She called PakNet’s official helpline directly—not the number in the SMS, but the one printed on her old bank statement.

“Madam, we detected suspicious activity. Please confirm the 56789 code sent to you so we can block the transaction.”

She reported the number to the FIA Cyber Crime Wing. Three days later, they called back: her quick refusal had helped them trace a small ring operating out of a guesthouse in Gulshan-e-Iqbal. They’d been collecting verified numbers to drain digital wallets.

The ringleader, a 22-year-old who had learned spoofing from YouTube tutorials, had chosen “56789” simply because it was easy to remember.

She remembered her sister’s golden rule: No real agent ever asks for the code.