Phishing Scams in Pakistan: Fake Bank Links, Login Pages and Messages

A fake bank link can steal more than your password.

It may take:

• bank login
• card data
• OTP
• CNIC data
• email login
• wallet login

If you clicked a fake bank link but did not type any data, close the page.

If you entered bank data, call your bank now.

If you gave an OTP or password, treat the account as at risk.

NCCIA warns that fraudsters use fake emails, calls, and text messages to steal financial data.

What is phishing?

Phishing is a scam that tries to make you trust a fake message, link, email, or web page.

The scammer may act like:

• your bank
• Easypaisa
• JazzCash
• State Bank
• a courier firm
• a shop
• a tax body
• a government office
• a social media app

The aim is to get you to click a link, type a password, share an OTP, give card data, download a file, install an app, or send money.

I clicked a fake link. What should I do?

First ask what you did after the click.

There is a big difference between opening a page, typing your login, typing card data, giving an OTP, and installing an app.

If you only opened the page, close it.

Do not go back to check it.

Save the link if you can do so without opening it again.

If you typed bank data, call the bank.

I entered my bank password on the fake page

Call your bank at once.

Tell them:

• you used a fake page
• you typed your bank login
• when it happened
• whether you also gave an OTP
• whether you see any new payment

Change the password through the real bank site or app if the bank tells you to do so.

I entered my card number and CVV

Call the card issuer.

Ask whether the card should be blocked.

Do not wait for a payment alert.

I also shared an OTP

Treat this as urgent.

An OTP may approve an action.

Tell the bank that both your login or card data and your OTP were shared.

I downloaded an app from the fake link

Stop using the app.

If you think it may have had access to your phone, use another safe device to contact your bank.

Tell the bank that your phone may be at risk.

How can I tell if a bank link is fake?

Warning signs can include:

• odd web address
• spelling change in bank name
• short link
• fear based text
• urgent demand
• request for OTP
• request for PIN
• request for full password
• page opened from an unknown SMS
• fake prize
• threat to block account
• request to install an app

Good design does not prove that a site is real.

What proof should I save?

Save:

• SMS
• phone number
• email
• email sender
• fake web address
• screen shot
• date
• time
• bank alert
• transaction ID
• chat
• social media ad
• name of app you were told to install
• bank complaint number

How do I report phishing to my bank?

Tell the bank:

• you got a fake bank message
• you clicked the link
• what data you entered
• whether an OTP was shared
• whether an app was installed
• whether funds have moved

Ask for a case number.

How do I report phishing to NCCIA?

You can report a cyber fraud case through:

• NCCIA helpline 1799
• NCCIA complaint portal
• NCCIA office

Which law may apply?

NCCIA points to sections 13 and 14 of PECA 2016 for online financial fraud.

Section 14 deals with electronic fraud.

Depending on how the fake site or message was made, other PECA rules may also be relevant, such as spoofing, fake electronic data, identity misuse, or illegal access.

Quick action list

1. Close the page.
2. Do not enter more data.
3. Call your bank if you entered secret data.
4. Block the card if needed.
5. Change the password if needed.
6. Save the fake link.
7. Save the SMS or email.
8. Check for new payments.
9. Report fraud to NCCIA.
10. Watch your account.

Official help

NCCIA Cyber Crime Helpline: 1799

SBP Sunwai: https://sunwai.sbp.org.pk/

Related guides and help

• Online banking fraud in Pakistan
• OTP fraud in Pakistan
• Easypaisa fraud complaints in Pakistan
• JazzCash fraud complaints in Pakistan
• All money, banking and financial fraud guides

If you need legal advice on a cyber fraud case, our cyber crime lawyers in Pakistan can talk your situation through. You can also contact LawBridge for a consultation. This guide is general information, not legal advice for your specific matter.

Last checked: 14 August 2026.