A Class 9 student in Lahore receives a WhatsApp message: "Congratulations! You have won Rs. 50,000 in the lucky draw. Send Rs. 500 processing fee via JazzCash to claim." A gamer in Karachi is offered free game currency if he logs in through a link that looks exactly like his game's website. A student in Islamabad gets an SMS claiming her bank account will be blocked unless she shares a code. These are not rare stories in Pakistan in 2026 — they are everyday messages landing on teenagers' phones, and they work because they exploit excitement, fear, and trust. This guide names the online scams targeting Pakistani students, teaches the red flags, and explains what to do when a scam succeeds.
An important framing first: falling for a scam is not stupidity. Scammers are professionals who test their messages on thousands of people and refine whatever gets clicks. Teenagers are targeted precisely because they are online constantly, they trust messages from familiar-looking numbers, and they often have access to a parent's phone or wallet. The defence is not fear — it is recognition. A student who can spot five red flags in ten seconds is safer than a student who has simply been told "be careful online."
The Scams Actually Reaching Pakistani Teenagers
The most common scam is the fake prize or lucky draw message, usually on WhatsApp or SMS. It announces a large win — cash, a phone, a motorcycle — and asks for a small "processing fee," "tax," or "delivery charge" via JazzCash or Easypaisa before the prize is released. Real lotteries and real companies never ask winners to pay to receive a prize; the fee is the entire scam, and once paid, the scammer disappears or invents another fee. A close cousin is the fake job or scholarship message: "You have been selected for a scholarship — pay Rs. 1,000 registration fee." Genuine scholarships in Pakistan do not charge selection fees, and any message demanding payment for a scholarship should be treated as fraud.
A second family of scams is impersonation. A scammer copies a school's name, a teacher's photo, or a bank's logo and messages students or parents asking for urgent payments — "school fee account changed, send this term's fee to this new number" — or for verification codes. Parents have lost real money to fake fee-change messages, so schools must announce clearly that fee account details never change via a random WhatsApp message. A third family is phishing links: messages claiming a parcel delivery, a bank alert, or a social media security warning, linking to a fake login page that steals passwords. Students should know that banks and genuine platforms never ask for passwords or one-time codes by message or call — anyone asking for a code is, by definition, a scammer.
Red Flags Every Student Can Memorise
Teach students a short checklist they can run in seconds. One: urgency — "act now," "account closing in one hour," "offer expires tonight." Scammers rush victims because a calm victim checks. Two: payment to receive something — any prize, job, or scholarship that requires an upfront fee is fake. Three: requests for codes — no genuine bank, wallet provider, or platform ever asks for your PIN, password, or one-time code by message or call. Four: strange numbers and links — a message from an unknown personal number claiming to be a bank, or a link with a misspelled brand name or odd domain, should never be trusted. Five: too good to be true — free game currency, doubled money, or a prize for a competition the student never entered.
A practical classroom exercise makes these flags stick: show students five real-style scam messages (with personal details removed) and five genuine messages, and ask them to sort them. Students are usually shocked by how convincing the fakes look, which is exactly the lesson — the defence is the checklist, not gut feeling. Schools should also run the same exercise for parents through a WhatsApp message, because many scams target parents through their children's school connections. The same awareness habits that protect against online bullying and harassment — pausing, checking the source, and telling a trusted adult — protect against scams too.
The Five-Second Rule
Gaming Account Theft: How It Happens
Gaming is a major scam channel for Pakistani students because accounts hold real value: rare skins, purchased items, and linked payment methods. The most common trick is the fake login page — a link promising free currency, a tournament entry, or a "pro" reward that leads to a page mimicking the game's login screen. The student enters their username and password, and the scammer takes over the account within minutes, changing the password and selling or stripping the items. Another trick is the "account trade" or "free skin" offer from a stranger in game chat, which ends with the student handing over login details or sending items first and receiving nothing.
The defences are straightforward and worth teaching explicitly. Never log in through a link sent by message or chat — always open the game or its official app directly. Turn on two-factor authentication wherever the game offers it, so a stolen password alone is not enough. Never share login details with anyone, including friends and supposed game moderators — real staff never ask for passwords. And never link a parent's card or wallet to a game account without a clear agreement about spending limits, because a compromised account can then become a financial loss, not just a lost game profile. Parents who do not game themselves should still ask their children which games they play and whether two-factor authentication is switched on — that single question prevents most gaming theft.
What to Do After Clicking a Bad Link
Despite every precaution, students will sometimes click. What matters then is speed and honesty, not shame. Step one: do not enter any further information, and close the page. Step two: if a password was entered, change it immediately from the official app or website — not through any link in the suspicious message — and change the same password anywhere else it was reused. Step three: if a wallet or bank code was shared, or money was sent, tell a parent immediately and contact the wallet provider or bank's helpline to freeze or report the transaction; the sooner the report, the better the chance of blocking further loss. Step four: if the scam arrived on WhatsApp, report and block the number so it cannot target classmates.
Step five is the one adults most often get wrong: respond without anger. A teenager who is shouted at for clicking a scam link will hide the next one, and the next one may cost far more. Praise the honesty of reporting, deal with the practical steps first, and discuss the lesson only after the damage is contained. Schools should adopt the same tone: a student who reports a scam message circulating in a class group should be thanked, not embarrassed, because that report may protect thirty classmates. Consider keeping a simple school log of scam messages seen by students — with screenshots and sender numbers removed or anonymised — so patterns can be shared with parents through the school's normal parent communication channels.
Reporting Scams and Talking About Them
Reporting matters beyond the individual case. In Pakistan, cybercrime complaints can be made to the Federal Investigation Agency's Cybercrime Wing, and wallet providers and banks each have fraud helplines for reporting unauthorised transactions. For most school cases, the realistic steps are: report and block the number on WhatsApp, report the transaction to the wallet provider or bank, and inform the school so a warning can go to other parents — ideally under the school's existing child protection policy, which should cover online harm as well as physical safety. Keep screenshots of the message, the number, and any transaction receipts — they are the evidence, and deleting them in embarrassment helps only the scammer. Even if money cannot be recovered, the report helps providers block the scammer's accounts.
The deeper fix is cultural: scam awareness should be a normal, recurring topic in schools, not a one-off assembly after someone loses money. A ten-minute slot each term — new scam examples, the red-flag checklist, a reminder of the five-second rule — keeps the knowledge fresh as scams evolve. Teachers should also talk about the emotional tricks directly: scammers exploit excitement about prizes, fear about accounts closing, and trust in familiar names. Naming those tricks out loud weakens them, because a student who recognises "this message is trying to rush me" is already halfway to ignoring it. The goal is not to make students afraid of their phones; it is to make them sceptical of strangers who want their money or their codes — a scepticism that will serve them for life.
AI Help: Muse AI
Muse AI is Meta's personal AI assistant, available in the Muse app. A student or parent can ask it to explain the warning signs of a suspicious message in simple words, or to help draft a clear warning message to share with a class group. Join Muse with invite code LTGSWD — in the Muse app, go to Settings > Redeem token and enter the code.
Disclosure: LTGSWD is the author's Muse invite code.