call back yourself. If the call claims to be from your bank, end it and dial the official helpline number printed on your debit card or your bank’s website.
- Check SMS sender IDs. Real bank alerts come from official short codes, not private mobile numbers. When in doubt, open your banking app or call the helpline.
- Do not act under pressure. Any call that demands an instant decision is suspicious. Hang up, breathe, verify.
- Report scam numbers to PTA and NCCIA even if you did not lose money — every report helps block the fraudster’s SIM.
Related guides: How SIM Swap Fraud Takes Over Your Number, Fake Easypaisa and JazzCash Payment Screenshots, The BISP 8171 SMS Scam, and WhatsApp “Vote for My Child” Contest Scam.