Protect Your Elderly Parents From Phone Scams in Pakistan: 5 Checks for OTP, PIN and Fingerprint Fraud

Short answer: Tell your parents one rule: no caller, bank or "official" ever needs your OTP, PIN or CNIC number on the phone. If a caller asks, hang up and call the number on the back of the bank card. PKCERT, Pakistan's national cyber emergency team, lists five scam types that target older people, and this page turns them into five checks you can do together in one evening.

A father in Multan gets a call at 11 am. The caller sounds polite and says his account will close in an hour. He asks for the six digit code that just arrived by SMS. Many people hand it over, because the voice sounds sure and the clock sounds urgent.

We read PKCERT's "Guarding Elderly Citizens Against Cyber Threats" infographic on its ABC (Awareness Brings Change) Program page on 12 October 2026. Everything attributed to PKCERT below comes from that page. The checks and the examples are our own plain-language reading of it.

Callers who ask for an OTP or PIN are always a scam

PKCERT says legitimate organisations never ask you to share an OTP or account details over a phone call. It also says never share a one-time password received by text or email with anyone, whatever reason is given.

An OTP (one-time password) is the short code a bank or wallet sends to confirm a payment or a login. Whoever has the code can move the money. That is why the scammer wants it, and why the caller always sounds in a hurry.

PKCERT adds a warning about fake prizes and lottery wins. These are often used to make the person read out a code. If a stranger says you won something, there is nothing to claim and nothing to read out.

The same rule covers parcels. A fake courier call can ask for a code "to release your parcel", as we explain in the check on fake courier calls that ask for a code.

PINs stay with the owner, even inside the family

PKCERT's advice on PINs is strict: treat your personal identification numbers with the utmost confidentiality and never share them with anyone, including family members or service providers. Do not write a PIN down or store it where others can find it.

This is hard for many families, because a son or a neighbour often takes the card to the ATM. The safer plan is to give your parent a bank app or wallet account of their own, with their own PIN, and to set small daily limits.

If a PIN may be known to someone else, PKCERT says to tell the bank and change it at once. Do that before anything goes wrong. The numbers for each bank are in the list of bank helpline numbers we checked.

Free fingerprint offers and fingerprint photos are a risk

PKCERT warns about biometric fingerprint scams. It says to be cautious of anyone offering free biometric scans or services, because they may be trying to steal personal information. If in doubt, ask a trusted family member first.

It also gives a small tip for photos: when taking selfies and photographs, remember that finger pores are not part of the picture, as scammers can take advantage of it. In plain words, do not post close-up photos of fingers and palms.

Fingerprints matter in Pakistan because SIMs and bank accounts are tied to them. A stranger who asks for a thumb scan "for a prize" or "to update your SIM" is not working for NADRA or the bank. The steps to see which SIMs sit on a CNIC are in our check on SIMs registered on your CNIC.

Links and emails need a second person to look at them

PKCERT tells older users to be careful with links and attachments in emails, especially when the message seems urgent or too good to be true. Red flags are spelling mistakes, bad grammar and a generic greeting from a famous name.

The fix is a simple habit. Before a parent clicks anything, they check the sender through an official channel, such as the number printed on the card. For a message that claims to be from a government body, the case is explained in the check on fake PTA, NCCIA or bank calls.

Wallet and bank apps are safer than links in messages. Ask your parent to open the app themselves and look for the notice there.

Do these five checks together this week

Sit down with your parent and a phone. It takes about thirty minutes. Do each check once, then repeat it every few months.

1. Write the bank helpline number on a card and keep it next to the phone.
2. Set a low daily limit in the bank app or wallet, so a mistake cannot empty the account.
3. Switch on SMS or app alerts for every transaction, and read the statement each week.
4. Agree a family rule: any call that asks for a code, PIN or CNIC gets a "let me call you back" and a message to you.
5. Turn on a SIM lock PIN, which stops a stolen phone from receiving codes. The steps are in the guide to locking your SIM with a PIN.

PKCERT also says to review bank statements regularly for suspicious activity. A weekly look together is the easiest way to keep that going.

If money has already gone, move fast and in this order

Call the bank or wallet first, because only they can hold a transfer. Then report the fraud, and block the number. Speed matters more than anything else in these cases.

1. Call the bank or wallet helpline and ask them to hold the transfer and block the card or app.
2. Change the PIN and the app password from a safe phone.
3. Tell your family. Do not hide it, because the same caller often tries again.
4. Report the number to PTA on 0800-55055. That is the helpline we read on PTA's own site on 12 October 2026.
5. File a cybercrime complaint. PKCERT's own incident form says fraud against individuals goes to NCCIA, and the steps are in the guide to reporting a cybercrime.

Refund rules differ between banks and wallets. The State Bank's liability framework is explained in the page on claiming a digital fraud refund.

Common questions

Does a bank ever ask for my OTP on the phone?

No. PKCERT says legitimate organisations will never ask you to share your OTP or account details over a phone call. If someone asks, end the call.

Can I give my PIN to my son to withdraw cash?

PKCERT advises against sharing a PIN with anyone, including family members. A separate account or app with its own PIN and a small limit is safer.

Is a free biometric scan offer real?

Treat it as a risk. PKCERT warns that people offering free biometric scans may be trying to steal personal information. Check with a trusted family member first.

What should my parent do if a stranger says they won a prize?

Do nothing and share nothing. PKCERT lists fake prizes and lottery wins as common tricks to get an OTP or personal details.

Who do I call if my parent is already scammed?

Call the bank or wallet first so they can hold the money. Then report the number to PTA on 0800-55055 and file a cybercrime complaint with NCCIA.

How we verified this

What we checked, where we read it, and what we could not confirm.

Last checked on 12 October 2026, Pakistan time. We read PKCERT's Protection for the Elderly page and its infographic, and PKCERT's incident reporting page. We read the PTA helpline 0800-55055 on PTA's website. NCCIA's websites refused automated requests on this check, so we did not read them. We did not test any helpline by calling it.