How to Get a Refund After Online Banking Fraud in Pakistan
State Bank rules make your bank refund a transfer caused by its own security failure, plus compensation. What is covered, what is not, and the timeline.
If money left your account through no fault of yours and the weakness was on your bank's own side, State Bank regulation makes the bank give it back, not just apologise for it. That single rule gets buried under general advice to "contact your bank" after online banking fraud in Pakistan, and most victims never hear the part that actually forces a refund.
We read the State Bank of Pakistan's Electronic Fund Transfers Regulations 2018 at source on 5 October 2026 to find the exact liability rule, the clock it runs on, and where it stops applying.
A refund is owed when the failure was on the bank's side
The regulation is specific. Your bank, called the Originator AFI in the text, is liable for a refund when an unauthorised transfer happened because of a security breach, a control failure or negligence on its own end. The refund covers the stolen amount plus compensation.
An unauthorised transfer, by the regulation's own definition, is one started by someone other than you without your authority, or one where you got no benefit from it at all. A transfer you were tricked into approving yourself sits in murkier territory, which is why documenting exactly what happened matters from the first call.
The resolution clock runs for ten working days
Once you notify the bank, it has ten business days to investigate and resolve the error. That is not a target; it is the ceiling set in the regulation's own dispute resolution process.
The ten days break down into named steps rather than one long wait, and knowing them helps you push back when a stage stalls.
- The bank gives you a unique complaint number on the same day you report it.
- It checks its own statement, scroll and authorisation logs within three business days.
- If another bank's card network or terminal was involved, the complaint moves on within one business day.
- That other institution investigates in detail within three business days.
- Your account is credited within one business day once the complaint is upheld.
If the bank instead finds no error occurred, it must tell you within three business days of that finding and give you the records it relied on, if you ask for them. A bare "no error found" with nothing behind it is not a compliant answer.
Compensation is a fixed formula, not a goodwill gesture
Where the bank's own fault caused the delay, it owes mark up at three percent above the State Bank's policy rate for the period you were without your money. This is paid automatically within fifteen days of the error being confirmed, without you having to separately claim it.
Islamic banks follow a Shariah compliant equivalent of the same compensation duty rather than charging or paying conventional interest. Either way, the point is the same: a delayed refund is not supposed to be free for the bank.
What this does not cover
The regulation reaches mobile banking, internet banking, ATMs, point of sale terminals and branchless banking. It does not reach a payment you made to a shop or an online seller for goods or services; the rule says so in plain words. A purchase dispute runs through a different process with your card issuer instead.
A denied claim is not the end of the road
If your bank denies the refund or goes silent, you are not stuck. Escalation exists, and it costs nothing to use.
| Step | What happens |
|---|---|
| Bank complaint unit | First stop, always in writing, with a reference number |
| 45 days, no reply or a bad one | File with the Banking Mohtasib, free of cost |
| Microfinance bank account | State Bank itself acts as the second forum, not the Mohtasib |
| Separate and parallel | Report the fraud itself so it is on record with NCCIA |
A fuller walk through of those escalation clocks, including the acknowledgement and final reply deadlines your bank already works to, sits in our bank fraud complaint deadlines guide. Reporting the crime itself, separate from recovering the money, is covered in how to report a cybercrime in Pakistan.
What to do in the first hour matters as much as the law
A strong legal rule still needs a paper trail behind it. Block the channel the fraud used, note the exact time, and write down the transaction reference before memory gets fuzzy.
- Call your bank's helpline immediately and get a complaint number before you hang up.
- Screenshot every SMS or app alert tied to the transfer.
- Note whether you received an OTP for it, and when, since the bank will ask.
- Put the same details in writing by email the same day, so there is a dated record beyond the call.
Money sent to the wrong wallet by your own mistake, rather than someone else's fraud, is a different fix with its own steps, covered in our wrong wallet transfer guide.
Frequently asked questions
Will my bank always refund an unauthorised transfer?
Only when the security breach, control failure or negligence was on the bank's own end. A transfer you authorised yourself under deception is handled as a dispute, not an automatic refund.
How long does the bank have to investigate?
Ten business days from when you notify it, with a three business day deadline to explain itself if it finds no error.
Do I get anything beyond my money back?
Yes, where the bank was at fault. Compensation runs at three percent above the State Bank policy rate for the delay, paid within fifteen days of the error being confirmed.
Does this cover money I paid to an online seller?
No. The regulation explicitly excludes customer to merchant payments for goods and services. That goes through your card issuer's own dispute process instead.
What if my bank refuses to pay?
Escalate in writing, wait up to 45 days, then take it to the Banking Mohtasib, which is free. Microfinance bank customers go to State Bank directly instead.
Should I report the fraud to anyone besides my bank?
Yes. Recovering your money and reporting the crime are separate tracks, and reporting it keeps a record with NCCIA even while your bank's investigation runs.
About the author
Technology Journalist & Multimedia Producer
Ahmad Ali is a technology journalist and multimedia producer at Pakistan Era, joining the team in October 2026. He covers consumer technology and digital life for Pakistani readers, combining research with hands-on product testing.
