Online financial fraud in Pakistan usually takes one of a few forms: a call impersonating a bank or a government body that extracts an OTP; a fake investment or prize scheme; a compromised mobile wallet; or a fraudulent online seller. In all of them the money moves through an account, and everything depends on reaching that account before it is emptied.
The first hour
- Call your bank's helpline immediately and report the transaction as unauthorised. Ask them to block your account or card and to raise a fraud dispute. Note the time of the call and the complaint reference.
- Ask the bank to request a freeze on the beneficiary account. This is the request that recovers money. Banks can, through their fraud channels and the State Bank's arrangements, seek a hold on the receiving account. Say the words: you are asking for the beneficiary account to be marked and frozen.
- Do not share any further information with the caller, and do not act on any follow-up call offering to help recover the money - a second call impersonating the FIA or the bank is a standard part of the pattern.
- Report to the FIA Cybercrime Wing, online or in person, the same day.
- Where a mobile wallet is involved, report to the wallet provider as well as the bank.
Preserve the evidence
- The transaction record: date, time, amount, beneficiary account number and title, and the reference number
- The SMS and email alerts from the bank
- The call log showing the fraudster's number, and any recording
- Any messages, links or screenshots of the site or app used
- Your bank statement for the period
Who is liable for an unauthorised transaction
This is genuinely contested and the outcome depends on the facts.
Where the loss arose from a failure in the bank's systems or controls - a breach at the bank's end, a transaction that should have been flagged, a failure to act on a reported compromise - the bank's liability is strong.
Where the customer disclosed an OTP or PIN, the bank's standard position is that the customer authorised the transaction. That position is not automatically correct: the State Bank's consumer protection framework requires banks to have controls, to educate customers and to investigate disputes properly, and where the customer was deceived by a caller who already possessed the customer's data - which usually means the data leaked from somewhere - the analysis is not straightforward.
The practical approach is to press the dispute through the bank's own process first, in writing, and to escalate rather than accept the first refusal.
Escalating: the Banking Mohtasib
If the bank rejects the complaint or does not resolve it within its stated timeline, complain to the Banking Mohtasib Pakistan. The route is:
- Complain to the bank in writing and keep the acknowledgment.
- Wait for the bank's response, or for the period it has specified to expire - ordinarily around forty-five days.
- File with the Banking Mohtasib on the prescribed form, attaching the bank's response and your evidence.
The service is free, requires no lawyer, and the Mohtasib can direct the bank to compensate. Fraudulent-withdrawal complaints are a substantial part of its caseload and it makes awards in them.
The State Bank also operates a public complaint facility, and complaints there frequently prompt movement at the bank.
The criminal case
Under PECA, the applicable provisions include section 14 - electronic fraud, section 13 - electronic forgery, section 12 - tampering with communication equipment where a SIM was involved, and section 16 - unauthorised use of identity information. Cheating under the Penal Code applies alongside.
The FIA's practical advantage is that it can obtain the beneficiary account's KYC record and the call data, which is how these cases are solved. Mule accounts are usually opened on real CNICs belonging to people who sold their account details, and that is the thread investigators follow.
Realistic expectations
Where the report is made within hours and the money is still in the beneficiary account, recovery is genuinely possible. Where it has been withdrawn in cash or moved through several wallets, the money is generally gone even if the offender is eventually identified and prosecuted. This is why the sequence at the top of this article matters more than anything else in it.
Prevention worth stating plainly
- No bank, no branch, and no regulator will ever ask for an OTP, PIN or full card number. Anyone who does is committing a crime, whatever number they are calling from - caller ID is trivially spoofed.
- Enable transaction alerts and check them.
- Set per-transaction and daily limits on internet and mobile banking.
- Never open a bank account or SIM for someone else. That is how mule accounts are created, and the account holder is prosecuted.
This article describes general steps and remedies for online financial fraud in Pakistan. It is not advice on any specific case. Report to your bank and the FIA immediately; timing determines recovery.