Digital payment fraud in Pakistan is overwhelmingly social rather than technical. Almost nobody has their banking app broken into; they are persuaded to hand over a one-time password to a caller who sounds like the bank, or to approve a transaction they misunderstand. Because the transfer is technically authorised, recovery depends heavily on how fast you move and how well you document it.
The first hour
- Call the bank's fraud helpline immediately. Use the number on the back of your card or in the app, not a number from a search result. Ask them to block the card or account and to attempt to freeze the beneficiary account.
- Get a complaint reference number on that call and note the time and the agent's name. Without a reference you have no evidence you reported promptly.
- Follow up in writing the same day - the bank's app, email or a branch visit - restating what you reported and when. This converts a phone call into a documented complaint.
- Do not share any further codes with anyone, including callers claiming to help you recover the money. Recovery scams follow the original fraud closely.
- Capture the evidence. Transaction IDs, amounts, timestamps, the beneficiary account or wallet number, and the caller's number or the message that started it.
Report within hours, not days. Fraud proceeds are typically moved through several accounts or cashed out quickly. A freeze request that arrives while the money is still sitting in the beneficiary account is the single strongest determinant of whether you get it back.
What each body can actually do
| Body | What it can do | When to use it |
|---|---|---|
| Your bank | Block the card, attempt to freeze the beneficiary account, investigate, reverse in some cases | Immediately, always first |
| FIA Cybercrime Wing | Investigate the offence, trace and act against the account holder | Same day, in parallel |
| Banking Mohtasib | Adjudicate complaints about how a bank handled the matter | After the bank has responded unsatisfactorily |
| State Bank channels | Regulatory oversight of conduct | Where systemic failure is alleged |
Note the division. The bank is the only one that can act on the money quickly. The FIA deals with the criminal conduct. The Banking Mohtasib does not chase the fraudster - it examines whether your bank treated you properly.
Filing the FIA complaint
Electronic fraud is an offence under PECA. File through the FIA online portal or call 1991, and attach:
- The transaction record - ID, amount, date, time.
- The beneficiary account or wallet number, which is the most actionable single item you can give an investigator.
- The number or account that contacted you, and the full message or call log.
- Your bank complaint reference and the date you reported it.
- A chronological narrative of how the approach was made.
The beneficiary account matters because it is held by a real person who completed identity verification to open it. That is the thread investigators pull, even where the caller used a false identity.
Escalating to the Banking Mohtasib
The Banking Mohtasib Pakistan considers complaints against banks. It is the right forum when the complaint is about your bank's conduct rather than about the fraudster - for instance where the bank ignored a prompt freeze request, delayed unreasonably, failed to investigate, or declined without explanation.
Practical points:
- Exhaust the bank's own complaint process first and keep the reference numbers and correspondence.
- Complain in writing with a clear chronology and copies of everything.
- Be specific about the failure - what you asked for, when, and what the bank did or did not do.
- Attach the FIA complaint reference, which demonstrates you treated the matter seriously.
Where an account has been frozen rather than drained, our guide to bank account freezing in Pakistan covers the separate route for getting access restored.
The scripts to recognise
- The bank security call. A caller who knows your name and some account details says there is suspicious activity and asks for the OTP to "verify" or "block" it. A bank will never ask for an OTP.
- The prize or benefit scheme. You have won something, or been selected for a government payment, and a processing fee or a code is needed.
- The wrong transfer. Money is sent to you "by mistake" and the sender urgently wants it returned - often a device to launder funds through your account.
- The marketplace buyer. A buyer for your listed item sends a payment link or asks you to enter a code to "receive" money. Receiving money never requires a code from you.
- The recovery scam. After you are defrauded, someone offers to recover your money for a fee. This targets people already known to be victims.
One rule covers nearly all of these: a code sent to your phone is for you alone, and no legitimate person - bank, government, employer, buyer or helpful stranger - needs it. Anyone asking is committing an offence.
Realistic prospects of recovery
Being straightforward about this is more useful than false optimism. Recovery is most likely where:
- You reported within hours and the funds were still in the beneficiary account.
- The beneficiary is a domestic bank account rather than a wallet cashed out immediately.
- The bank acted on a freeze request promptly.
Recovery is difficult where funds were converted to cash or moved offshore, where reporting was delayed by days, or where you authorised the transfer and the bank takes the position that it acted on your instruction. Even then, filing matters: it supports any Banking Mohtasib complaint, contributes to identifying repeat offenders, and is required for most insurance or employer claims.
Frequently asked questions
What should I do first if I have been defrauded online in Pakistan?
Call your bank's fraud helpline immediately using the number on your card or in the app, ask them to block the card and attempt to freeze the beneficiary account, and get a complaint reference number. Speed matters more than anything else.
Will a bank ever ask for my OTP?
No. No legitimate bank, government body, employer or buyer needs a one-time password sent to your phone. Anyone asking for it is attempting fraud.
Can I get my money back after an OTP scam?
Sometimes. Recovery is most likely where you reported within hours, the funds were still sitting in a domestic beneficiary account and the bank acted promptly on a freeze request. It is much harder once funds are cashed out or moved offshore.
What is the Banking Mohtasib for?
It adjudicates complaints about how a bank handled your matter, not against the fraudster. Use it after you have exhausted the bank's own complaint process and kept the references and correspondence.
Should I report bank fraud to the FIA as well as my bank?
Yes, in parallel. The bank is the only one who can act quickly on the money; the FIA deals with the criminal conduct and can trace the beneficiary account holder.
Someone transferred money to me by mistake and wants it back. Is that safe?
Treat it with caution and involve your bank rather than transferring it yourself. This is a common method of routing fraud proceeds through an innocent person's account.
Can someone recover my lost money for a fee?
Almost certainly not. Recovery scams specifically target people already defrauded. Deal only with your bank, the FIA and, if needed, the Banking Mohtasib.
Sources & official references
- Banking Mohtasib Pakistan - adjudicates complaints about how a bank handled your case
- State Bank of Pakistan - regulator for banks and payment systems
- Federal Investigation Agency - official cybercrime wing pages, reporting centres and complaint facility