6 Cybersecurity Habits Every Digital Wallet User Should Follow

Evergreen Safety Guide · Nepal Digital Payments · Updated 2026

Digital wallets have made sending and receiving money in Nepal faster and easier than ever. Platforms like eSewa, Khalti, IME Pay, and ConnectIPS now handle everything from utility bill payments to inter-bank transfers for millions of Nepali users. But this explosive growth has a shadow side: cyber fraud targeting digital wallet users is rising sharply, and the tactics are growing more sophisticated every year. Fake customer support calls, counterfeit QR codes, phishing SMS messages, and social engineering scams are increasingly common — and most victims weren't careless people; they simply didn't know what to watch for. This guide covers six concrete security habits that, practiced consistently, dramatically reduce your risk of becoming a victim.

HABIT 1 🔑 Use Strong, Unique PINs and Passwords

Your PIN or password is the first line of defence between a thief and your wallet balance. A weak or reused PIN is not just a minor inconvenience — it's an open door. Here's what strong looks like in practice:

• Never use predictable PINs — your birth year, "1234", "0000", or any sequence from your phone number or citizenship ID are the first combinations an attacker tries.
• Use a different PIN for every platform. If your eSewa PIN is the same as your Khalti PIN and your phone lock screen, a single breach compromises all three.
• For passwords, use length over complexity. A 14-character passphrase made of four random Nepali words is harder to crack than a short string of symbols you'll forget — and far more memorable.
• Use a password manager (Bitwarden is free and open-source) to generate and store unique credentials for every app. You only need to remember one master password.
• Change your PIN immediately if you've shared it with anyone, used it on a shared device, or suspect any account activity you didn't initiate.

Quick check: Open your most-used digital wallet app right now. Is your PIN six digits or longer? Does it appear nowhere else in your life? If either answer is no, change it before continuing.

HABIT 2 🛡️ Enable Two-Factor Authentication (2FA)

Two-factor authentication adds a second verification layer beyond your password — typically an OTP (one-time password) sent to your registered mobile number or generated by an authenticator app. Even if someone obtains your login credentials, they cannot access your account without also controlling your second factor.

• Enable 2FA in every digital wallet and banking app that offers it. This is usually found under Settings → Security → Two-Factor Authentication or Login Verification.
• SMS-based 2FA is the minimum standard. If a platform also offers an authenticator app option (Google Authenticator, Authy), prefer that — it's not vulnerable to SIM-swap attacks the way SMS codes are.
• Protect your SIM card. Since many 2FA systems send codes to your phone number, a fraudster who can convince your carrier to transfer your number to a new SIM (a SIM swap) can intercept those codes. Set a SIM PIN with your mobile carrier to block unauthorized transfers.

Quick check: Go to Settings in your eSewa, Khalti, or bank app. If you see a 2FA toggle that's off — turn it on now. It takes under a minute.

HABIT 3 🚫 Never Share Your OTP — With Anyone

This is the single most important habit on this list, and the one that prevents the majority of digital wallet fraud cases in Nepal. An OTP (One-Time Password) is a temporary code sent to your phone to confirm a transaction or login. It exists precisely because it expires quickly and can only be used once — making it extremely valuable to a fraudster in the seconds after it's sent to you.

The scam works like this: someone calls you claiming to be from eSewa support, Khalti, your bank, or even Nepal Telecom. They create a sense of urgency ("your account will be blocked," "we need to verify a suspicious transaction") and ask for the OTP that just arrived on your phone. The moment you read it aloud, your account is theirs.

• No legitimate company will ever call you and ask for an OTP. Not eSewa. Not Khalti. Not your bank. Not Nepal Telecom. Not anyone. This is an absolute rule without exceptions.
• Do not share OTPs in chat messages either — WhatsApp, Viber, Messenger, or any platform. The channel doesn't make it safer.
• If someone asks for your OTP, end the call immediately and contact your wallet provider through their official app or verified phone number to report the attempt.

⚠ Remember: The urgency a caller creates is part of the scam. Real account issues can wait while you independently verify the caller's identity. Scams cannot — they rely on you acting before you think.

HABIT 4 📷 Verify Before Scanning QR Codes or Clicking Payment Links

QR codes and payment links are convenient — and that convenience makes them attractive targets for fraud. A tampered QR code looks identical to a legitimate one; a fraudulent payment link can be crafted to resemble an official eSewa or Khalti URL closely enough to fool a distracted user.

• Always check the merchant name after scanning — your wallet app will display the registered beneficiary name before you confirm payment. If the name doesn't match the shop or person you're paying, do not proceed.
• Be cautious with printed QR codes in public places — fraudsters have been known to paste their own QR codes over legitimate merchant codes. Physically check that a sticker hasn't been placed on top of the original.
• Never click payment links sent via unsolicited SMS, email, or social media messages — even if they appear to come from someone in your contact list (whose account may itself have been compromised).
• Check the URL before entering credentials. Legitimate Nepali payment platforms use HTTPS and their verified domain. A URL like "esewa-nepal-support.com" or "khalti-verify.net" is not the real platform.
• For receiving money, you do not need to enter your PIN or scan anything. If someone sending you money asks you to scan a QR code "to receive" a payment — that is a scam designed to initiate a payment from your account to theirs.

