PTA Warns Citizens Against Digital Fraud as Scammers Exploit OTPs, CNIC Data

Pakistan’s telecom regulator is telling citizens something it has said before, but with fresh urgency: stop handing over your OTPs.

The Pakistan Telecommunication Authority issued a public advisory this week urging citizens to protect their personal data against digital fraud, specifically warning against sharing CNIC numbers, one-time passwords, and account passwords with unknown callers or through suspicious links.

The advisory itself breaks no new ground. PTA has run similar campaigns for years. What makes this one worth reading closely is the gap between the warning and the numbers now coming out of the National Assembly.

What PTA Is Actually Saying

The regulator’s message is direct: citizens should never share sensitive information such as their CNIC number, OTP, or passwords with any unrelated individual and should avoid clicking on unfamiliar or suspicious links sent via SMS or messaging apps.

PTA flagged a specific tactic: fraudsters posing as representatives of PTA itself, banks, or courier services to extract personal information from unsuspecting citizens. The authority instructs not to act on any unverified call or message, regardless of who the caller claims to be.

This mirrors a more detailed advisory PTA issued in January, which named the impersonation targets more specifically: government departments, banks, the National Cyber Crime Investigation Agency, and mobile wallet services including Easypaisa and JazzCash. Earlier, scammers were reported using a common pressure tactic, telling victims their SIM, bank account, or wallet was about to be blocked, then demanding OTPs, ATM PINs, or biometric details to “resolve” the fake problem.

The playbook hasn’t changed much between January and now. That consistency is itself a data point; it suggests these scripts keep working.

Where to Report

PTA has pointed citizens toward three reporting channels. Complaints can be filed at complaint.pta.gov.pk, through the PTA Digital Assistant on WhatsApp at 03150055055, or via the PTA Complaint Management System app. A toll-free number, 0800-55055, is also active for phone-based complaints.

The WhatsApp assistant, launched in February, runs on a menu-driven format rather than live agents, useful for routine queries like IMEI verification or SIM-blocking requests, though its speed with active fraud complaints is untested at scale.

The Numbers Behind the Warning

Advisories like this one land against a backdrop that makes the underlying problem hard to ignore. Data presented to the National Assembly this year showed the National Cyber Crime Investigation Agency received 150,542 cybercrime complaints in 2025, of which 81,996 were tied specifically to financial fraud. WhatsApp account hacking added another 2,974 cases.

The financial scale is larger than the complaint count suggests. Reported financial crime cases in 2025 involved roughly PKR 2.716 billion. Of that, only about PKR 452 million had been recovered by the time the figures were compiled, a recovery rate under 17 percent.

Enforcement hasn’t kept pace with reporting. Across 2023 to 2026, NCCIA logged over 523,000 cybercrime complaints but secured only 199 convictions, a conviction rate of roughly 0.04 percent. The agency itself has cited outdated investigative tools, staffing shortages, and jurisdictional hurdles when fraud operations cross borders.

Why This Keeps Happening

Two-factor authentication was designed to be a safeguard, not a weak point. But an OTP is only as strong as the person guarding it, and Pakistan’s fraud numbers suggest that gap is where scammers are concentrating their effort, impersonation over intrusion, deception over technical compromise.

That’s a cheaper attack than hacking a bank’s systems directly, and it scales. A single scripted call, repeated thousands of times, only needs to work on a fraction of targets to be profitable.

For PTA, repeating this advisory is close to the limit of what a telecom regulator can do unilaterally; it can warn, and it can route complaints to NCCIA, but prosecution and recovery sit outside its mandate. The conviction data suggests that’s where the system is actually struggling, not at the warning stage.

Citizens who receive suspicious calls or messages claiming to be from PTA, a bank, or a courier service have a narrow but clear playbook: don’t share OTPs, PINs, or CNIC details under any circumstance, and report the contact through PTA’s official channels rather than engaging further.