If you gave an OTP to a scammer, act at once.
Do not wait for money to leave your account.
Call your bank or wallet firm now.
Tell them that you shared an OTP with a person who may be a scammer.
Ask them to block or secure your account.
If money has already gone out, report the payment as soon as you can.
You can also report the fraud to NCCIA. Its cyber crime helpline is 1799.
NCCIA Cyber Crime Helpline: 1799 (24 hours).
For a bank or wallet loss, contact your bank or wallet firm first, then report the cyber crime.
What is OTP fraud?
OTP means one-time password.
It is a short code sent to your phone or email.
A bank, wallet, app, or web service may use an OTP to check that a real user is taking an action.
In an OTP scam, the fraudster tries to make you share this code.
The scammer may say:
- I am calling from your bank.
- Your account will be blocked.
- Your card has a fault.
- You won a prize.
- We need to check your account.
- Your wallet needs an update.
- Your payment failed.
- Your account has been hacked.
The aim is often to make you act with fear or haste.
I shared my OTP. What should I do now?
1. Call your bank or wallet firm
Tell them:
- you shared an OTP
- when you shared it
- who asked for it
- what phone number was used
- whether money has left the account
- whether you also gave a PIN, password, card number, or CNIC data
Ask them to check the account for risk.
2. Change key login data
If the bank or wallet firm tells you to do so, change your password, PIN, and linked email password.
Use a safe device.
3. Check recent payments
Look for bank transfers, wallet transfers, card payments, cash withdrawals, new payees, and new device logins.
Take screen shots of any payment you did not make.
4. Get a complaint number
Ask the bank or wallet firm for a case or complaint number.
Keep it.
What if no money has gone yet?
Still report the event.
An OTP may have been used to add a new device, reset a password, link an account, or approve a payment.
Do not assume you are safe only because you do not see a debit yet.
What proof should I save?
Save:
- scam phone number
- call log
- SMS
- WhatsApp chat
- OTP SMS
- time of the call
- bank alert
- wallet alert
- payment record
- transaction ID
- screen shots
- web link
- social media profile
- voice note
- bank complaint number
Do not edit the files.
Can a real bank worker ask for my OTP?
Do not give an OTP to a caller who asks for it.
JazzCash states that it will never ask for your PIN, OTP, or password.
Easypaisa also warns users not to share OTP data with callers.
If a person says they are from your bank, end the call.
Then call the bank on its own official number.
How do I report OTP fraud to NCCIA?
NCCIA deals with online financial fraud.
Its report routes include:
- Helpline: 1799
- Online complaint portal
- NCCIA office
- Helpdesk email
Which law may apply?
NCCIA's financial fraud page points to sections 13 and 14 of PECA 2016 for online financial fraud.
Section 14 deals with electronic fraud.
Other parts of PECA may apply if the case has fake data, identity misuse, spoofing, or illegal account access.
Quick action list
- Call your bank or wallet firm.
- Tell them the OTP was shared with a scammer.
- Block the account, card, or app if needed.
- Check recent payments.
- Change key login data.
- Save all proof.
- Get a complaint number.
- Report the fraud to NCCIA.
- Do not send a second OTP.
- Watch your account.
Official help
NCCIA Cyber Crime Helpline: 1799
SBP Sunwai: https://sunwai.sbp.org.pk/
—
Related guides and help
- Online banking fraud in Pakistan
- Easypaisa fraud complaints in Pakistan
- JazzCash fraud complaints in Pakistan
- phishing and fake bank link scams
- All money, banking and financial fraud guides
If you need legal advice on a cyber fraud case, our cyber crime lawyers in Pakistan can talk your situation through. You can also contact LawBridge for a consultation. This guide is general information, not legal advice for your specific matter.
Last checked: 14 August 2026.