PTA warns of courier OTP scam: never read out the code, what to do if you already did

The Pakistan Telecommunication Authority (PTA) has warned mobile users about a courier OTP scam: a caller says he is from a courier company, tells you a parcel is waiting, and asks for the code that has just arrived by SMS "to complete the delivery". That code is a one-time password (OTP) for your WhatsApp, bank app or wallet, and giving it away hands the account to the caller, the PTA said on Friday, as first reported by ARY News.

How the courier OTP scam works

1. You get a call or a WhatsApp message from someone using the name of a courier company, often with a parcel number that looks real.
2. He says the rider cannot deliver until you "confirm" with a code.
3. At the same moment, an SMS with a six-digit code lands on your phone. The scammer has triggered it by trying to log in to your WhatsApp, JazzCash, Easypaisa or bank account with your number.
4. If you read the code out, he is in. A hijacked WhatsApp is then used to ask your contacts for money; a wallet or bank app is emptied.

The PTA's advice is short: never share an OTP with anyone who calls you, whoever they say they are. No courier needs a code to hand over a parcel. Callers who create urgency ("the rider is leaving in five minutes") are the warning sign.

This is not new. The PTA issued a similar advisory about fake courier texts in 2025, and the State Bank flagged spoofed helpline calls and fake debit SMS last month (SBP's four bank scams). The repeat warning suggests the trick is still working.

What to do if you are called

• Hang up and check the parcel yourself: open the courier's own app or website and enter the tracking number from your order, or call the number printed on the courier's website.
• Do not open links in the SMS or WhatsApp message.
• Turn on two-step verification in WhatsApp (Settings, Account, Two-step verification) so a stolen OTP alone cannot move your account to another phone.

If you already shared the code

1. Bank or wallet: call your bank or wallet helpline at once from the number on the back of your card or in the official app, and ask them to block the account and any pending transfers.
2. WhatsApp: reinstall WhatsApp and log in with your number; the new OTP logs the scammer out. Then warn your contacts.
3. Report it: a fraud complaint goes to the National Cyber Crime Investigation Agency (NCCIA). Problems with your mobile operator, such as a SIM issued without your consent, go to the operator first and then to the PTA's Complaint Management System or its free helpline 0800-55055: our guide on how to file a PTA complaint has every step.
4. Check your SIMs: make sure no extra number has been issued on your CNIC. Our guide on how to check SIMs registered on your CNIC shows how with SMS 668.