Phishing Scams
Fraudsters use unsolicited emails, messages and suspicious links to obtain personal or financial information.
Threat landscape
Authorization without a customer approval secret.
When customers return PINs, TPINs, passwords, keys, OTPs, or credentials to authorize a transaction, an attacker can obtain that information and use it to attempt authorization.
- Theft
- Interception
- Replay
- Hijacking
- Disclosure
- Screen overlays
- Phishing
- Malware
- Social engineering
Authoritative identity
Biometric verification establishes the customer’s tokenized authority. The authoritative token is validated for each transaction.
Explore the Super TokenAuthorization separate from the banking application
A compromised banking application does not give an attacker the authority to authorize a transaction. Authorization takes place through a distinct communication channel, where customer intent relates to the specific transaction context.
Common Financial Frauds
Source: NCCIA — Financial Frauds ↗Fraudulent Transfers
Victims are deceived or manipulated into transferring money to fraudulent recipients.
PIN, Password and OTP Theft
Fraudsters impersonating trusted institutions attempt to obtain PINs, passwords, OTPs and other financial information.
Click Frauds
Unsolicited messages direct customers to malicious links under the pretext of updating personal credentials.
Income Support Program Frauds
Fraudsters imitate messages associated with government financial-support programs to deceive eligible individuals.
Fake Investments and Financial Offers
Promises of quick returns or offers that appear too good to be true are used to induce disclosure or payment.
Supporting Evidence
27 alleged Oad Gang members arrested · July 2026
NCCIA reported that suspects impersonated bank officials and others to obtain OTPs, banking credentials and sensitive information before fraudulently transferring funds.
The fraud depended on something the victim could be deceived into giving away.
Secret-less approval through a distinct authorization channel
Phishing, social engineering, credential theft, malicious links and impersonation exploit the ability to steal or manipulate information used to authorize financial transactions.
Zero-Secret
Nothing for the scammer to steal.
Context-Bounded
Real-time, in-session authorization bound to the transaction being authorized.
See the Difference
Generic approval vs. Context-Bounded Authorization
Non-Bounded Authorization
482731
Authorization Secret
482731 is the authorization secret — something that can be stolen, intercepted, relayed, or socially engineered from the customer and then used by someone else.
Credentis Context-Bounded Authorization
Real-Time · In-Session
310991
Not an Authorization Secret
310991 is not an authorization secret. Intercepting the value does not allow another person to authorize the transaction because the token cannot be used outside that authorization session.
Transaction
Live Authorization Session
Customer Response
Authorization Decision
SIM-Swap Fraud
A SIM change blocks authorizations until bank biometric verification.
Primary Control Behavior
When the SIM associated with the registered mobile number changes, Credentis blocks further authorizations until the account holder completes biometric verification with the bank.
Banking Context
Digital banking relies heavily on the account holder’s registered mobile number and mobile phone. Banks associate both with the customer’s digital banking account, but they are not capable of mandating the registration of the SIM card itself.
Registered
Mobile Number
Registered
Mobile Phone
SIM Change
Detected
Registered Number’s
SIM Changed
Authorizations
Blocked
Bank Biometric
Verification
The SIM associated with the registered mobile number has changed.
Recent SIM-Hijacking Frauds
Customer Banking Fraud
PKR 10.45 million · August 2026
Six customers were reportedly affected in a fraud involving compromised banking information and duplicate SIM issuance.
Duplicate SIM issued without biometric
PKR 8.5 million · October 2025
A duplicate SIM was reportedly issued without his biometric verification, followed by more than 100 unauthorized transactions.
Pre-Activated International SIM Rackets
Nationwide · February 2025
Authorities seized thousands of illegally used international SIMs associated with criminal activity including financial fraud.
Sheikhupura Biometric Misuse
December 2025
Authorities recovered 150 SIMs and five BVS devices following allegations involving unauthorized SIM issuance.
Authorization that can also be reconstructed
Every Credentis authorization produces structured evidence supporting subsequent review, investigation and reconstruction.