How to Safely Recover a Hacked Mobile Banking Account

Financial fraud through hacked mobile banking and wallet accounts has become one of the fastest-growing categories of cybercrime in Nepal, with police recording thousands of financial fraud complaints in a single fiscal year and a clear, documented trend toward account hacking and OTP theft as the method of choice. If you suspect your mobile banking account has been compromised, the first hour matters more than almost anything else you do afterward. This guide walks through exactly what to check, what to do immediately, how to work with your bank to recover your account safely, and how to report the incident properly so it is investigated and, ideally, does not happen again.

Signs Your Account May Be Compromised

Not every unusual notification means your account has been hacked, but a few warning signs deserve immediate attention rather than a "check it later" response:

• Transactions you did not make, even small ones, since fraudsters sometimes test an account with a tiny transaction before attempting a larger withdrawal.
• An OTP arriving when you did not initiate any transaction, which usually means someone else has your username and password and is actively trying to complete a login or payment.
• Login notifications from an unfamiliar device or location that you did not authorize.
• Your mobile banking app suddenly logs you out, or your password stops working without you having changed it, which can indicate someone else has already reset your credentials.
• Your SIM card suddenly loses signal unexpectedly, particularly if you had no reason for a service disruption, since this can indicate a SIM swap attack where a fraudster has convinced your telecom provider to transfer your number to a new SIM card under their control.
• Unfamiliar linked devices or beneficiaries appearing in your account settings that you did not add yourself.

Immediate First Steps: Block Your Card and Freeze Your Account

The moment you suspect unauthorized access, speed matters more than a perfectly organized response. Work through these steps as quickly as you reasonably can:

1. Call your bank's 24/7 customer service or fraud hotline immediately, not just during business hours. Every major bank and licensed digital wallet in Nepal maintains an emergency contact line specifically for this scenario, and this single call is the fastest way to freeze further activity.
2. Request an immediate block on your debit or credit card if a card is linked to the compromised account, which most banks can do instantly over the phone without requiring you to visit a branch first.
3. Ask the bank to temporarily suspend online and mobile banking access on the affected account while the situation is investigated, cutting off the attacker's ability to initiate further transactions even if they still have your login credentials.
4. If you suspect a SIM swap, contact your telecom provider immediately as well, since regaining control of your phone number is often just as urgent as freezing your bank account, given that OTPs are typically sent to that same number.
5. Do not attempt to log in repeatedly yourself while troubleshooting, since some systems temporarily lock an account after multiple failed or suspicious login attempts, which can complicate the bank's own recovery process.

Step-by-Step: Contacting Your Bank for Recovery

1. Call the fraud or customer service hotline and clearly explain that you believe your account has been compromised, providing your account details and any specific unauthorized transactions you have identified.
2. Follow up with a written complaint, either through the bank's official email, its in-app support system, or in person, since most banks require a formal written report before initiating a full investigation or reversing unauthorized transactions.
3. Visit your branch in person if requested, bringing your citizenship certificate or other government-issued ID, your account documents, and your phone, since some recovery steps require in-person identity verification that cannot be completed over the phone.
4. Provide a detailed timeline of what you noticed and when, including screenshots of suspicious notifications, unauthorized transaction alerts, or unfamiliar login activity, since this speeds up the bank's internal investigation considerably.
5. Ask specifically about a dispute or chargeback process for any unauthorized transactions, since banks generally have a formal process for disputing fraudulent charges that is separate from simply reporting the account as compromised.
6. Get a reference or complaint number for your case, and keep it along with the name of whoever you spoke with, since you will likely need this reference when reporting the incident to the Cyber Bureau afterward.
7. Ask when and how your account access will be restored, and what additional verification, if any, will be required before you can resume normal use of your mobile banking.

Resetting Credentials Securely After Recovery

Once your bank confirms your account is secured and access is being restored, take the following steps before resuming normal use:

• Create a completely new password, not a variation of your old one, and avoid reusing this password on any other account, particularly email or social media accounts that might otherwise be used to help reset your banking credentials.
• Change your mobile banking MPIN separately from your password, since these are often two distinct credentials, and both need to be refreshed after a suspected compromise.
• Enable biometric login, such as fingerprint or face recognition, where available, adding a layer of protection that is considerably harder for a remote attacker to bypass than a password alone.
• Review and remove any linked devices you do not recognize from your account's device management settings before considering the account fully secured.
• Check and remove any unfamiliar saved beneficiaries or linked bank accounts that may have been added without your knowledge during the compromise.
• Update your recovery email and phone number if there is any possibility the attacker gained access to either, since these are often used as backup verification channels.
• Avoid resetting your credentials over public WiFi, doing this instead over your own mobile data or a trusted home network to reduce the risk of a repeat compromise during the reset process itself.

