Fake SMS & OTP Scams in Nepal: How People Are Losing Money

April 1, 2026 12 Min Read

Comments Off

Understanding the Impact of Fake SMS OTP Scams Nepal

The message arrives without warning. It looks exactly like one from your bank. It carries the same sender name you have seen a hundred times. It tells you your account has been flagged, or your eSewa wallet is about to be blocked, or there has been suspicious activity on your Khalti account. At the bottom, there is an OTP a one-time password and a number to call.

Thank you for reading this post, don't forget to subscribe!

One phone call later, the money is gone.

This is not a hypothetical. Across Nepal, from Kathmandu to Chitwan to Pokhara, ordinary people are losing real money to fake SMS and OTP scams every week. A teacher in Lalitpur lost Rs. 45,000 from her mobile wallet in under ten minutes. A shopkeeper in Butwal had his entire ConnectIPS balance wiped out after responding to what looked like a bank notification. A university student in Biratnagar handed over his OTP to someone who identified himself as an NTC customer support agent.

These are the people behind the statistics. And the statistics are getting worse.

If you use mobile banking, digital wallets, or any online account connected to a Nepali phone number and that is most of the country’s internet population this post is essential reading.

What Are Fake SMS and OTP Scams?

Before understanding how to stop them, you need to understand exactly how they work.

An OTP, or one-time password, is a temporary numerical code usually four to six digits sent to your registered phone number as a second layer of account verification. Banks, payment platforms, and online services use OTPs to confirm that the person trying to access an account actually has access to the registered phone number.

The logic is sound: even if an attacker steals your password, they should not be able to log in without also controlling your phone.

Fake SMS and OTP scams exist specifically to break that assumption.

In these attacks, the fraudster’s goal is simple: trick you into either handing over your OTP verbally or clicking a link that captures it automatically. Once they have your OTP combined with your account credentials, which they either already have or are harvesting at the same time they own your account.

The entire operation can take less than five minutes.

How These Scams Work: The Step-by-Step Breakdown

Understanding the attack flow is one of the most effective defenses available. Most victims, in hindsight, recognize the manipulation only after it has already succeeded.

Step 1: Target Selection and Credential Harvesting

The attacker begins by identifying targets. In many cases, they already have partial information your phone number, your name, and the bank or wallet platform you use. This data is frequently obtained from:

Previous data breaches where user records were exposed
Purchased lists sold on dark web marketplaces
Public social media profiles (your phone number visible on Facebook, for example)
Malicious apps installed on your device that harvest contact and account information

With this starting point, the attacker moves to the next phase.

Step 2: The Fake SMS

This is where the attack becomes convincing. The fraudster sends a crafted SMS that mimics official communications from a known institution Nepal Rastra Bank, NIC Asia Bank, Global IME Bank, eSewa, Khalti, or a telecom provider like NTC or Ncell.

Modern attackers use a technique called SMS spoofing, which allows them to make a message appear as if it came from a legitimate alphanumeric sender ID for example, “NIC-ASIA” or “eSewa-Alert” even though it was sent from a fraudulent system. The recipient sees the same sender name they have seen in genuine messages. On many phones, the fake message even appears in the same conversation thread as real messages from the institution.

The message typically contains one of several urgency triggers:

“Your account has been temporarily suspended due to suspicious activity.”
“Verify your eSewa wallet immediately or it will be blocked.”
“An unauthorized login was detected. Call us immediately.”
“Your Khalti KYC is expired. Update now to avoid account closure.”
“You have won a cashback reward. Call this number to claim.”

Each message is designed to override rational thinking by creating time pressure and fear. The call to action is always either to click a link or call a number.

Step 3: The Phone Call

When a victim calls the provided number, they reach the attacker or an accomplice who poses as a customer service representative. These individuals are often surprisingly professional. They have scripts. They know the right terminology. They use calm, authoritative voices.

The fraudster will ask for verification details: your name, account number, date of birth, or the last four digits of your card. This information, combined with what they already have, builds credibility. The victim, reassured by how “official” the representative sounds, drops their guard.

Then comes the critical moment: “Sir/madam, we are sending you a verification OTP. Please share it with me so I can verify your identity and resolve the issue.”

Here is what the victim does not realize: the attacker, at that exact moment, is using the victim’s credentials to trigger a real login or transaction on the real platform. The OTP the victim is receiving is the legitimate two-factor authentication code for that action. When they read it out, the attacker enters it and completes the transaction.

The call ends. The money is gone.

Step 4: The Fake Link Variant

Not all fake SMS scams involve a phone call. Many direct victims to a malicious URL a website designed to look exactly like the legitimate platform’s login page.

