Pakistan

Scammers reach people by a phone call that pretends to be the bank, by a swap of the SIM card in their phone, by the theft of their identity details, and by accounts opened in a false name. The State Bank of Pakistan, the central bank, named those tricks in May 2023, together with social engineering, in which a person is talked into parting with money or a code, and it said the scammers were taking advantage of customers who do not know the tricks.

In 2025 the National Cyber Crime Investigation Agency, the national body for scam cases, received 81,996 complaints of financial fraud and 2,974 complaints of WhatsApp hacking, inside 150,542 complaints in all. The central bank's note of September 2025 says branchless mobile wallets are more likely to be used in these scams because the identity check on them is simpler than on an ordinary bank account. Money sent to such a wallet arrives at once, and the spending of it waits two hours so the sender can tell the bank.

The interior minister told the Assembly in January 2026 that deepfake and voice cloning scams are moving quickly, and that the ministry's safety teaching is aimed at people in rural areas, women, older people, communities with less schooling, and places with weaker connections. His August 2026 reply says scam investigations are slowed by encryption, by footprints that hide who is behind an account, by platforms hosted abroad, and by the difficulty of pursuing a scam across a border.

The scam payment is usually one the person is talked into making, or one that leaves an account a scammer has taken over. In May 2023 the central bank named social engineering (talking a person into handing over money or a code), calls that fake a bank helpline, SIM swaps, identity theft and accounts opened on false details.

Branchless mobile wallets are a likely place for scam money to land, because the identity check is simpler. A rule in place since April 2023 stops that wallet being cashed out, used for a purchase or used for a phone top-up for two hours after the money arrives, while the transfer itself is instant. In September 2025 the central bank said the wait had worked smoothly and had proved a strong check on scams, because it gives the sender time to tell the bank. A trusted customer of the receiving bank can be allowed to spend sooner.

Banks register the phone a customer uses, wait two hours before a new banking app works or before a change of number, email, limit or password takes effect, and tie a new channel, a new phone or a change of email or number to a biometric check. A call to block a card or a digital channel is answered within one minute, and staff are not to ask the customer to read a one-time code aloud. The sending bank raises a dispute on a shared system within 30 minutes of the report, and the bank that received the money blocks withdrawal within 30 minutes. Alerts of a new phone, a password reset or a failed login go out free, in Urdu or English.

Pakistan's official loss figure comes from the cases investigators register. The National Cyber Crime Investigation Agency received 150,542 complaints in 2025, 81,996 of them about financial fraud. After scrutiny it opened 10,756 financial crime inquiries and registered 851 cases, with Rs 2,716.386 million involved, about Rs 3.2 million a case, and 1,095 accused were arrested, the interior minister told the National Assembly on 16 January 2026. Most fraud complaints therefore never become a registered case with a loss attached.

Later replies to the Assembly put complaints for all cybercrime at 157,465 in 2025, after 161,828 in 2024 and 134,710 in 2023, with 2,356 cases registered in 2025 against 1,667 the year before.

The central bank names the methods behind the larger losses: calls that fake a bank helpline, SIM swaps, identity theft and accounts opened on false details.

Bank refunds in Pakistan follow the central bank's liability rules of April 2023, which cover a payment a scammer talked the customer into making. The sending bank must raise a dispute within 30 minutes of the report and the receiving bank must block withdrawal within 30 minutes. A bank that misses its deadline, that cannot show the payment came from the customer's registered phone, or whose required control was missing pays the customer in full. Receiving banks that miss the deadline share the loss, and a bank that opened an account on false details without the required checks pays. Banks must also offer insurance against these scams, if the customer asks for it.

The money returned that is published is what investigators recover from scammers. In the 851 financial crime cases of 2025, the National Cyber Crime Investigation Agency had recovered Rs 452.376 million by 16 January 2026, with investigation still going, the interior minister told the National Assembly. Across all cybercrime the agency recovered Rs 554.5 million in 2025, after Rs 652.6 million in 2024, and Rs 1,418.48 million in 2026 by its August reply.

People report scams to the National Cyber Crime Investigation Agency, the national body for these scams, through its public reporting portal and a national helpline. In the count published with the money, the agency received 150,542 complaints in 2025. Of those, 81,996 were financial fraud and 2,974 were WhatsApp hacking. From the 81,996 it opened 10,756 inquiries and registered 851 cases, so about 1 percent became a registered scam case. A later reply, on 20 August 2026, put all cybercrime complaints in 2025 at 157,465, of which 141,681 had been verified, with 30,214 inquiries and 2,356 cases. The ministry's figures show 134,710 complaints and 1,375 cases in 2023, and 161,828 complaints and 1,667 cases in 2024: complaints eased slightly in 2025 after the rise in 2024, while scam cases kept rising.

