Banking and Financial Scams

Financial institutions are among the most impersonated entities in Nepali phishing attacks. Scammers create convincing copies of bank websites and communications to steal credentials.

• Fake emails claiming to be from Nepal Rastra Bank, NIC Asia, Global IME, or other major banks
• SMS messages warning about “account suspension” or “unusual activity”
• Requests to “verify” account details through fraudulent websites
• Calls from scammers posing as bank representatives requesting OTP codes

Government Service Impersonation

Scammers exploit trust in government institutions by impersonating agencies like Nepal Telecom, Nepal Electricity Authority, or the Department of Immigration.

• Fake bill payment notices with “discounts” for immediate payment
• Fraudulent tax refund notifications requesting bank details
• Counterfeit government websites asking for citizenship information
• QR code scams disguised as government payment portals

Job and Employment Fraud

With many Nepalis seeking employment opportunities abroad, scammers have created elaborate phishing schemes targeting job seekers.

• Too-good-to-be-true job offers requiring “registration fees”
• Foreign employment scams requesting passport information
• Fake job portals asking for extensive personal details
• Fraudulent employment agencies requiring upfront payments

Check the URL Carefully

Legitimate websites use secure connections and proper domain names. Before entering any information, examine the URL in your browser’s address bar.

<!-- Legitimate URL -->
https://esewa.com.np/login

<!-- Phishing URL examples -->
https://esewa-verify.com.np/login
https://esewa.com.np.secure-verify.xyz/login
http://esewa-nepal-login.com/verify

Notice how phishing URLs often include extra words, misspellings, or different domain extensions. Always check that the main domain (before the first single slash) is correct.

Look for Language and Design Issues

Phishing messages and websites often contain telltale signs in their content and appearance.

• Poor grammar, spelling errors, or unusual phrasing
• Mismatched or low-quality logos and branding
• Unprofessional design that doesn’t match official websites
• Mixed languages (e.g., English and Nepali incorrectly combined)

Enable Multi-Factor Authentication (MFA)

Add an extra layer of security to your accounts by enabling MFA whenever possible.

For eSewa:
1. Log into your eSewa account
2. Go to Profile Settings
3. Select Security
4. Enable Two-Factor Authentication
5. Follow the prompts to link your phone number

For Khalti:
1. Open the Khalti app
2. Go to Profile > Settings > Security
3. Toggle on Two-Factor Authentication
4. Verify your phone number when prompted

Use Security Software

Technical protections can help identify and block phishing attempts before they reach you.

// In Google Chrome:
1. Click the three dots in the top-right corner
2. Select "Settings"
3. Navigate to "Privacy and security"
4. Ensure "Safe Browsing" is set to "Enhanced protection"

Act Quickly to Minimize Damage

1. Change passwords for all affected accounts immediately
2. Contact your bank to freeze accounts if financial information was compromised
3. Monitor account statements and credit reports for unauthorized activity
4. Enable additional security measures like login notifications

Report the Scam to Authorities

Reporting phishing attempts helps authorities track and combat cybercrime in Nepal.

• Nepal Police Cyber Bureau: +977-01-4201145
• Central Investigation Bureau (CIB): +977-01-4412748
• Nepal Rastra Bank: Financial Consumer Protection Unit