The victim enters their username and password on what they believe is the eSewa or Khalti portal. The attacker captures those credentials instantly. In some cases, the fake site also has a real-time OTP capture mechanism: it simultaneously uses the stolen credentials on the real site, triggers an OTP, and then shows the victim a fake “enter your OTP” screen. The victim enters the OTP on the fake site, the attacker intercepts it and enters it on the real site, completing the takeover.

This variant is faster and requires no phone interaction.

Real Scenarios: How It Plays Out in Nepal

The following scenarios are representative of attack patterns documented in Nepal. Details have been generalized to protect individuals involved.

Case 1 — The eSewa Wallet Drain: A user in Kathmandu received an SMS appearing to come from “eSewa-Alert” informing her that her wallet was flagged for suspicious outgoing transfers. She called the number in the message, spoke to a “support agent,” shared her OTP when asked, and within seconds, Rs. 38,000 was transferred out of her wallet. By the time she called the real eSewa support line, the transaction was complete and the money was gone.

Case 2 — The NTC Data Plan Scam: A user received an SMS claiming NTC was offering a 10GB bonus data package for loyal customers. The message included a link. He clicked it, entered his NTC account credentials to “claim the offer,” and unknowingly handed his credentials to an attacker. His account was subsequently used to make international calls, resulting in a Rs. 12,000 bill.

Case 3 — The Bank Account Takeover: A business owner received a call from someone identifying as a Global IME Bank fraud prevention officer. The caller referenced specific recent transactions information apparently sourced from earlier malware on the victim’s phone. He shared his OTP. His internet banking account was accessed and Rs. 75,000 transferred to an unknown account before he realized what had happened.

Why These Scams Are So Effective in Nepal

These attacks succeed not because victims are careless or unintelligent. They succeed because they are engineered to defeat normal human judgment. Several factors make Nepal a particularly effective environment for these scams.

Authority and urgency are a powerful combination. When a message appears to come from your bank and tells you your money is at risk, the instinct to act immediately overrides the instinct to verify. This is basic social engineering it works across every culture and education level.

SMS spoofing is technically easy and largely undetected. Many Nepali users do not know that sender names in SMS messages can be faked. They reasonably trust that a message appearing from “NIC-ASIA” came from NIC Asia Bank. That trust is the foundation of the entire attack.

Limited public awareness about OTP confidentiality. A significant portion of Nepali mobile banking users are first-generation digital banking users who received minimal onboarding about security. The concept that a genuine bank will never ask for your OTP over the phone is not universally understood.

Digital wallet growth has outpaced security education. Nepal added millions of mobile wallet users over the past four years. The platforms have grown, but user security education has not scaled at the same rate.

The SIM Swap Attack: A More Advanced Variant

Beyond fake SMS and OTP capture, a more sophisticated attack is also active in Nepal: SIM swapping.

In a SIM swap, the attacker contacts your telecom provider NTC or Ncell impersonating you and requesting that your phone number be transferred to a new SIM card they control. If they succeed, your number is immediately deactivated on your device and activated on theirs.

The impact is severe. Every OTP sent to your number now goes to the attacker. They can access your email (via OTP reset), your mobile banking, your digital wallets, and any other account tied to your number.

To successfully execute a SIM swap, attackers typically need to pass the telecom’s identity verification, which often only requires your name, approximate date of birth, and a recent call you made. This information is frequently available through social media or prior data breaches.

SIM swap indicators to watch for:

Your phone suddenly loses all signal (not due to network issues in the area)
You stop receiving calls and SMS messages unexpectedly
You receive a notification that your SIM has been changed
You are suddenly logged out of accounts

If this happens, call your telecom provider immediately from a different phone. Act within minutes not hours.

Protection Guide: What You Must Do Right Now

For Individual Users

Understand this single rule — it prevents most attacks: No legitimate bank, payment platform, telecom provider, or government agency will ever ask for your OTP over the phone, via SMS, or through any other channel. Your OTP is yours alone. The moment someone asks for it, the call is a scam. End it immediately.

Never click links in SMS messages. If you receive a message asking you to verify your account via a link, do not click it. Open your browser independently and navigate directly to the official URL. Bookmark legitimate sites so you always access the genuine version.

Enable SIM lock / port protection with your telecom. Contact NTC or Ncell and ask about available SIM lock features that prevent unauthorized SIM transfers. This adds a layer of protection against SIM swapping.

Use authenticator app-based 2FA where available. Some platforms now support authentication apps like Google Authenticator or Aegis instead of SMS OTP. These are significantly harder to intercept because they do not go through the phone network.

Check your accounts proactively. Do not wait for a suspicious message to check your balance. Enable transaction notifications so you are alerted the moment money moves in or out of your accounts.

Limit personal information on social media. Your phone number, date of birth, and home district are pieces of information attackers use for both social engineering and SIM swap requests. Restrict what is publicly visible on your Facebook profile.