Banks take the payment side of a scam report. Under the rules of the State Bank of Pakistan, the central bank, from April 2023, a customer's report is entered on a dispute system shared by the banks within 30 minutes, and the bank holding the money blocks its withdrawal within 30 minutes.

The interior minister's reply of 16 January 2026 names the portal and the helpline as the channels added so that people in rural areas, women, older people and places with fewer services can reach the agency. On 18 May 2026 the minister had put the 2025 case total at 2,256; the August reply of the same series stands at 2,356.

The figure shown here is the 851 financial crime cases the National Cyber Crime Investigation Agency, the body for these scams, registered in 2025, with Rs 2,716.386 million involved. It counts scam cases registered after an inquiry, not every complaint: the same reply, on 16 January 2026, says that of 150,542 complaints that year, 81,996 were financial fraud, 10,756 inquiries were opened, and 1,095 people were arrested in the 851 cases. The wider cybercrime series, restated on 20 August 2026, shows 2,356 cases in 2025, 2,916 people arrested and 39 convictions, after 1,667 cases, 2,157 arrests and 60 convictions in 2024, and 1,375 cases, 2,007 arrests and 92 convictions in 2023. The reply of 18 May 2026 adds 168 acquittals in 2025, after 268 in 2024 and 416 in 2023, so in each of those years acquittals outnumbered convictions.

Scam cases are brought under the Prevention of Electronic Crimes Act, 2016. Electronic fraud, deceiving a person or misusing a system for a wrongful gain, carries up to two years or a fine of up to Rs 10 million in the Assembly's text of that law. The amendment gazetted on 29 January 2025 makes the agency's officers police officers for the inquiry, transfers cases from the Federal Investigation Agency wing to it, and adds an offence of spreading false or fake information likely to cause fear or unrest, with up to three years or a fine of up to Rs 2 million. The minister's August 2026 reply names misuse of someone's identity, spoofing and cyberstalking.

Scams that take money are the largest named part of what people report. In the interior minister's reply of 16 January 2026, 81,996 of the 150,542 complaints received in 2025 were financial fraud, just over half, and 2,974 were WhatsApp hacking. Those complaints led to 10,756 inquiries and 851 registered scam cases, with Rs 2,716.386 million involved.

The State Bank of Pakistan, the central bank, describes how scammers take the money. In social engineering the person is talked into the payment. Other scams start with a call that fakes a bank helpline, a SIM card swapped so the codes go to someone else, identity details that have been stolen, or an account opened on false papers. The legal offence of electronic fraud, in the Assembly's text of the 2016 Act, is using a system or deceiving a person for a wrongful gain, and it carries up to two years or a fine of up to Rs 10 million. Branchless mobile wallets are more likely to receive the money because they are easier to open. Since April 2023 the wallet cannot be cashed out for two hours, which is the pause in which the sender can tell the bank.

WhatsApp hacking is the other category the minister named for 2025, 2,974 complaints of a messaging account a scammer has taken over. Besides those, the minister told the Assembly that deepfake and voice cloning scams are moving quickly, which is why a first national artificial intelligence policy was still being finished in January 2026.

Banks and one national agency share the work against scams, and the tables show cases rising while convictions fall. The 2025 amendment puts investigation and prosecution in the National Cyber Crime Investigation Agency, the body for these scams, gives its officers police powers, and folds in the Federal Investigation Agency's wing and its cases.

Banks had to meet the central bank's rules by the end of 2023: a shared dispute system, 30 minutes to lodge a dispute and 30 minutes to freeze the receiving account, a two hour bar on spending money just paid into a mobile wallet, and a duty on the bank that misses the clock or the control to pay the customer in full. In September 2025 the central bank said that wallet bar had proved a strong check on scams.

All cybercrime cases rose from 1,375 in 2023 to 1,667 in 2024 and 2,356 in 2025, and arrests from 2,007 to 2,916, while convictions fell from 92 to 60 to 39. Acquittals still outnumbered convictions each year. Of the Rs 2,716.386 million involved in the financial crime cases, Rs 452.376 million had been recovered by January 2026. Recovery on the wider count was Rs 554.5 million in 2025, down from Rs 652.6 million in 2024.

The interior ministry says the cases are still hard because of encryption, hidden accounts, platforms hosted abroad, and a scam that crosses a border. Deepfake and voice cloning scams are moving faster than the response, and a first national artificial intelligence policy was still being written in January 2026.