Fake NADRA, FBR and BISP websites stealing logins: National CERT alert, how to spot one

Fake websites posing as NADRA, FBR, HEC, PTA, FIA, SECP and BISP are live and collecting people's logins and personal details, the National Cyber Security Emergency Response Team (National CERT) warned in an advisory after detecting them on Sunday 4 October 2026, Dawn reported. The suspected domains were still active when the advisory went out.

Which institutions are being copied

The National CERT's Threat Intelligence Centre found phishing domains imitating:

1. National Database and Registration Authority (NADRA)
2. Federal Board of Revenue (FBR)
3. Higher Education Commission (HEC)
4. Pakistan Telecommunication Authority (PTA)
5. Federal Investigation Agency (FIA)
6. Securities and Exchange Commission of Pakistan (SECP)
7. Benazir Income Support Programme (BISP)
8. Prime Minister's Youth Programme
9. Punjab Safe Cities

The fake sites copy the look of real government login pages so that visitors type in their passwords, CNIC numbers and other details, according to the advisory as reported by Dawn and PhoneWorld. The links reach people through email, messaging apps and social media.

How to tell a fake government website

• Check the address, not the logo. Federal government sites end in .gov.pk, such as nadra.gov.pk, fbr.gov.pk (tax returns are filed on iris.fbr.gov.pk), hec.gov.pk, pta.gov.pk, fia.gov.pk, secp.gov.pk and bisp.gov.pk. An address like "nadra-gov-pk.com" or "fbr.verify-online.xyz" is not the government, however real the page looks.
• Do not log in from a link in WhatsApp, SMS or email. Type the address yourself or use a bookmark.
• BISP never asks for a fee. The Benazir programme's eligibility check is the free 8171 SMS service and its official site. Anyone asking for money to "release" a payment is a scammer.
• The HEC does not take payment by phone. We reported on fake callers using the HEC name this week: HEC fake callers asking for money. The real process is in our HEC degree attestation guide.
• Look for spelling slips and pressure. "Your CNIC will be blocked today" or "claim your refund within one hour" are classic phishing lines.

If you already entered your details

1. Change the password on the real portal at once, and on any other account where you used the same password.
2. Check what is registered on your CNIC. A stolen CNIC can be used to issue SIMs; our guide shows how: check SIMs on your CNIC with 668.
3. Call your bank if you typed in card or account details, and ask them to block the card.
4. Report it to the National Cyber Crime Investigation Agency (NCCIA), which now handles cybercrime complaints that the FIA's cybercrime wing used to take.

The National CERT said it is still monitoring the campaign. It did not publish the list of fake domains.