Unauthorised Bank Transaction in Pakistan: Who Is Liable and How to Recover

There is an important distinction underneath most banking disputes in Pakistan. A transaction you never authorised at all - a cloned card, a compromised system - is treated very differently from one you approved after being deceived into it. Both feel identical to the victim. Knowing which category you are in determines how you argue the case and how likely recovery is.

The first hour

1. Call the bank's fraud line using the number on your card or in the app - never a number from a search result.
2. Ask them to block the card or account and to attempt to freeze the beneficiary account.
3. Obtain a complaint reference number on that call, and note the time and the agent's name.
4. Follow up in writing the same day through the app, email or a branch visit, restating what you reported and when.
5. Change your credentials and check for any registered device or beneficiary you do not recognise.
6. Do not share any further codes with anyone, including callers offering to help recover the money.

Speed is the single strongest determinant of recovery. Fraud proceeds move through several accounts quickly, and a freeze request that arrives while the money is still in the beneficiary account is worth more than any argument made weeks later.

The distinction that decides liability

If you were deceived into approving, do not concede the point simply because you pressed a button. The questions that matter are how the deception was carried out, whether the bank's systems should have flagged an unusual transaction, and how quickly the bank acted once told.

Building the evidence

• Transaction records - IDs, amounts, timestamps, and the beneficiary account or wallet number.
• Your report - complaint reference, time of the call, and the written follow-up.
• The approach - the caller's number, messages received, any link clicked.
• Your location and device at the time, where you are asserting you did not transact.
• Any OTP messages received, or the absence of them.
• The bank's responses, in writing wherever possible.
• Account statements covering the period.

The beneficiary account number is the most actionable single item you can give anyone. It belongs to a real person who completed identity verification to open it, and it is the thread both the bank and the FIA can pull.

Escalating beyond the bank

Note that the Banking Mohtasib examines your bank's conduct, not the fraudster's. Frame that complaint around what you asked the bank to do, when, and what it did or failed to do.

Making the Banking Mohtasib complaint work

1. Exhaust the bank's own process first and keep every reference number.
2. Set out a clear chronology with dates and times.
3. Be specific about the failure - what you requested, when, and the bank's response or silence.
4. Attach everything - statements, complaint references, correspondence, the FIA complaint number.
5. State the remedy sought in precise terms.
6. Keep it factual. A measured chronology is more persuasive than an account of how badly you were treated.

The strongest Mohtasib complaints identify a specific act or omission by the bank - a freeze request ignored for two days, a complaint closed without investigation, a written query unanswered for weeks. Complaints framed purely as "I lost money and the bank should pay" are considerably weaker.

Realistic prospects

Being straightforward is more useful than optimism. Recovery is most likely where:

• You reported within hours and funds were still in the beneficiary account.
• The beneficiary is a domestic bank account rather than a wallet cashed out immediately.
• The bank was slow or unresponsive to a prompt freeze request, giving you a conduct complaint.
• The transaction was genuinely unauthorised and you can evidence that.

It is difficult where funds were converted to cash or moved offshore, where reporting was delayed by days, or where you authorised the transfer and the bank maintains it acted on instruction. Even then, filing matters - it supports a Mohtasib complaint, assists identification of repeat offenders, and is required for most insurance or employer claims.

Preventing the next one

• Never share an OTP. No bank, employer, buyer or official needs it.
• Call back on a known number rather than trusting an incoming caller who knows your details.
• Set transaction alerts so anything unusual surfaces within minutes.
• Use app-based two-factor authentication where offered rather than SMS.
• Review registered beneficiaries and devices periodically.
• Keep transfer limits low and raise them deliberately when needed.
• Treat urgency as a warning sign in any financial request.

For the wider scam patterns and the FIA route, see our guide to bank fraud and OTP scams.

If it is a business account

Corporate fraud follows different patterns and the amounts are usually larger, so the response differs.

• The invoice redirection fraud. A supplier's email is compromised and new bank details are sent. Verify any change of account by phoning a known number, never by replying.
• Internal misuse. An employee with access exceeds authority. Preserve system logs immediately and take advice before confronting anyone.
• Mandate abuse. A signatory transacts outside agreed limits. Check the mandate terms against what occurred.
• Notify insurers. Where you hold fidelity or cyber cover, prompt notification is usually a policy condition.
• Preserve evidence properly. Do not let anyone tidy up systems while the position is being assessed.

In the invoice redirection case the money often reaches a domestic account opened for the purpose. That account holder is identifiable and is the strongest investigative lead - give the beneficiary details to both the bank and the FIA on the same day.

Frequently asked questions