Comparison Table: Legitimate vs. Fraudulent Communication

Indicator	Legitimate Institution	Scammer
Asks for your OTP	Never	Always
Creates urgency / panic	Rare	Always
Sends unsolicited links	Rarely / never	Frequently
Verifies your identity first	Yes	Pretends to
Matches official website/number	Yes	Spoofed to appear so
Asks to call a number in an SMS	No	Yes
Requests remote access to phone	Never	Sometimes

For Organizations and Platform Providers

Display persistent security reminders. Every login screen and transaction confirmation for eSewa, Khalti, ConnectIPS, and mobile banking apps should display: “We will never ask for your OTP.” Repetition builds awareness.

Implement SIM swap detection. Platforms should flag logins from a device that does not match the registered SIM and require additional verification when a number has recently been ported.

Report suspicious SMS senders to NTCA. Nepal Telecommunications Authority (NTCA) has mechanisms for reporting fraudulent SMS campaigns. Platforms and users should actively use them.

Pro Tips

Pro Tip 1: If you receive a suspicious call from someone claiming to be your bank, hang up. Then call your bank’s official number the one printed on the back of your debit card or listed on their official website and report the call. Never call back the number that contacted you.

Pro Tip 2: Set a daily transaction limit on your mobile banking and digital wallets that reflects your actual daily usage. A lower limit means that even if an attacker gains access, the damage they can do in a single session is capped.

Pro Tip 3: If you suspect you have been targeted by a SIM swap, immediately contact your bank and all digital wallet providers from a secondary contact number and request a temporary account freeze. Speed is critical.

What to Do If You Have Already Been Scammed

Being a victim of an OTP scam in Nepal does not mean the situation is hopeless, but fast action is critical.

Call your bank or wallet provider immediately and report unauthorized transactions. Request an emergency account freeze. Most platforms have 24-hour fraud lines.
File a complaint with Nepal Police Cyber Bureau at cybercrime.police.gov.np. Provide all details: the SMS you received, the phone number you called or that called you, the time of the incident, and the transaction amount.
Contact your telecom provider if you suspect SIM swapping was involved. Request a SIM lock and an account access log.
Change all account passwords from a clean, trusted device. Do not use the same device that may have been compromised.
Inform your contacts if your phone number was compromised, so that attackers cannot use your number to scam people in your network.

Recovery of funds is not guaranteed. Nepali financial regulations around fraud recovery are still developing, and speed of reporting is the most significant factor in whether a reversal is possible.

Conclusion

Fake SMS and OTP scams are not going away. They are scaling up more targets, more convincing messages, more sophisticated techniques. The attackers behind them are professional, organized, and have refined their methods to be remarkably effective against users who have received little to no security education.

The good news is that these attacks rely almost entirely on deception rather than technical complexity. They work because the victim hands over the OTP. Remove that one action and the attack fails. Understanding the mechanics the fake SMS, the spoofed sender, the scripted phone call, the artificial urgency is itself the most powerful protection available.

Share this post with someone who needs to read it. In Nepal’s digital ecosystem, awareness is not just personal protection. It is a community service.

Frequently Asked Questions (FAQ)

Yes. A technique called SMS spoofing allows attackers to send messages that appear to come from any alphanumeric sender ID, including names like “NIC-ASIA” or “eSewa-Alert.” The message may even appear in the same conversation thread as genuine messages. The sender name alone is not sufficient proof that a message is legitimate.

No. This is the most important rule in mobile banking security. No legitimate bank, digital wallet platform, telecom provider, or government agency in Nepal will ever ask you to share your OTP over the phone, via SMS, or through any messaging channel. An OTP is only to be entered into the official application or website nowhere else.

SIM swapping is an attack where the fraudster convinces your telecom provider (NTC or Ncell) to transfer your phone number to a SIM they control. Once successful, they receive all your SMS messages, including OTPs. To protect yourself, contact your telecom provider and request SIM port lock protection. Also minimize the amount of personal information available on your public social media profiles.

Act immediately. Contact your bank or wallet provider’s fraud line and request an emergency account freeze. File a complaint with Nepal Police Cyber Bureau at cybercrime.police.gov.np. Change your account password from a trusted, clean device. Time is the critical factor the faster you report, the higher the chance of limiting the damage.

Do not click it. Instead, open your browser independently and manually type the official website address of the institution. If you are unsure of the official URL, call the institution’s publicly listed customer service number not any number provided in the suspicious message. Legitimate institutions do not require you to follow SMS links to resolve account issues.

Both. Individual users are the most frequent targets due to scale, but businesses particularly small businesses using mobile wallets for transactions are also targeted. Business accounts often hold higher balances, making them attractive to attackers who conduct more research and use more sophisticated methods, including supply chain phishing and insider-assisted fraud.