Recognize the psychological traps scammers use to steal your OTPs, wallet pins, and lifetime savings.
OTP (One-Time Password) scams and phishing attacks are social engineering techniques where cybercriminals manipulate victims into revealing their secret dynamic authentication codes, transaction MPINs, or banking passwords to illegally drain funds from their bank accounts and digital wallets.
Digital financial crime in Nepal has exploded alongside mobile banking adoption. Victims lose their entire life savings - often hundreds of thousands of rupees - in less than 3 minutes simply because they believed a caller claiming to be a "Bank Customer Support Representative" updating their KYC. Banks cannot reverse transactions authorized with a valid OTP, making prevention your only real protection.
You receive an urgent call on WhatsApp/IMO or an SMS claiming: "Your bank account will be frozen within 2 hours unless you update your KYC" or "Congratulations! You won NPR 25 Lakh in the Dashain lottery."
The scammer creates intense urgency, forbidding you from disconnecting the call or consulting family members, pretending to assist you with system verification.
Behind the scenes, the scammer enters your mobile number on a banking app or connectIPS portal, causing the genuine bank server to dispatch an OTP to your phone.
The scammer asks: "Read me the 6-digit verification code you just received to verify your identity." The moment you disclose it, your account is emptied.
| Scam Type | Typical Scammer Script / Hook | Underlying Trap | Immediate Defensive Action |
|---|---|---|---|
| Fake Bank KYC Update | "Your bank account is blocked. Click this link to update citizenship KYC." | Phishing website steals login credentials & OTP | Never click SMS links. Open official banking app directly. |
| WhatsApp/IMO Lottery | "You won NPR 25,00,000 from KBC/Dashain. Send NPR 15,000 tax first." | Advance fee fraud; prize does not exist | Block number immediately; report to Nepal Police Cyber Bureau. |
| Facebook Impersonation | "Urgent hospital emergency! Please transfer NPR 20,000 to this eSewa number." | Hacked or cloned friend profile | Call your friend directly on mobile phone to verify identity. |
| Fake Merchant Payment | "I sent you money via QR, enter your MPIN to accept the incoming payment." | Entering MPIN authorizes a DEBIT, not credit | Remember: Receiving money NEVER requires entering your MPIN/OTP! |
According to Nepal Police Cyber Bureau statistics, over 80% of reported cyber financial crimes involve social engineering and voluntary disclosure of OTPs rather than technical database hacking. Fraudsters frequently target migrant worker families in rural districts via IMO and WhatsApp, exploiting unfamiliarity with digital banking interfaces. Nepal Rastra Bank directives mandate that all banks issue clear SMS alerts stating: "Do NOT share this OTP with anyone, including bank staff."
Laxmi received a call on WhatsApp displaying the official logo of her commercial bank. The polite caller said: "Madam, your ATM card expires today. To keep it active, read me the 6-digit code just sent to your phone."
Laxmi remembered RisePaisa's rule: "Banks never ask for OTP." She replied: "I will visit my branch in person" and hung up. When she checked the SMS, it was a connectIPS password reset authorization for NPR 1,20,000. Her vigilance saved her family's entire savings.
Goal & Dilemma: Responding to a threatening phone call claiming her bank account is frozen for incomplete KYC.
Your digital signature that unlocks funds leaving your account.
Receiving money NEVER requires your secret pin or code.
If someone says: "Enter your 4-digit MPIN to receive NPR 10,000 in your wallet," it is mathematically 100% a scam. Receiving funds requires only your mobile number or account number - never your PIN!
Believing that caller ID or WhatsApp profile pictures prove a caller is genuine.
Know that scammers easily download bank logos and use VoIP spoofing to mimic bank phone numbers.
Sharing OTPs with callers who claim to be "preventing fraud" on your account.
Hang up immediately. No legitimate bank employee can or will ask for your OTP.
Clicking shortened URLs (e.g. bit.ly, tinyurl) received via SMS for banking updates.
Never click links in SMS messages; navigate directly to official bank websites or verified apps.
Once an OTP is entered, the transaction is processed instantly on real-time rails. Reversing it requires freezing the scammer's destination account through Nepal Police Cyber Bureau, which is only possible if reported immediately before the scammer withdraws the cash.
Scammers obtain basic personal details from public voter lists, leaked resume databases, social media profiles, or discarded bank deposit slips.
Call your bank's 24/7 card/digital helpline immediately and shout: "Block my mobile banking and freeze all debit transactions right now!" Change your passwords immediately.
NEVER. No genuine bank, payment gateway, police officer, or Nepal Rastra Bank official will ever ask for your OTP, password, or PIN. Anyone asking for an OTP is 100% a fraudster.
Call your bank's 24/7 card and digital banking helpline IMMEDIATELY to block your mobile banking app, freeze your debit cards, and request a temporary hold on all account debits.