Scam guide
Phishing in Pakistan
Fake link or page to steal personal information. Below are community-submitted reports about phone numbers, websites and accounts linked to this type of scam. Community reports are one signal, not a verdict — always verify independently.
Phishing uses fake websites, links or pages that look like your bank, wallet, PTA or a delivery company to steal your login, card details or OTP.
How this scam typically works
- You get an SMS, email or WhatsApp link that looks like it is from a trusted company.
- The link opens a page almost identical to the real login page.
- It asks for your password, card number, OTP or CNIC.
- The stolen details are used to take money or take over the account.
Red flags
- Lookalike domains with extra letters or hyphens (for example, a misspelled bank name).
- Shortened or unusual links in messages.
- A login page asking for your full card number, PIN and OTP together.
- "Your account will be blocked, verify now" type messages.
Official advisories
Do not open banking links received by SMS
Fraudulent SMS with lookalike banking links is a common phishing method. Open your bank only through the official app or by typing the address yourself, and never enter your password or OTP on a page reached from a link.
Official advisories are awareness guidance published by authorities. They are not a verdict about any specific person and are kept separate from community reports.
Most reported for this scam type
Latest community reports
What to do if targeted
- Never enter credentials after clicking a link — open the official app or type the website yourself.
- If you entered details, change your password and call your bank immediately.
- Enable two-factor authentication where available.
- Report the link so it can be blocked and other users warned.
Where to report
- Your bank or wallet fraud desk.
- FIA NR3C cybercrime portal with the link/screenshot.
- PTA complaint portal for phishing SMS and numbers.
Frequently asked questions
The page looked exactly like my bank. How can I tell?
Check the domain carefully, never trust a link from a message, and always open your bank through the official app or by typing its website manually.
I entered my card details. What is the first step?
Block the card through your bank app or helpline immediately, then dispute any transaction and change your passwords.