The National Cyber Crime Investigation Agency (NCCIA) has issued a fresh warning to the public, asking Pakistanis to keep four pieces of personal information strictly private as online fraud and identity theft continue to spread across the country. The agency says careless sharing of these details with strangers or unverified online sources can quickly lead to financial loss and stolen identities.
In a public awareness advisory, the NCCIA named the four details that people must protect above all else. The first is the Computerised National Identity Card (CNIC) number, the second covers bank details and account information, the third is passwords, and the fourth is the One-Time Password, or OTP, that banks and digital services send to a mobile phone to confirm a transaction or a login. The agency said none of these should ever be shared with an unknown person.
The warning is aimed at a pattern the agency sees again and again. Fraudsters pose as bank officers, government officials or customer service agents, and they contact people by phone call, text message or social media. They often claim that an account has been blocked, a payment has failed, or a prize or cash reward is waiting to be claimed. In the rush to fix the supposed problem, people hand over the very details that give criminals direct access to their money and their identity. Once a fraudster has a CNIC number along with bank account details, the damage can go far beyond a single stolen payment, because the same information can be used to open accounts or obtain mobile connections in the victim’s name.
The NCCIA was particularly clear about passwords and OTPs. A password is the key to an account, and an OTP is the final check that only the genuine account holder can pass. The agency stressed that people should never share either of them with anyone, including callers who claim to represent a bank or another organisation. Genuine banks do not ask customers for their passwords or OTPs over the phone, and any caller who does so should be treated as a fraudster. The same caution applies to links sent by text or email. Citizens have been advised not to enter personal details on suspicious links or unverified platforms, and to share sensitive information only when necessary and only with a source they trust.
The advisory also reflects how much of everyday life in Pakistan now runs through a phone. Banking, bill payments, shopping and government services are increasingly handled online, and every transaction depends on the same handful of personal details. That convenience gives criminals a much larger surface to attack. A single careless reply to a message from an unknown number can be enough to hand over the keys to a bank account, and recovering stolen money is often a slow and uncertain process even when the crime is reported quickly.
The NCCIA itself is a relatively new institution, created to deal with exactly this kind of crime. It was established on 3 May 2024 under Section 51 of the Prevention of Electronic Crimes Act (PECA) 2016, replacing the Cybercrime Wing of the Federal Investigation Agency (FIA), and it became fully operational in April 2025. The agency holds nationwide jurisdiction to investigate digital offences, including financial fraud, identity theft, hacking, online harassment and cyber-enabled scams.
The scale of the problem the agency faces is large. According to official data obtained through a right to information request and reported by Dawn, the NCCIA received 94,552 complaints from across the country during the nine months from April to December 2025. That figure covers the full range of cybercrime, from financial fraud and impersonation to harassment and the misuse of personal data, and it shows how common these offences have become. Behind each complaint is a person who lost money or had their identity misused, which is why the agency keeps returning to the same simple message: prevention is far easier than recovery.
People who believe they have been targeted can report the matter to the agency through its online complaint portal at complaint.nccia.gov.pk, or by calling its toll-free helpline 1799. The agency advises victims to keep whatever evidence they have, including screenshots of messages, call records and transaction details, because that material can help investigators trace the fraud. Reporting quickly also matters, because banks and investigators have a better chance of freezing a fraudulent transaction in the hours immediately after it happens.
The wider lesson of the advisory is that digital safety now depends as much on everyday habits as it does on the law. Technology can block many attacks, but it cannot stop a person from willingly handing over their own password or OTP to a stranger who sounds authoritative on the phone. The NCCIA’s advice is deliberately simple, and it is meant to be followed every time: keep the CNIC number private, guard bank details, never share a password, and treat every OTP as a secret that belongs to the account holder alone. As more Pakistanis bank, shop and work online, those four habits may be the most effective protection most people have.
