Cyber Security in Nepal

Digital security in Nepal: what actually goes wrong

Mobile banking, QR payments and online shopping have spread far faster than digital literacy. The result is a gap that fraudsters exploit: people who can send money from a phone but cannot recognise a phishing message. Most reported incidents are not sophisticated attacks. They are social engineering — someone convincing a user to share a one-time password, install a fake app, or scan a code that authorises a payment.

The scams people report most

• OTP fraud. A caller poses as a bank or wallet support agent and asks for the one-time password that just arrived. No legitimate institution ever asks for it.
• Fake loan and investment apps. Small "instant loan" apps that demand access to contacts and photos, then use them for blackmail when repayment is claimed.
• QR and payment-request tricks. A code that takes money out of your account instead of paying you, often disguised as a buyer for something you are selling online.
• Fake job offers. Overseas employment offers that charge a fee and vanish, or ask for passport scans and advance payment.
• Social media account theft. Account takeover followed by messages to your friends asking for emergency money.

Basic protection that prevents most losses

• Use a different password for banking than for social media, and turn on two-factor authentication where available.
• Never share an OTP, PIN or card photo — not with callers, not with people who claim to be from the bank.
• Install apps only from official stores, and check what permissions an app asks for before granting them.
• Update your phone and apps; most exploits rely on unpatched devices.
• Keep a second phone number or email for recovery so a stolen SIM does not lock you out of everything.

Who handles cybercrime

The Nepal Police maintains a dedicated cyber bureau that receives complaints about online fraud, harassment and account takeover. The telecommunications regulator and the national planning body both publish advisories and coordinate on digital policy, and banks and wallet providers run their own fraud desks. Reporting quickly matters more than reporting perfectly: early complaints give banks a chance to freeze a transaction before it is withdrawn.

If you are scammed

1. Contact your bank or wallet provider immediately and ask for the transaction to be frozen.
2. Keep screenshots, transaction IDs and the caller's number — these become evidence.
3. File a complaint with the cyber bureau and, where money was lost, with the local police.
4. Change passwords on any account that may have been exposed, starting with email.
5. Warn the contacts who may be targeted next using your name.

Keep reading

See cyber security companies in Nepal for the organisations working in this space.

Quick answers