Request for OTP, PIN or password: warning signs and what to do
What to do
Never share an OTP, PIN or password with anyone, including someone who says they are from bKash, Nagad, a bank or the police. No genuine company asks for them.
Warning signs
- Asks for an OTP, PIN, verification code or password.
- Threatens that your account will be blocked.
- Caller claims to be from customer care or an office.
- Asks you to click a link to log in, verify, unblock or update an account.
- Warns of a problem with your account or card.
- Mentions replacing or re-activating your SIM, the first step of a SIM-swap takeover.
- Says your Facebook page or account broke the rules and must be appealed through a link.
How this scam has played out
Fake "reversal" and fake mobile-money messages
Safaricom warns M-Pesa users about fake or old transaction messages, fake reversal instructions that send people to an agent, fake staff and SIM-swap fraud. The same tricks work on bKash and Nagad users: always check the balance inside the app, never the SMS.
Source: Safaricom fraud awareness
Fake "Meta" copyright or policy-violation warnings
Page owners receive a message saying their Facebook page or account breaks copyright or community standards and will be disabled within 24 hours unless they appeal through a link. The link leads to a fake form that steals the password and two-factor code. Check your account status only by opening Facebook yourself.
Source: Cybernews (2023–24)
Received a message or offer like this? Check it before you pay.
Check it nowHelp and helplines
- National emergency 999
- Police Cyber Support for Women 01320-000888
- Visa check for Oman, Qatar, Saudi Arabia (Ami Probashi, paid) 16768
This guide is a warning about a pattern; it does not accuse any particular person or organisation.