OTP Fraud & Interception Scams: Full Protection Guide
Six digits. That's all it takes. Your bank sends them to confirm a transfer is really you, and for one careless moment, so many of us read them out to a stranger on the phone who sounded official enough. PTA has repeated the same warning for years, most recently with fresh urgency: never share your OTP, your CNIC number or your password with anyone. And yet the fraud keeps working, because it doesn't attack your phone's security. It attacks your trust. This guide explains exactly how OTP fraud happens in Pakistan, what officials have confirmed, the newer trick of malicious apps that read your SMS without asking you to say a word, and a practical way to build a habit that protects you and your family.
An OTP is something you enter, never something you say or type to someone else. No bank, wallet, PTA, NADRA or police officer will ever ask you to read one out. If anyone does, the call is the fraud, whatever they claim to represent.
Here's what officials have actually said about how big this problem has become.
What Officials Have Actually Said
PTA has issued this warning more than once, which is itself worth noticing. On 30 November 2025, PTA issued an advisory urging citizens to be cautious of scammers impersonating PTA officials, bank representatives or courier services to steal OTPs, CNIC numbers and passwords, using fake calls, SMS or messages with suspicious links. Less than a year later, PTA repeated the warning, saying citizens should never share sensitive information such as a CNIC number, OTP or password with any unrelated individual, and should avoid clicking unfamiliar or suspicious links sent by SMS or messaging apps.
The scale behind the warning is significant. A document presented in the National Assembly in May 2026 put the number at 523,749 cybercrime complaints received by NCCIA between 2023 and 2026, against only 199 convictions in the same period, a conviction rate of roughly 0.038 percent. Officials have attributed the gap to outdated investigative tools, staffing shortages and jurisdictional hurdles when fraud crosses borders. As one analysis put it, an OTP fraud call is a cheaper attack than hacking a bank's systems directly, and it only needs to work on a small fraction of the people it reaches to be profitable.
Enforcement does happen, though. On 31 July 2026, NCCIA announced it had arrested 27 alleged members of what it called the "Oad gang" in coordinated raids across Lahore, Multan and Faisalabad: 13 suspects in Lahore, 13 in Multan and one in Faisalabad. According to the agency, the suspects posed as bank officials, customs and police personnel, representatives of charitable organisations, TCS riders and investment company employees to trick citizens into sharing OTPs, banking credentials and other sensitive details before transferring funds out of their accounts. Those arrested are accused, not convicted, and NCCIA said it was still analysing evidence to trace stolen funds and identify further members.
Decode the Scam Script
Fraudsters lean on a small set of openers, because they work. Pick the one closest to what you've heard, and see what's really happening underneath it. Nothing you click here is stored or sent.
Scam script decoder
Tap the line closest to what the caller said.
Tap a line above.
What's really happening: they've already triggered a real transaction or login on your account, and the code they're asking for is the one that would approve it. Reading it to them completes the theft.
Do this: hang up. Call your bank on the number printed on your card, not one the caller gives you.
What's really happening: PTA's genuine advisories about expired CNICs get copied word for word by scammers. The "code" is usually a real OTP from your bank or SIM account that they're trying to trick out of you.
Do this: check your CNIC yourself with 668 or the portal. Never confirm anything through a link in the message.
What's really happening: real police and NCCIA investigations don't run through unsolicited phone calls asking for a code. This is fear used as pressure.
Do this: hang up. If you're worried, contact NCCIA yourself on 1799 using a number you looked up.
What's really happening: courier and customs scams are a well-known variant. The "fee" request is a distraction, and the real goal is still the code.
Do this: contact the courier company directly through its official number or app, never through the caller.
What's really happening: you can't win something you never entered. The "confirmation code" is your bank's or wallet's real OTP.
Do this: hang up. A prize that needs your OTP to claim isn't a prize.
Three Ways an OTP Gets Stolen
"OTP fraud" isn't one trick. It's a small family of them, and knowing which one you're facing changes how you defend yourself.
- Voice social engineering. A caller impersonates a bank officer, a PTA official, a police officer, a customs agent, a courier rider or an investment firm employee, and talks you into reading out a code that's just landed. This is the pattern behind the July 2026 arrests described above.
- Smishing, SMS phishing. A text mimics a real service, warns that your account will be locked, and includes a link. The fake site asks for your login and the code, and both go straight to the fraudster.
- Malicious apps that read your messages. Some Android apps, often disguised as free-data offers or utility tools, ask for SMS permissions during install and then quietly forward your codes without you ever seeing a suspicious call. We cover this one in detail below, because it's the trick that needs no phone call at all.
All three end the same way: a code meant only for you reaches someone else, and they use it before you notice.
The App That Reads Your Texts
This is the quiet version of OTP fraud, and it's worth taking seriously because it doesn't need you to say anything on a phone call. Reports describe malicious Android apps, often disguised as utility apps, prize-notification apps or fake bank apps, promoted on social media or forwarded through WhatsApp with messages like "install this for free data". During installation, they request permission to read SMS messages. Once granted, they can forward your incoming codes to the fraudsters without any further action from you.
A rough checklist helps you spot the risk on your own phone. Nothing you tick here is stored or sent.
App permission checklist
Tick anything that's true on your phone right now.
- Review permissions periodically. Go into your phone's settings and revoke SMS read access from any app that doesn't specifically need it.
- Install only from the official app store, and be suspicious of anything a WhatsApp forward tells you to sideload.
- Prefer authenticator apps where you can. Codes generated on your device every 30 seconds, through apps like Google Authenticator or Microsoft Authenticator, can't be intercepted by reading your SMS, because there's no SMS involved. Many email and social media accounts support this. Most Pakistani bank apps and wallets still rely on SMS codes, so this isn't a full fix for banking yet, but it's worth turning on everywhere it's offered.
