The Digital Rights Foundation (DRF) has issued an alert warning Pakistani citizens of a growing scam that targets WhatsApp users through fake calls designed to trick them into sharing verification codes. These fraudulent calls, often claiming to be from courier services or official institutions such as the Higher Education Commission (HEC), have led to a rise in compromised WhatsApp accounts across the country.
DRF, a non-profit organisation established in 2013 and focused on digital rights in Pakistan, confirmed that it has received numerous reports of users falling victim to this ongoing scam. The alert states that callers often impersonate delivery riders or representatives of HEC, asking users to provide a code sent to their phone under the pretense of verifying educational records or confirming delivery details. However, once the code is shared, control of the user’s WhatsApp account is transferred to the attacker.
WhatsApp remains one of the most widely used communication platforms in Pakistan, with over 52 million users according to World Population Review’s 2024 data, ranking the country seventh globally by user base. Its popularity, combined with limited user awareness of online security threats, has made it a frequent target for such scams.
DRF highlighted that legitimate courier companies will only use codes from verified official numbers, and citizens are advised to confirm any such communication via official helplines before taking action. The organisation strongly emphasized that no one should ever share any codes with anyone, regardless of the urgency communicated by the caller.
For those who suspect their account has been compromised, DRF recommends immediate action: turning on two-factor authentication across all social media platforms, checking WhatsApp’s ‘linked devices’ feature to monitor unauthorized access, and removing any unfamiliar devices from the account. Citizens can also report scam calls directly to PTA at 0800-55055.
DRF’s Digital Security Helpline, available every day from 9am to 5pm at 0800-39393 or via social media, offers further assistance. The helpline team reported receiving 233 scam-related cases since January 2025. The scams vary in method, including impersonation of JazzCash helplines, fake kidnapping demands, and phishing attacks using compromised accounts to request urgent financial help from the victim’s contacts.
According to DRF’s Digital Security Helpline Lead, Hyra Basit, the use of artificial intelligence tools has made scam verification increasingly challenging, and many individuals continue to fall prey despite widespread awareness efforts. She stressed the need for a data protection law aligned with human rights principles to safeguard citizens’ private information and reduce their vulnerability to digital threats. Furthermore, she called for easier reporting mechanisms to enable the public to respond quickly when faced with suspicious activity.
Earlier this month, the National Cyber Crime Investigation Agency arrested five foreign nationals in a raid on an illegal call centre in Islamabad. In a separate development, Pakistan’s Cyber Emergency Response Team recently warned of a massive global data breach that exposed credentials of more than 180 million internet users in the country, urging all citizens to enhance their digital security measures immediately.
