A call from someone who says they are from your bank, or from a helpline you found on a search result. An OTP you were persuaded to read out. A link that opened a page looking exactly like your bank's. Minutes later the balance is gone.
What happens next is decided almost entirely by speed, and by whether you create a written record on day one.
The first hour
- Call your bank's helpline and report fraud. Ask them to block the account and the card, and to place a hold on the beneficiary account. Note the time and the complaint reference number, and the name of the person you spoke to.
- Follow it up in writing the same day — email to the bank's complaint address, and a written application at the branch with a received stamp. A phone call alone leaves you dependent on their record of it.
- Report to the FIA Cybercrime Wing. Banks act far more readily on a beneficiary freeze when there is a cybercrime complaint behind it.
- Change your credentials from a clean device, and check whether an unrecognised beneficiary, a new device or a changed mobile number has been added to your profile.
Ask expressly for the beneficiary account number, title and bank. You are entitled to know where your money went, and that detail drives everything afterwards — the freeze, the police complaint and any civil recovery.
What to put in the written complaint
- Your account and card details, and the exact transactions with date, time and amount.
- How it happened, honestly — the call, the link, the OTP, the app you were asked to install.
- Whether you disclosed an OTP or a PIN, and to whom.
- The beneficiary details, if the bank has given them.
- What you are asking for: reversal, a freeze on the beneficiary account, and a written investigation report.
Do not exaggerate and do not conceal that you shared an OTP. It is better argued honestly than discovered later.
Who bears the loss
This is the contested question, and the answer is not automatic either way.
The State Bank's consumer protection framework requires banks to run secure systems, to authenticate transactions properly, to monitor for suspicious activity and to resolve complaints within defined timelines. Where the failure lies with the bank's systems or procedures — a transaction pushed through without proper authentication, a beneficiary added without verification, an obvious fraud pattern that its monitoring should have caught, a delayed response after you reported — the bank's position is weak.
Where the customer voluntarily disclosed credentials, banks routinely deny liability. But that is an argument, not a conclusion. The relevant questions are whether you were deceived by a convincing impersonation of the bank itself, whether the bank's own controls should have flagged the transaction, and above all how quickly the bank acted once you told it.
Delay by the bank after your report is often the strongest point you have.
Escalation
- The bank's complaint unit, with a deadline.
- The Banking Mohtasib Pakistan — the specialist ombudsman for banking complaints. Free, no lawyer required, and this is exactly the class of case it exists for. Complain in writing with the full history and the bank's reply, or evidence that it did not reply in time.
- The State Bank of Pakistan's consumer protection function, for conduct and for breaches of its own directives.
- A civil suit for recovery, where the sum justifies it — against the bank, the beneficiary, or both. Where the beneficiary is identified and holds assets, an application to attach before judgment matters more than the decree.
The criminal side
The offences are cheating under sections 415 to 420 of the Penal Code together with the Prevention of Electronic Crimes Act, 2016 — section 14 for fraudulent use of an information system, section 13 for electronic forgery of the fake page, section 16 for identity misuse, and sections 3 and 4 for unauthorised access to data.
Prosecution rarely returns your money. It matters because the freeze, the beneficiary trace and the bank's cooperation all move faster once a formal investigation exists.
What actually prevents this
- No one from a bank ever needs your OTP, PIN or password. Not to verify you, not to reverse a transaction, not to block a card. There is no exception to this and it is worth saying to every relative who has a bank account.
- Never call a helpline number you found in a search result or a social media comment. Use the number printed on your card.
- Do not install remote-access apps because a caller asked you to. That is how the screen and the OTP are taken together.
- Enable transaction alerts and read them. The reversal window is measured in hours.
- Set a low daily transfer limit and raise it only when you need to.
This article describes general banking complaint procedure in Pakistan and is not advice on any particular loss. Whether a reversal is achievable depends almost entirely on how quickly the beneficiary account is frozen. Report to your bank and the FIA Cybercrime Wing immediately, and consult an advocate before accepting a final rejection.