How to Spot and Stop Phishing Attacks
Phishing is the most common cyberattack in the world, and Pakistan is no exception. It works like this: a criminal sends you a message that looks like it comes from your bank, Jazz, Telenor, Easypaisa, the government, or even a friend. The message creates panic or excitement — "your account will be blocked", "you won a prize", "your parcel is held" — and pushes you to click a link, enter your password, or share an OTP code. One click can hand your account, your money, or your identity to a stranger. The good news: phishing is easy to defeat once you know what to look for.
What Phishing Is
Phishing is fraud by impersonation. Instead of breaking into systems with code, attackers trick people into handing over access. It arrives as email, SMS, WhatsApp messages, phone calls (called vishing), and fake websites. The goal is always one of three things: steal your login credentials, steal a one-time code, or get you to install malware. Because it targets human trust rather than technology, anyone — young or old, tech-savvy or not — can be a target.
Email Red Flags
Before clicking anything in an email, check these warning signs:
- The sender address is wrong. "support@jazz-support-desk.com" is not Jazz. "easypaisa-help.net" is not Easypaisa. Real companies email from their own official domains. Tap the sender name to reveal the actual address.
- Urgency and threats. "Your account will be SUSPENDED in 2 hours!" Real banks and companies do not threaten you by email to click a link.
- Generic greetings. "Dear customer" instead of your name is a classic sign of a mass-sent scam.
- Links that don't match. The text says "jazz.com.pk" but hovering or long-pressing the link shows a different address. Always verify the real destination before tapping.
- Attachments you didn't expect — especially .zip, .exe, or Office files claiming to be invoices or statements.
- Spelling and grammar errors in messages claiming to be from professional organizations.
- Requests for passwords or OTP codes. No legitimate company ever asks for your password or one-time code by email.
SMS and WhatsApp Phishing
In Pakistan, SMS and WhatsApp scams are even more common than email phishing. Typical examples: "Congratulations! You won a Toyota in the Jazz lucky draw, call this number", "Your Easypaisa account is blocked, send your CNIC and PIN to unblock", "This is NADRA, verify your SIM", or a message from a "friend" whose account was hacked asking for money urgently. Prize and lottery scams are illegal in the first place — telecom companies do not run lotteries over SMS. Never send money, PINs, or CNIC copies in response to an unsolicited message, and never call back premium-rate numbers from such texts.
Fake Login Pages
A sophisticated phish sends you to a page that looks exactly like Facebook, Gmail, or your bank's login screen. The page's only purpose is to capture what you type. Clues: the website address is slightly wrong (faceb00k.com, gmai1.com), there is no padlock or the certificate looks odd, or you arrived via a link instead of typing the address yourself. The golden rule: never log in through a link someone sent you. Open your browser, type the official address yourself, and log in there.
How to Verify Links Safely
- On a phone: press and hold the link — a preview of the real address appears. Do not tap it.
- On a computer: hover your mouse over the link and look at the bottom-left corner of the browser for the real destination.
- Check the domain: the part right before the first single slash is the real site. In "jazz.com.pk.verify-account.xyz/login", the real site is verify-account.xyz — a scam.
- When in doubt, go direct: open the company's official app or type their official website yourself, and check whether the message is real.
- Call the official helpline (from the company's real website, not from the suspicious message) to confirm.
What to Do If You Clicked
Don't panic — act fast. (1) If you entered a password, change it immediately from a clean device, and change it on every site where you reused it. (2) If you entered an OTP or approved a transaction, call your bank or mobile-money helpline at once (Easypaisa: 3737, JazzCash: 4444) and ask them to freeze the transaction. (3) If you downloaded a file, do not open it; delete it and run a scan with Play Protect or a reputable antivirus. (4) Turn on two-factor authentication on the affected accounts. (5) Watch your accounts for strange activity over the next few days.
Reporting Phishing
Reporting helps protect everyone else. In Gmail, open the message, tap the three dots, and choose "Report phishing". In WhatsApp, you can report and block a suspicious contact from the chat menu. Forward scam SMS messages to your network's spam reporting number, and report fraud to the FIA Cybercrime Wing through their official complaint portal. You can also warn family members — forwarding one real example to your family WhatsApp group does more good than any lecture.
Remember the core principle: legitimate organizations never ask for passwords, PINs, or OTP codes through links in messages. Slow down, verify independently, and the phish fails.