How Are eSewa and Digital Wallet Users Getting Hacked? The Real Tricks Scammers Use in Nepal
Even public figures aren’t safe from Nepal’s growing wave of digital payment scams. CPN-UML lawmaker Yashoda Kumari Baral recently shared that Rs 21,900 was withdrawn from her eSewa account after she clicked on an unknown link. If a sitting Member of Parliament can lose money this way, it’s a fair question for the rest of us: how exactly does this happen and how easily could it happen to you?
Thank you for reading this post, don't forget to subscribe!This article breaks down, in plain language, the actual techniques scammers use to drain digital wallet accounts in Nepal, so you can recognize the warning signs before it’s too late.
Why This Story Matters
Nepal’s digital payment ecosystem eSewa, Khalti, IME Pay, ConnectIPS, and mobile banking has grown explosively over the last few years. That convenience comes with a downside: your entire wallet balance can now be accessed remotely, in seconds, by anyone who tricks you into handing over the right piece of information. Unlike a stolen wallet or purse, you often don’t even realize it’s happened until you check your balance.
Baral’s case fits a very common and well-documented pattern of attack called phishing and understanding how it works is the single best way to protect yourself.
How “Clicking a Link” Actually Leads to Money Being Stolen
It can feel almost magical (in a bad way) that clicking a link can lead to money vanishing from an account. In reality, it happens through a fairly predictable chain of steps. Here’s what typically goes on behind the scenes:
1. The Bait: A Convincing Fake Message
Scammers send a message via SMS, Facebook, WhatsApp, Viber, or email designed to look like it’s from eSewa, a bank, a delivery service, a “prize draw,” or even a government office. Common bait includes:
- “You’ve won a cash prize / lucky draw claim it now”
- “Your KYC is incomplete, verify immediately or your account will be blocked”
- “Unusual login detected confirm your identity”
- Fake job offers, loan offers, or “refund” notifications
The goal of the message is simple: create urgency or excitement so you act before you think.
2. The Trap: A Fake Login Page
The link doesn’t take you to the real eSewa website. It takes you to a lookalike page a website designed to look nearly identical to eSewa’s login or verification screen, often with a URL that’s just slightly different from the real one (an extra letter, a different domain ending, or a subdomain trick).
When the victim enters their eSewa ID, password, MPIN, or OTP on this fake page, that information is sent directly to the scammer not to eSewa.
3. The Theft: Instant Account Takeover
With valid login credentials and, critically, a one-time password (OTP) captured at the right moment, the attacker can log into the real eSewa account and initiate a transfer or withdrawal before the victim even realizes what happened. This is why OTPs matter so much they’re the last line of defense, and phishing pages are specifically designed to capture them in real time.
Other Common Techniques Beyond Basic Phishing
Baral’s case appears to match the classic phishing pattern above, but it’s worth knowing the other ways digital wallet accounts get compromised in Nepal:
- Fake customer care numbers: Scammers post fake “eSewa helpline” numbers on social media or Google listings. Victims call them for help and are talked into sharing their OTP or MPIN “for verification.”
- SIM swap fraud: Attackers convince or bribe a telecom retailer to issue a duplicate SIM card for the victim’s number, letting them intercept OTP messages directly.
- Malicious apps: Fake “eSewa cashback” or “loan” apps distributed outside the official app store can secretly read SMS messages, capturing OTPs as they arrive.
- Social engineering calls: A caller impersonates a bank or eSewa employee, claims there’s a “security issue,” and walks the victim through steps that end with them revealing their MPIN or approving a transaction themselves.
- Credential reuse: If someone uses the same password for their email and their eSewa account, and that password was exposed in an unrelated data breach, attackers can try it directly on payment platforms.
Why Even Careful People Fall for This
It’s easy to assume “I would never fall for that,” but these scams work because they’re engineered to exploit normal human reactions:
- Urgency short-circuits careful thinking (“act now or lose access”)
- Authority makes people comply without question (a message appearing to be from a bank, police, or government office)
- Familiarity the fake page looks and feels exactly like the real one
- Distraction most people check messages quickly, on a small phone screen, while doing something else
Public figures and busy professionals are, if anything, more vulnerable they receive a high volume of messages daily and have less time to scrutinize each one.
How to Protect Your eSewa, Khalti, or Bank Wallet Account
- Never click payment or “verify your account” links sent via SMS, social media, or email. Always open the official app or type the website address manually instead.
- Never share your OTP or MPIN with anyone not even someone claiming to be eSewa/Khalti staff. Legitimate companies never ask for this over a call or message.
- Check the URL carefully before entering login details. Look for the correct domain name and HTTPS padlock but remember even this can be faked, so when in doubt, don’t log in via a link at all.
- Enable transaction alerts and set daily limits on your wallet so unusual activity is capped and flagged immediately.
- Use a strong, unique password for your wallet account never reuse a password from another site or app.
- Verify unknown “customer care” numbers only through the official app or website, never through a number found via a social media post or search ad.
- Report immediately if you suspect fraud contact eSewa/Khalti support directly through their verified app or official number and file a complaint with the Cyber Bureau of Nepal Police as soon as possible.
The Bigger Picture
Baral’s experience is a reminder that digital payment fraud in Nepal isn’t rare or isolated it’s a systematic, high-volume criminal activity that doesn’t discriminate by profession or status. As adoption of digital wallets keeps growing across the country, so will the volume and sophistication of scams targeting them.
The good news: nearly every one of these attacks depends on the victim taking one specific action clicking a bad link, sharing an OTP, or answering a suspicious call the “right” way. Breaking that single link in the chain is usually enough to stop the theft before it starts.
Stay skeptical of urgency. Verify independently. Never share your OTP. That’s 90% of the defense right there.
FAQs
No a phone number alone isn’t enough. They also need your password/MPIN or your OTP, which is why phishing links and fake “verification” calls exist: to trick you into handing those over.
In most cases, yes, simply opening a link doesn’t compromise your account unless you entered login credentials or the site prompted you to install something. Still, it’s wise to change your password as a precaution and avoid clicking similar links in the future.
Change your password immediately from a trusted device, contact eSewa support through their official app or verified number, and report the incident to the Cyber Bureau of Nepal Police.
Note: This article is based on public statements regarding lawmaker Yashoda Kumari Baral’s reported incident, combined with general, well-documented digital payment fraud patterns seen across Nepal.
