Common Online Scams in Nepal
नेपालमा हुने अनलाइन ठगी
The online scams people in Nepal fall for most - and how to stop them
Scammers don't need to be hackers. Almost every case reported in Nepal starts with a message that persuades someone to share a code, tap a link or send money. Learn the patterns below and you'll recognise most of them on sight.
ठगहरूले प्रायः एउटै तरिका प्रयोग गर्छन् - डर देखाउने, लोभ देखाउने र हतार गराउने। तलका ढाँचा चिन्नुहोस्।
Fake wallet or bank "KYC update" messages
नक्कली KYC सन्देशHow it works: An SMS or Messenger message says your eSewa, Khalti or bank account will be blocked unless you update KYC through a link. The link opens a copy of the real login page that steals your ID, password and OTP.
How to protect yourself:
- Never log in through a link in a message - open the official app yourself.
- Check the address with our link checker.
- Your provider will never ask for your MPIN or OTP.
Hacked Messenger: "friend" asks for money
ह्याक भएको मेसेन्जरबाट पैसा मागHow it works: A friend's or relative's account is taken over. The criminal messages everyone on the friend list with an emergency - hospital, stuck abroad, urgent payment - and asks for money by wallet transfer.
How to protect yourself:
- Call the person on the phone number you already have.
- Ask a question only the real person would know.
- Protect your own account with two-step verification so it can't be used against your friends.
Lottery, prize and "lucky draw" messages
चिट्ठा र पुरस्कारको लोभHow it works: You are told you have won a large prize from a telecom company, a brand or a TV show, but must first pay a "tax", "processing fee" or "customs charge" - and often send a copy of your citizenship.
How to protect yourself:
- You cannot win a draw you did not enter.
- Real prizes never require an advance payment.
- Never send citizenship, passport or selfie-with-ID photos to strangers.
Fake foreign jobs and visas
वैदेशिक रोजगारको नाममा ठगीHow it works: Social media groups and pages advertise high-paying jobs in Japan, Korea, Europe, the Gulf or Malaysia with "guaranteed visa" and "no interview", then collect booking fees and passports.
How to protect yourself:
- Use only licensed manpower agencies - check them with the Department of Foreign Employment before paying.
- Get a written contract and receipt; never pay into a personal wallet or account.
- Be very wary of "no language test" and "limited seats, pay today".
QR code and "refund" tricks on online selling
QR कोड ठगीHow it works: You are selling something online. A "buyer" sends a QR code or payment request and says scanning it will send you the money. Scanning and entering your PIN actually pays them.
How to protect yourself:
- You never need to scan a QR code or enter your PIN to receive money.
- Check your balance in your own app before handing over goods.
- Be careful with buyers who insist on paying "extra" and asking for a refund.
Phone calls pretending to be a bank, telecom or police
बैंक वा प्रहरी भनेर आउने फोनHow it works: A caller claims to be from your bank, your telecom company or even the police. They say your card, SIM or account needs "verification" and ask you to read out a code that has just arrived.
How to protect yourself:
- Never read out an OTP to anyone - it is the key to your account.
- Hang up and call the official number printed on your card or on the official website.
- Real police do not settle cases over the phone or by wallet payment.
Malicious APK files on WhatsApp and Viber
नक्कली APK एपHow it works: A file named like a bank update, wedding card, traffic fine or photo album arrives in a chat. Installing it gives criminals control of your SMS - and your OTPs.
How to protect yourself:
- Only install apps from the Play Store or App Store.
- Never tap "Allow install from unknown sources".
- Check suspicious files with our free virus check.
Instant loan apps and online investment "schemes"
अनलाइन ऋण र लगानी ठगीHow it works: Apps promise instant loans with no documents, then demand access to your contacts and photos and harass you and your family. "Investment" groups promise to double your money and disappear.
How to protect yourself:
- Borrow only from banks and financial institutions licensed by Nepal Rastra Bank.
- Never give a loan app access to your contacts and gallery.
- If a return sounds too good to be true, it is.
Sextortion and harassment
अनलाइन ब्ल्याकमेलHow it works: Someone builds trust - often through a fake profile - then threatens to share private photos or video calls unless you pay. Young people are frequently targeted.
How to protect yourself:
- Do not pay - payment usually leads to more demands.
- Stop replying, keep screenshots and block the account.
- Report it - the Cyber Bureau handles these cases confidentially. You are the victim, not the one who did wrong.
Test what you've learned
Try the 3-minute Spot the Scam quiz - and share it with someone in your family.
Already lost money or been hacked?
Call your bank or wallet provider immediately to block the account, then report it to the Nepal Police Cyber Bureau. Our step-by-step reporting guide lists what evidence to keep and who to contact.
More free tools and guides
Free toolFree Virus Checkनिःशुल्क भाइरस जाँचCheck a file against 70+ antivirus engines without uploading it.Free toolSuspicious Link Checkerशंकास्पद लिङ्क जाँचSpot fake eSewa, Khalti, bank and Facebook links before you tap.Free toolPassword Strength & Leak Checkपासवर्ड बलियो छ कि छैनSee how strong a password is and whether it has leaked online.Free toolEmail Breach Checkईमेल चुहावट जाँचFind out if your email address was leaked in a data breach.Free toolSpot the Scam Quizठगी चिन्नुहोस् - क्विज8 real-style messages from Nepal. Can you tell which are scams?GuideHow to Report Cybercrime in Nepalसाइबर अपराधको उजुरी कसरी दिनेWhat to do first, what evidence to keep and where to complain.GuideSecurity & Responsible Disclosureसुरक्षा नीतिFound a security problem on our website? Here is how to tell us.
This Cyber Safety Centre is a free public-awareness service of Shrijanshil Nepal, a non-profit organization in Nepal. The tools give guidance, not a guarantee - no checker can prove that a file or link is safe.