OTP Scam in Pakistan: 8 Tricks Used to Get Your Code (2026 List) and What to Do If You Shared It
OTP scams in Pakistan: 8 tricks used to get your code, the real JazzCash and Easypaisa helplines, and the calls to make in 30 minutes if you shared it.
An OTP scam in Pakistan is any call, SMS or chat that tries to get the one-time code sent to your phone. No bank, wallet, PTA, NADRA, BISP or WhatsApp staff member will ever ask you for it. JazzCash says it will never ask for your PIN, OTP or password. If you already shared a code, call your bank or wallet helpline at once, then complain to the NCCIA on 1799.
An OTP, short for one-time password, is the 4 to 6 digit code your bank, wallet or WhatsApp sends to confirm it is really you. Whoever holds that code for the next few minutes is "you". Below are the eight tricks used to get it, how to tell a real call from a fake one, and the exact order of calls to make if the code has gone. We read PKCERT's advisories and the JazzCash and Easypaisa contact pages on 25 October 2026.
Eight tricks are used to get your code, and all of them follow one script
Every OTP scam creates a reason, adds urgency and then asks for the code. The reason changes: a blocked account, a parcel, a prize, a "mistake". The ask never does. Learn the eight common stories below and you will recognise the ninth one too.
| Trick | What they say | What the code really does |
|---|---|---|
| "Sent by mistake" | "I sent my code to your number, please forward it" | Moves your WhatsApp to their phone |
| Fake bank or wallet call | "Your account or ATM card is blocked, confirm the code" | Approves a transfer or new device |
| Fake courier | "Your parcel is on hold, tell me the code to deliver" | Opens your wallet or WhatsApp |
| Fake prize or BISP payment | "You won, or your BISP money is ready, share the code" | Logs them into your account |
| Fake PTA staff | "Your SIM or phone will be blocked unless you verify" | Takes over the account they chose |
| Phishing link | A page that looks like your bank or WhatsApp | You type the code into their site |
| Call forwarding code | "Dial this code to fix your network" | Sends your voice OTP calls to them |
| Screen-sharing app | "Install this app so I can help you" | Lets them read codes on your screen |
PKCERT, the national computer emergency team, describes the "by mistake" request, call forwarding and phishing links in its advisory on WhatsApp hijacking. PTA's scam awareness pages list callers who pretend to be banks, BISP or PTA staff. The courier version has its own steps in our piece on the fake courier call asking for a code.
Read the OTP message itself before you do anything
Most OTP messages say what the code is for and warn you not to share it. Read that line. If a code says it is for a new device login, a transfer or a WhatsApp registration you did not start, someone else started it. That is your warning, not a mistake.
The caller will often read your name, CNIC number or last transaction aloud to sound official. That proves nothing. Personal details leak in many ways, and in October 2026 the NCCIA was reported to have arrested a bank manager for selling NADRA Verisys records to fraudsters. A caller who knows your details and asks for a code is more dangerous, not less.
Real banks and wallets do not call from random mobile numbers
A genuine bank or wallet call will never ask for your OTP, PIN, CVV or password. Easypaisa publishes the only numbers it uses for outbound calls. JazzCash tells customers to report any suspicious call or message on its 4444 helpline. When in doubt, hang up and call the official helpline yourself.
| Service | Helpline to call yourself | What it says about codes |
|---|---|---|
| JazzCash | 4444 from Jazz, UAN 111-124-444, WhatsApp 0325-4444-786 | Never asks for PIN, OTP or password |
| Easypaisa | 3737 from Telenor, 021, 042 or 051-111-003-737 | Lists its only official outbound numbers |
| Your bank | The number on the back of your card | Call it, do not call back a number that called you |
| PTA | 0800-55055 | Report the scam number |
Easypaisa's contact page names numbers including 0347, 051-8166001, 042-3333-0347 and 0344-3737-111 as its only official outbound call lines. A call from any other number claiming to be Easypaisa is not from Easypaisa. Even a call from a real-looking number can be faked, which is why the steps to check a fake bank call with a spoofed number end with the same rule: hang up and dial the helpline yourself.
For every bank's number in one place, see our list of bank helpline numbers in Pakistan.
If you shared a code, make these calls in the first 30 minutes
Speed decides whether money can be held. Call the bank or wallet first and ask them to block the account and any transfer in progress. Then secure the account the code opened, then report. Do these steps even if no money has moved yet.
- Call your bank or wallet helpline and say the words "fraud" and "block". Ask for a complaint number.
- If the code was for WhatsApp, re-register WhatsApp on your phone with a fresh SMS code. That logs the other person out.
- Dial *#21# to check whether your calls are being forwarded, and cancel forwarding if it is on.
- Change your wallet PIN, bank app password and email password from your own phone.
- Complain to the NCCIA on 1799 or at complaint.nccia.gov.pk, with screenshots of the call log and messages.
- Report the scam number to PTA on 0800-55055.
Under State Bank of Pakistan rules, banks must act on fraud reports quickly, and the steps to claim a digital fraud refund from your bank or wallet explain what they must do and when. Keep the complaint number from your first call. Every later step asks for it.
Three settings make an OTP scam much harder
Turn on two-step verification on WhatsApp with an email address, lock your SIM with a PIN, and lower your daily transfer limit in your bank app. Each one means a single stolen code is no longer enough to empty an account or take your WhatsApp.
PKCERT calls WhatsApp two-step verification with a recovery email "critical". A SIM PIN stops a thief who has your phone from receiving your codes, and our steps to lock your SIM with a PIN take two minutes. A lower transfer limit caps the damage if a scammer does get through.
Do the same for older parents. Sit with them, turn these three on, and save the real helpline numbers in their contacts under clear names, so "Easypaisa" in their phone book is the real line and not whoever called last.
Common questions
Can anyone take money with just my OTP?
An OTP usually approves one action, such as a transfer or a new device login. Combined with details the scammer already has, that can be enough. Never share it.
Does JazzCash or Easypaisa ever ask for an OTP on a call?
No. JazzCash says it will never ask for your PIN, OTP or password, and Easypaisa lists the only numbers it calls from.
Someone asked for my WhatsApp code by mistake. What do I do?
Do not send it. Call the person on a normal call to check, because their account may already be hijacked.
Where do I report an OTP scam call in Pakistan?
Report the money loss to your bank or wallet and to the NCCIA on 1799. Report the caller's number to PTA on 0800-55055.
Can a bank get my money back after an OTP scam?
Sometimes, if you report fast and the money is still held. A refund is not guaranteed when the customer shared the code, so report within minutes, not days.
Is the code in my SMS valid after a few minutes?
Most OTPs expire within minutes, but the action they approve does not reverse when the code expires.
How we verified this
What we checked, where we read it, and what we could not confirm.
We read PKCERT's advisory on WhatsApp account hijacking, the JazzCash contact page and the Easypaisa contact page on 25 October 2026. NCCIA details come from our read of its site on 24 October 2026, and PTA's helpline and scam list from our earlier reads of pta.gov.pk, which refused our request today. We did not test any code ourselves. Whether a bank refunds a loss after a shared code depends on the bank's own findings, which we could not check.
About the author
Technology Journalist & Multimedia Producer
Ahmad Ali is a technology journalist and multimedia producer at Pakistan Era, joining the team in October 2026. He covers consumer technology and digital life for Pakistani readers, combining research with hands-on product testing.
