Digital wallets like eSewa and Khalti have changed how Nepal pays for everyday life — topping up mobile data, paying electricity bills, splitting a lunch bill, or sending money to a family member in another district. But as more money moves through these apps, more scammers are trying to get a piece of it too. If you have ever wondered whether your eSewa or Khalti account is truly safe, or what you should be doing differently, this guide walks you through everything in plain language, with practical steps you can apply today.
Why Digital Payment Security Actually Matters in Nepal
Nepal's digital payment ecosystem has grown extremely fast over the past few years, and that growth has attracted attention from fraudsters as well as genuine users. Wallets like eSewa and Khalti are regulated by Nepal Rastra Bank (NRB) as licensed payment service providers, which means they follow baseline security standards. But regulation at the company level does not automatically protect an individual account — most digital payment fraud in Nepal happens because of human error, not because the platform itself was hacked. A stolen SIM, a shared OTP, or a fake customer-care call can be enough for someone to drain a wallet in minutes.
Understanding this distinction is the first step toward real security. The platform can only protect you so far; the rest depends on the habits you build around how you use it.
Common Threats to eSewa and Khalti Users
Most incidents reported by users fall into a handful of recurring patterns. Recognizing them makes it much easier to spot trouble before it happens.
Phishing calls and messages. Someone calls or texts pretending to be from eSewa, Khalti, or your bank, claiming your account has an issue and asking you to "verify" it by sharing an OTP or MPIN. Genuine support staff never ask for these codes over the phone.
Fake apps and cloned websites. Look-alike apps or web pages are designed to steal your login credentials the moment you type them in. These often spread through ads, unofficial app stores, or links shared in messaging groups.
SIM swap fraud. A fraudster convinces your telecom provider to issue a duplicate SIM card in your number, which lets them intercept OTPs sent to "your" phone. This is rarer but far more damaging when it happens.
QR code tampering. A merchant's QR sticker gets swapped or overlaid with a fraudulent one, redirecting payments to the wrong account. This mostly affects small shops but is worth knowing about as a customer too.
Social engineering through prize or refund scams. Messages claiming you have won cashback, a lucky draw, or a refund, asking you to click a link or share account details to "claim" it.
How to Check If Your Account Is Safe Right Now
Before making any changes, it helps to do a quick health check on your existing account:
Open the app and review your recent transaction history line by line. Look for any transfer, top-up, or merchant payment you do not recognize. Next, check which devices are currently logged in, if the app shows this option, and log out of any device that is not yours. Confirm that your registered mobile number and email are still correct, since these are used to send you OTPs and alerts. Finally, make sure notifications are turned on for the app so you are alerted the instant a transaction happens.
Step-by-Step Security Checklist for eSewa and Khalti
1. Set a strong, unique MPIN. Avoid birth years, repeated digits, or the same PIN you use for your bank card. Change it periodically.
2. Turn on biometric or app-lock protection. Both eSewa and Khalti support fingerprint or face-unlock on most modern phones. This adds a second barrier even if someone gets hold of your phone.
3. Never share your OTP, MPIN, or password with anyone. Not with someone claiming to be customer support, not with a "friend" helping you troubleshoot, not with anyone. These codes exist specifically so only you can authorize a transaction.
4. Download apps only from the official Google Play Store or Apple App Store. Verify the developer name matches the official publisher before installing, and avoid APK files shared through social media or messaging apps.
5. Double-check URLs before entering login details. Bookmark the official website rather than clicking links from messages or search ads.
6. Keep your SIM and phone number secure. Never share your SIM PUK code, and contact your telecom provider immediately if your SIM suddenly stops working — that can be an early sign of a SIM swap attempt.
7. Set transaction alerts and daily limits if the app allows it, so a single compromised session cannot drain your entire balance.
8. Log out of shared or public devices after use, and avoid logging into your wallet on a friend's phone or a cyber cafรฉ computer.
9. Update the app regularly. Updates often include security patches for vulnerabilities that have already been discovered.
What To Do If You Suspect Fraud
Acting quickly makes a real difference. If you notice an unauthorized transaction or suspect your account has been compromised:
Immediately change your MPIN and password from a trusted device. Contact eSewa or Khalti customer support directly through the number listed on their official website or app — not a number given to you by the caller who contacted you. Ask them to freeze or lock the account while the issue is investigated. If money has already been lost, file a complaint with the Nepal Police Cyber Bureau, which handles digital fraud and cybercrime cases nationally, and keep screenshots of the suspicious transaction, messages, or calls as evidence. You can also inform your bank if the wallet is linked to a bank account, so they can monitor for further unusual activity.
Building Long-Term Safe Habits
Security is not a one-time setup; it is an ongoing habit. Make it a routine to review your transaction history at least once a week, treat any unexpected call or message about your wallet with suspicion by default, and talk to family members — especially those less familiar with technology — about these same precautions, since scammers often target the people least likely to question a convincing phone call.
Digital wallets have made life genuinely more convenient in Nepal, and that convenience is worth protecting. A few minutes spent tightening your account settings today can save you from a much more painful situation later. Stay alert, verify before you trust, and keep your OTP to yourself — that one habit alone prevents the vast majority of digital payment fraud.
Discussion