⚠ Critical rule: You never need to scan a QR code to receive money. Scanning and confirming always initiates a payment from your end — not to it.

HABIT 5 📋 Regularly Review Your Transaction History

Most digital wallet fraud isn't discovered immediately — victims often notice something is wrong days or even weeks after their account was first accessed. Making a habit of reviewing your transaction history at least once a week closes this window significantly, giving you the best chance of catching unauthorized activity before it escalates.

• Check your transaction history every Sunday evening as a routine — right after reviewing the week. It takes under two minutes and quickly trains your eye to spot anything unfamiliar.
• Look for small, unfamiliar transactions first. Fraudsters often test access with a tiny withdrawal (NPR 10–50) before attempting a larger one. A micro-transaction you didn't make is a serious warning sign.
• Enable push notifications for every transaction. All major Nepali wallet apps allow this — it means you get an alert on your phone the instant any money moves, giving you real-time visibility even when you're not actively checking.
• Cross-check your bank statement too — if your wallet is linked to your bank for top-up or withdrawal, verify that all bank-to-wallet and wallet-to-bank transactions on your bank statement were ones you authorized.

Quick check: Open your wallet app and tap the transaction history. Scroll through the last seven days. Does every entry look familiar? If not, report it immediately.

HABIT 6 🔄 Keep Your Apps and Phone OS Updated

App and operating system updates are not just about new features — the majority of updates for payment and banking apps contain security patches that fix known vulnerabilities. Running an outdated app is the digital equivalent of leaving your door unlocked: the weakness is known, and it's only a matter of time before it's exploited.

• Enable automatic updates for all financial apps on both Android and iOS. If automatic updates are off, check the Play Store or App Store manually every week.
• Keep your phone's operating system updated — Android and iOS security patches are released regularly and protect the entire device, not just individual apps.
• Only install wallet apps from official sources — the Google Play Store or Apple App Store. Never install APK files sent via WhatsApp, email, or third-party websites, even if they claim to be official.
• Uninstall apps you no longer use. Dormant apps can still have active sessions or stored credentials that represent unnecessary risk — if you've stopped using a platform, close the account or at minimum uninstall the app.
• Avoid using public Wi-Fi for financial transactions. If you must, use a VPN. Open networks can allow traffic interception — never log in to your wallet or make a payment on an untrusted network.

Quick check: Open your Play Store or App Store and search for your wallet app. If you see an "Update" button instead of "Open" — you're running a version with known security gaps. Update now.

What to Do If You Suspect Fraud

Speed is critical. If you notice any unauthorized transaction, shared an OTP with someone you shouldn't have, or believe your account has been compromised, act in this order:

1. Change your PIN/password immediately — from a safe, trusted device and network. This cuts off further access even if the session is still active.
2. Freeze or block your account — most wallet apps have a "block account" or "freeze card" option in settings, or reachable via their official helpline. This stops any further transactions.
3. Call your wallet provider's official helpline — use only the number listed in your app or on the official website, not one provided by the caller or in an SMS. Report the incident, describe what happened, and request a transaction reversal if funds have already moved.
4. File a written complaint — with your wallet provider and with your bank if a bank account is linked. Written complaints create a paper trail essential for any investigation or potential refund process.
5. Report to Nepal Police Cyber Bureau — see resources below.

Resources for Reporting Cyber Scams in Nepal

If you've been targeted by or fallen victim to a digital financial scam in Nepal, the following channels are available to you:

Authority / Platform	Contact / Channel	What They Handle
Nepal Police Cyber Bureau	cyberdost.police.gov.np	Cyber fraud, account hacking, online scams
Nepal Rastra Bank	nrb.org.np (complaint portal)	Licensed payment service provider issues
eSewa Support	esewa.com.np / 01-4005888	Unauthorized eSewa transactions
Khalti Support	khalti.com / 16600172702	Unauthorized Khalti transactions
Your Bank's Fraud Helpline	Listed on your bank's official website	Linked bank account fraud, unauthorized transfers

ⓘ Contact details may change. Always verify current helpline numbers directly from the official app or website of the platform — never from a search result, SMS, or third party.

Final Thoughts

Cybersecurity doesn't require technical expertise — it requires consistent habits. A strong PIN, 2FA turned on, the discipline to never share an OTP, a moment's pause before scanning a QR code, a weekly glance at your transaction history, and apps kept up to date: these six habits form a security baseline that protects the overwhelming majority of users from the overwhelming majority of threats. None of them cost money, and together they take less than five minutes a week. The only thing they cost is attention — and in 2026, attention is the best security tool you have.

Found this guide useful?

Share it with a family member or friend who uses digital wallets — the person most likely to fall for an OTP scam is often someone who was never told what an OTP scam looks like. Browse more practical finance and safety guides at BandhuFintech, and check our NEPSE Mobile Trading Setup Guide if you're also investing in Nepal's stock market.