A message arrives showing a transaction you did not make. Or a call from someone claiming to be your bank, and minutes later the account is empty.
What happens next depends almost entirely on how quickly you act and what you put in writing.
The first hour
Block the card and the channel. Call the bank's helpline, use the app, or the bank's SMS blocking service. Do it before you do anything else.
Note the time you reported it. The reporting time is the single most important fact in the entire dispute. Ask for a complaint or ticket number and write it down.
Follow up in writing the same day — email and, if possible, a letter to the branch. A phone call that the bank has no record of is worth very little later.
Do not share anything further. No OTP, no PIN, no CVV, no card number, no screen-sharing app, no "verification" link. Bank staff never need your OTP or PIN. If you already shared them, say so honestly to the bank; concealing it makes the investigation worse, not better.
Preserve evidence — the SMS alerts, the transaction messages, the caller's number, any link you clicked, and screenshots of everything.
The bank's dispute process
Banks in Pakistan operate a consumer grievance handling process under State Bank requirements, with defined timelines for acknowledgement and resolution.
What to do:
- File a written dispute identifying each unauthorised transaction, the amount, the date, and when you reported it
- Ask for a chargeback to be raised where the transaction was on a card network — there are network deadlines, which is another reason speed matters
- Ask for the transaction logs, the channel used, and the authentication evidence the bank is relying on
- Keep every reference number and every response
If the bank rejects the claim, ask for the reasons in writing. That letter is what the next stage is built on.
When is the bank liable?
There is no single rule, but the argument turns on authentication and negligence, and the following matter:
Was the transaction properly authenticated? If it went through without OTP or two-factor authentication where the system requires it, that is the bank's system failure, not yours.
Was the card cloned or skimmed? Counterfeit card transactions on a machine you never visited are a security failure in the payment chain.
Did the bank act on your report? Transactions occurring after you reported the loss are on the bank. This is why the reporting time is decisive.
Did the bank follow its own controls? Failure to flag obviously anomalous activity, to enforce limits, or to act on the block request promptly.
Did you disclose your credentials? This is where claims fail. If you gave the OTP or PIN to a caller, the bank will say you enabled the transaction. That is not automatically the end — social engineering by someone using bank branding, spoofed numbers or a cloned app raises real questions about the bank's own security and customer warnings — but it is a materially harder claim, and you should be told that honestly.
Escalation: the Banking Mohtasib
If the bank does not resolve it, the Banking Mohtasib (Banking Ombudsman) is the route. It is free, it is designed for exactly this, and it is far faster and cheaper than litigation.
Practical points:
- Complain to the bank first and give it the opportunity to resolve — the Mohtasib expects this
- File within the applicable time, with the complete chronology and documents
- Present it as a timeline: when the transaction occurred, when you reported, what the bank did and when
- Complaints about service failures, unauthorised transactions and charges are squarely within scope
If the outcome is unsatisfactory, a civil suit remains available, as does the representation route to the State Bank. See recovering money owed.
Report the crime as well
The civil recovery and the criminal complaint are separate tracks, and both are worth running.
Online and card fraud falls to the FIA Cyber Crime Wing. A complaint with the transaction details and beneficiary account numbers gives the only realistic prospect of the money being traced, because the funds usually move to another account before being withdrawn. See reporting online fraud and cybercrime, an FIA notice and how the agency works and investment scams and recovery.
If your account is frozen instead
The opposite problem, and increasingly common: an account blocked because it received funds connected to someone else's fraud investigation, or under anti-money-laundering monitoring. Different process, different remedy — see a frozen bank account and AML compliance for smaller businesses.
Reducing the risk
- Set transaction limits and turn off international and online use unless you need them
- Enable alerts on every transaction, and read them
- Never approve a payment request you did not initiate — request and pay screens are deliberately similar
- Treat any call about "verification", "blocking", "a prize" or "a refund" as fraudulent by default, and hang up and call the number on your card
- Never install screen-sharing or remote-access apps at anyone's request
- For businesses: separate the person who prepares payments from the person who approves them, and review mandates when staff leave. See protecting your business when an employee leaves
How the firm can help
We draft the dispute and the escalation properly, obtain the authentication and transaction evidence the bank is relying on, take complaints to the Banking Mohtasib, file and follow FIA complaints to trace beneficiary accounts, and sue where the sum justifies it.
See banking and finance, or contact the firm — with the reporting time and reference number to hand, because that is where the claim starts.