NCERT Issues Urgent Warning on Phishing Scams in Pakistan

The National Cyber Emergency Response Team (NCERT) has issued a clear warning regarding phishing attacks through SMS, WhatsApp and phone calls are increasing across Pakistan. In recent weeks the team says fraudsters have stepped up efforts to trick people with fake prizes, counterfeit bank alerts and bogus account-verification calls, all designed to steal passwords, CNIC numbers and one-time passwords (OTPs).

NCERT urges the public not to click unknown links, respond to suspicious messages or calls, and never share bank details, CNICs or OTPs with anyone, even if the message looks official. NCERT emphasises that no legitimate organisation will ever ask for your password or verification code by phone or SMS.

What’s happening, the details

The scammers are professionalising their approach. They hide malicious links behind short messages that promise lottery winnings, refunds or urgent bank alerts. Others use spoofed phone numbers and fake caller IDs to pose as bank officers, government staff or delivery agents. WhatsApp messages carrying doctored screenshots of bank portals are used to lure victims into entering login details on fraudulent websites.

NCERT’s advisory lists the most common tricks:

• Messages claiming you’ve won a prize or lottery and must click a link to claim it.

• Fake “bank alerts” warning of unauthorised transactions and urging you to confirm by entering details on a provided link.

• Calls from numbers that appear local but that actually route to fraudsters who ask for OTPs “to verify your identity”.

• Malicious links sent through group chats that exploit the trust of friends and family circles.

An NCERT spokesperson told reporters:

Fraudsters are using increasingly believable stories to get people to act quickly without thinking. The goal is the same: get credentials, drain accounts, or sell personal data to hostile actors. Awareness and a few simple habits can block most of these attacks.

How to protect yourself: practical, everyday steps

NCERT’s message is practical and precise. Below are the steps every user should take right now:

1. Don’t click unknown links. If a message looks out of the blue, even from a friend, treat links with suspicion.

2. Never share OTPs, passwords or CNICs. No legitimate agency will ask for them via phone or SMS.

3. Use two-factor authentication. Enable 2FA on email, banking and social accounts to add a second line of defence.

4. Verify via official channels. If you get a bank alert, call your bank on the number printed on your card or official website, not the number in the message.

5. Block and report suspicious numbers. Many telecom providers and messaging apps let you report fraud directly. Use those tools.

6. Change passwords and notify institutions immediately if you clicked a suspicious link or entered credentials.

7. Avoid logging into sites from unverified links. Type the official URL yourself or use bookmarks.

If you suspect a breach, NCERT advises changing passwords straightaway and contacting the relevant institution, your bank or mobile provider, to freeze accounts or block transactions.

Why this matters, wider impact and what comes next

Phishing is not just an individual crime; it’s a national problem with economic and social consequences. Stolen credentials can be used for financial theft, identity fraud, and even to target critical infrastructure or sensitive institutions. When citizens’ personal data is harvested at scale, it undermines trust in digital services and slows the country’s move toward online convenience.

Scammers rely on urgency and fear; they want you to act before you think. Take a breath. Check the sender. Call the official number. Ask someone you trust to look at the message. These small pauses make a big difference.

ALSO READ: Fake Online Jobs on LinkedIn and Other Job Portals are Stealing Sensitive Data, PTA Warns