If you use MNP to 667 to check a SIM's record, treat that reply the same way: private, and never forwarded, since it's exactly the kind of identity detail these apps and callers are fishing for. Our MNP 667 code guide explains what it contains.
Tariq's Father and the "Blocked SIM" Call
Tariq's father gets a call from someone who sounds calm and official. "Your SIM will be blocked under a PTA order because your CNIC has expired. To stop it, read me the verification code we just sent." A code does arrive, moments later, from what looks like his bank. He almost reads it out, but pauses because Tariq had shown him a headline about exactly this kind of call a week earlier.
He hangs up, and calls the bank's number printed on his card. Nothing is wrong with his account. He checks his CNIC himself through cnic.sims.pk and finds it's valid. Tariq's father is invented, but the scenario matches how these calls work: a real PTA warning gets borrowed as bait, and a bank's own OTP becomes the "verification code" the caller wants. Our guide to expired CNICs and SIM blocking covers the genuine advisory these calls copy.
Who Genuinely Never Asks
One sentence, repeated by NCCIA, PTA and legal guidance alike, covers almost every case: no legitimate organisation asks for your OTP, PIN or password over a call, SMS or message.
- Your bank
- PTA
- NADRA
- Police / NCCIA
- JazzCash / Easypaisa
- Couriers
If anyone claiming to be from one of these calls and asks you to read out a code, the safest response is to end the call and contact that organisation yourself, on a number you looked up independently. Our guide to Truecaller vs official PTA verification explains why a name on your caller ID isn't proof of who's actually calling.
Better Than an SMS Code
You can't personally fix how your bank sends codes, but you can raise your own defences.
- Turn on app-based approvals wherever your bank or wallet offers them, instead of relying on SMS alone.
- Enable authenticator apps for email, social media and anything else that supports them.
- Turn on transaction alerts so you see activity the moment it happens, not after.
- Set sensible transfer limits where your bank allows it.
- Check your own SIM record occasionally. Text your CNIC to 668 or use the portal, and text MNP to 667 from your own SIM. Our 668 SMS code guide and portal guide show how. A SIM you don't recognise on your CNIC is worth investigating on its own.
If your phone ever loses signal suddenly and won't come back, treat it as an emergency rather than a coincidence. Our guide to SIM swap fraud has a first-hour plan for exactly that.
If You Already Shared One
It happens to careful people too, especially under pressure. Move fast and calmly.
- Contact your bank or wallet provider immediately using the number on your card or their official app, and ask them to freeze the account or reverse the transaction if possible.
- Change your passwords for banking, email and any account that shares the compromised login.
- Check for further messages or codes you didn't request, which can signal a second attempt.
- Report to NCCIA on 1799 or through its complaint portal, and to PTA on 0800-55055 or its complaint portal if the call abused telecom channels.
- File an FIR if money was taken, since banks and investigators often ask for one.
- Keep a written record of the call, the time, what was said, and every reference number you're given.
This is general information, not legal or banking advice, and your bank's own dispute process governs what happens to any lost funds.
Building the Habit in Your Family
Fraudsters target whoever is easiest to rush, and that's often the family member least comfortable with banking apps. A short, repeated conversation does more good than a single warning.
- Say the rule the same way every time: a code is only for you to type in, never to say out loud or forward.
- Practise hanging up. It's a skill some people need permission to use, especially with an insistent caller.
- Agree on a callback habit: always ring the organisation back on a number you looked up, never the one the caller gave.
- Share real examples, like the "blocked SIM" script above, so the pattern is recognisable before it happens.
- Check on elderly relatives' CNIC and SIM records together, with their consent, since they're often the most targeted.
Claims I Couldn't Verify
| The claim | What I found | Status |
|---|---|---|
| "OTP interception via SS7 attacks is common in Pakistan" | SS7 network-level interception is a known global technique, but I found no Pakistan-specific confirmed case. Most reported fraud here is voice or app-based, not network-level | Unverified locally |
| Specific malware or app names used in Pakistani campaigns | Described generically as WhatsApp-forwarded free-data apps by one guide, without a named app I could verify | Reported |
| PTA and NCCIA advisories against sharing OTPs and CNIC details | Confirmed by PTA's November 2025 and later 2026 advisories | Confirmed |
| 523,749 complaints and 199 convictions, 2023–2026 (0.038%) | Confirmed by a document presented in the National Assembly, reported by multiple outlets | Confirmed |
| 27 arrests, "Oad gang", 31 July 2026, Lahore/Multan/Faisalabad | Confirmed by an official NCCIA statement carried by the Associated Press of Pakistan. Those arrested are accused | Confirmed |
Treat network-level interception claims with particular scepticism. Almost everything documented about OTP fraud in Pakistan points to people being persuaded to hand codes over, or apps being granted permission to read them, not to codes being intercepted mid-air.
OTP Fraud: FAQs
What is OTP fraud?
Does any bank or government body ever ask for my OTP?
How do scammers steal OTPs without calling me?
How can I tell if a malicious app is on my phone?
Are authenticator apps safer than SMS codes?
What should I do if I already shared an OTP?
Is the "your SIM will be blocked" call real?
How common is OTP fraud in Pakistan?
Who do I report OTP fraud to?
Can I stop scam calls entirely?
The Code Is for You. It Stops There.
One habit, repeated every time, closes the door on most of this fraud.
Related guides: SIM Owner Details (main guide) · SIM Swap Fraud in Pakistan · Fresh SIM Data · PECA 2016 Explained · Truecaller vs Official PTA Verification.
Note: this is general information, not legal or banking advice. Confirm current guidance on pta.gov.pk and nccia.gov.pk. This site is independent and is not a government service.