SBP names four bank scams doing the rounds: fake debit SMS, spoofed UANs

The State Bank of Pakistan has warned bank customers to stay alert to suspicious calls and messages about payments, and named the four scams currently in circulation. The warning came at the 24th Future Banking Summit and Expo in Karachi.

The common thread in all four is that they do not attack the bank. Banks have tightened their systems; the fraudsters have moved to attacking the customer directly, which needs no hacking at all, only a convincing script.

The four scripts

1. The fake debit alert. You get an SMS formatted to look exactly like your bank's alert, saying an amount has been debited from your account. You panic, call the number in the message, and hand your details to the person who sent it. The debit never happened.

2. The spoofed helpline call. Your phone shows your bank's real UAN. The caller knows your name and sometimes the last digits of your card. They ask you to confirm an OTP, a PIN or your card details to block a fraudulent transaction. Caller ID can be faked; the number on your screen proves nothing.

3. The mistaken transfer. Someone calls to say they accidentally sent money to your account and begs you to send it back. Either nothing was sent at all, or the money that arrived was stolen from a third party and you become the laundering step.

4. The prize or subsidy. You have won on Jeeto Pakistan, or your BISP payment is ready, and a small processing fee or your account details are needed to release it. Neither the show nor BISP works this way.

The three rules that defeat all four

Check the statement, not the SMS. Before you react to any claim about your money, open your bank app or check the balance at an ATM. If the debit is not in the statement, it did not happen.

Know where real alerts come from. Legitimate bank alerts arrive from official short SMS codes, not from a private mobile number. A bank alert from an 03xx number is a scam, every time.

Banks receive calls, they do not make them. Your bank's helpline takes calls; it does not ring you asking for credentials. Hang up and dial the number printed on the back of your card yourself. Never share a PIN, password, OTP or full card number with anyone, including someone who says they are from your bank.

If you have already given something away

Call your bank's helpline yourself, from the number on your card, and get the card and digital banking blocked. Then file a complaint with the National Cyber Crime Investigation Agency. Speed matters here more than paperwork: a transfer disputed within minutes can sometimes be held, and one disputed the next morning usually cannot.

Where the cash rules bite

Many of these scams end with the victim being walked to an ATM. Worth remembering that on cash withdrawals above the threshold, non-filers pay advance tax on top of whatever they lose. Our cash withdrawal tax calculator shows what the deduction looks like, and the currency converter carries today's rates if the story you are being told involves a foreign transfer.