Reporting the Incident: Your Bank and the Cyber Bureau

Beyond securing your account, formally reporting the incident matters both for your own recovery of any lost funds and for helping authorities track broader fraud patterns. In Nepal, financial account hacking falls under the Electronic Transactions Act 2063, which covers unauthorized access and computer fraud as criminal offences, alongside provisions in the Banking Offence and Punishment Act 2064.

1. File a formal written complaint with your bank first, since this creates an official record and is often a prerequisite for the bank's own internal fraud investigation and any potential fund recovery.
2. Report the incident to the Cyber Bureau of Nepal Police, the specialized unit handling exactly this category of crime, located at Bhotahiti, Kathmandu, with the ability to also accept complaints through district police offices nationwide.
3. File online through the Cyber Bureau's official complaint portal if visiting in person is not immediately possible, or submit your complaint by email if you have all your supporting evidence ready to attach.
4. Prepare your evidence in advance, including screenshots of unauthorized transactions, any suspicious messages or calls you received, your bank's complaint reference number, and a clear written timeline of events.
5. Bring a valid ID such as your citizenship certificate, national ID, or passport when filing in person, since identity verification is required for a formal complaint to proceed toward investigation.
6. Act quickly rather than waiting, since digital evidence, including transaction trails and fraudulent account activity, becomes considerably harder to trace the longer a report is delayed.

Nepal Police data shows financial fraud complaints reaching the thousands annually, with account hacking and OTP-based theft specifically identified as an increasingly common method. Reporting your case, even if the amount involved feels small, contributes directly to how seriously and quickly these patterns get investigated at a national level.

Preventing Repeat Incidents

• Never share your OTP with anyone, regardless of how convincing the caller sounds, including someone claiming to be from your bank, eSewa, Khalti, or any other financial service. No legitimate representative will ever ask for your OTP over the phone.
• Be suspicious of unexpected APK download links shared through social media or messaging apps, especially those promising free access to major events, since fraudsters have specifically used this tactic to install malicious apps that intercept OTPs and banking credentials.
• Verify unfamiliar contact through official channels only, calling your bank's published customer service number directly rather than a number provided to you in a suspicious message or call.
• Enable transaction alerts for every transaction, no matter how small, so you notice unauthorized activity within minutes rather than days.
• Avoid conducting banking transactions over public WiFi networks, which are considerably easier for an attacker to intercept than your own mobile data connection.
• Keep your banking apps updated to the latest version, since updates frequently include security patches addressing vulnerabilities that fraudsters actively look to exploit.
• Set up a SIM lock or PIN with your telecom provider specifically to make an unauthorized SIM swap considerably harder for someone to execute using only your basic personal details.

Frequently Asked Questions

What is the very first thing I should do if I suspect my account is hacked?

Call your bank's fraud or customer service hotline immediately to request an account freeze and card block, before doing anything else, since speed is the single biggest factor in limiting further unauthorized activity.

Can I get my money back after an unauthorized transaction?

It depends on the specific circumstances and how quickly you report the incident. Banks typically have a formal dispute process for unauthorized transactions, and filing both a bank complaint and a Cyber Bureau report improves your chances of recovery.

Do I need to file a police report, or is contacting my bank enough?

Both matter. Your bank's internal process handles account security and potential fund recovery, while a Cyber Bureau report creates a formal legal record and supports broader investigation into the fraud, which can matter for both your case and preventing further incidents involving the same perpetrators.

How do I know if I've been targeted by a SIM swap attack?

A sudden, unexplained loss of mobile signal, especially alongside banking notifications you did not initiate, is the clearest sign. Contact your telecom provider immediately to check whether your number has been transferred to a different SIM card without your authorization.

Key Takeaways

• Act within the first hour: call your bank's fraud hotline immediately to freeze your account and block any linked cards.
• Follow up your phone call with a formal written complaint to your bank, and get a reference number for your case.
• Reset every credential, password, MPIN, and linked devices, once your bank confirms the account is secured, and never reuse your old password.
• Report the incident to the Cyber Bureau of Nepal Police, either online, by email, or in person at Bhotahiti, Kathmandu, bringing your ID and evidence.
• Never share an OTP with anyone, and treat unsolicited APK download links or unexpected calls "from your bank" with immediate suspicion.