The Digital Rights Foundation (DRF), a non-profit organization focused on digital safety, has issued an urgent alert about a rising scam that targets WhatsApp users in Pakistan. The scam involves fraudulent calls made by individuals posing as courier service agents or representatives of the Higher Education Commission (HEC), requesting verification codes that ultimately compromise users’ WhatsApp accounts.
According to the foundation, multiple cases have been reported where victims received calls asking for a code under false pretenses, often claiming it was for verifying academic credentials or confirming a package delivery. Once the code is shared, the scammers gain unauthorized access to the user’s WhatsApp account.
WhatsApp is one of the most widely used messaging apps in Pakistan, with around 52 million users in 2024. Its popularity has even extended into official and legal communications, making it a prime target for cybercriminals. The DRF warns that the scam is part of a broader trend of digital fraud affecting millions of users across the country.
The foundation clarified that while legitimate courier companies may use verification codes, these are only sent via official numbers. It strongly urged users to confirm any such communication with the courier company’s helpline before sharing any personal information. DRF’s advisory emphasized: “Never share codes from WhatsApp or other apps with anyone, even if they claim to represent a trusted institution.”
To help prevent account hijacking, the DRF recommended that all users enable two-factor authentication on their social media platforms, especially WhatsApp. It also encouraged users to regularly check the ‘linked devices’ feature on WhatsApp to ensure no unknown devices are accessing their account. In case of a breach, users should immediately remove unfamiliar devices and secure their account settings.
Victims of such scams can report incidents to the Pakistan Telecommunication Authority’s (PTA) complaint cell by calling 0800-55055. For direct support and recovery assistance, the DRF’s Digital Security Helpline can be reached at 0800-39393 between 9 AM and 5 PM daily or through their social media channels.
From January to August 2025, the DRF recorded 233 cases related to scam calls. In addition to WhatsApp fraud, other schemes included impersonation of JazzCash helpline representatives, fake kidnapping calls demanding ransom, and phishing links used to hijack social media accounts. Scammers then impersonate victims to request urgent financial help from friends and family.
The DRF helps victims recover accounts, create public awareness posts, and escalate high-risk cases to digital platforms for action. However, despite ongoing awareness efforts, many people continue to fall prey to these tactics. “People are still sharing their OTPs (One-Time Passwords), which are the keys to their accounts,” said Hyra Basit, who leads the DRF’s Digital Security Helpline.
Basit also highlighted how scammers are becoming more sophisticated, often using AI-generated voices or automated systems to increase credibility and scale their operations. She called for the urgent implementation of a data protection law that respects human rights and prioritizes user safety, as well as the development of accessible mechanisms for the public to report digital fraud.
In a recent crackdown on cybercrime, Pakistan’s National Cyber Crime Investigation Agency successfully raided an illegal call center in Islamabad, arresting five foreign nationals involved in scam operations.
Moreover, an alarming advisory issued in May by the national Cyber Emergency Response Team warned that login credentials and passwords of over 180 million internet users in Pakistan had been compromised in a global data breach, reinforcing the urgent need for improved cybersecurity practices among the general public.
The DRF reiterates that online safety is a shared responsibility and urges users to remain vigilant, protect their accounts, and report suspicious activities promptly.
