As of 29 October 2026 (12 Kartik 2083). We checked the Nepal Rastra Bank home page and press-release listing (no October 2026 fraud notice is posted there), the Nepal Police Cyber Bureau site, the Ministry of Home Affairs holiday list for 2083, and reporting of the NRB advisories by Onlinekhabar English (16 Oct 2026), Insurance Khabar (16 Oct 2026), ShareSansar (14 and 20 Oct 2026) and Republica (15 Oct 2026). Figures on complaints come from The Himalayan Times (14 Aug 2026) and The Rising Nepal (13 Aug 2026). Nothing after 29 October 2026 is known to us.
A festival offer scam in Nepal follows the calendar. Dashain brought the “Dashain dhamaka” links; the week before Tihar brings “Tihar-Chhath bumper” prizes, cashback messages and bank “KYC blocked” calls. Between 14 and 20 October 2026, Nepal Rastra Bank (NRB) issued three separate warnings about exactly this pattern: a directive to banks, a directive to wallet and payment companies, and a public advisory from its Financial Intelligence Unit. This post explains what each one said, what the live scam scripts look like, and a verification routine you can use before Laxmi Puja on 8 November.
Quick answers
| Question | Short answer |
|---|---|
| Did NRB really issue a festival fraud alert? | Yes. Directives to banks and payment companies were reported on 14 Oct 2026; an FIU public advisory was reported on 16 Oct 2026; a further public alert was reported on 20 Oct 2026. |
| Tihar holiday dates 2083 | Kartik 22 to 26, 2083 (8 to 12 November 2026), per the Ministry of Home Affairs list. Chhath is Kartik 29 (15 November). |
| Will a bank ever call you for an OTP, PIN or password? | No. NRB’s 20 Oct alert says banks never ask for these by phone. |
| Do you need to scan a QR code to receive money? | No. Scanning is for paying. “Scan to receive” is a scam script named in the NRB alert. |
| Where to report | Your bank or wallet first (to freeze), then the Nepal Police Cyber Bureau (cyberbureau@nepalpolice.gov.np, 01-5319044, toll-free 16600141516) or the nearest police office. |
| Cybercrime complaints last fiscal year | 20,526 in FY 2082/83, about 56 a day (Nepal Police figures via The Himalayan Times and The Rising Nepal). |
What NRB said, and when
The three NRB actions came within one week. Here is our reading of each, based on the news reports listed in the sources.
| Date reported | Who it targets | What it requires or advises |
|---|---|---|
| 14 Oct 2026 (ShareSansar, Republica 15 Oct) | Banks and financial institutions | Name a focal person for electronic fraud cases, give transaction details quickly, and put suspicious accounts on hold during the Vijaya Dashami, Deepawali and Chhath 2083 holidays. Send the focal person’s name, designation, mobile number and a 24/7 monitored email to the Cyber Bureau. |
| 14 Oct 2026 (ShareSansar) | Payment System Operators and Payment Service Providers (wallets, switches, gateways), via NRB’s Payment Systems Department | The same focal-person arrangement for wallets, plus a duty to identify and block or hold suspicious wallets and transactions during the holidays. |
| 16 Oct 2026 (Onlinekhabar English, Insurance Khabar) | The public, banks and online service providers | The Financial Intelligence Unit (FIU) said its analysis of banking transactions shows online fraud rising, and that festival periods bring more account openings, digital payments and e-commerce. It named four scam types (below) and gave safety rules. |
| 20 Oct 2026 (ShareSansar) | The public | NRB urged people not to open festival offer links from unknown sources, not to respond to “account blocked” messages, never to share OTP, username, password or PIN, and warned about “scan this QR to receive money” scams. |
For customers, the 14 October directives mean that during the long holiday your bank has a named person whose job is to answer a fraud call and freeze money. Republica reported that police receive roughly 200 to 300 financial fraud complaints a day, and that delays in freezing funds are the main obstacle to recovery.
We could not find the directive or advisory text on nrb.org.np itself on 29 October 2026; the NRB home page lists only monetary and procurement notices for October. The wording above is from the news reports, attributed accordingly.
The four scam patterns NRB named
The FIU advisory (as reported on 16 October) describes four schemes. We have added how each usually appears on a Nepali phone.
1. Fake festival offer and lottery links
The message says you have won a “Dashain dhamaka”, “Tihar-Chhath bumper” or a brand-name lucky draw. To “release” the prize you are asked to pay a service charge, tax or courier fee, usually by wallet transfer or by entering card details on a page. The prize does not exist; the fee is the theft. A second version asks you to log in to “claim” the prize on a cloned bank or wallet page.
2. Phishing pages that threaten account closure
You receive an SMS, WhatsApp or Viber message saying your mobile banking, wallet or ConnectIPS account will be blocked unless you “update KYC” through a link. The Rising Nepal reported this exact ConnectIPS impersonation in August 2026. The link opens a page that looks like the real app and asks for username, password and the OTP that arrives a moment later. With those three items the scammer logs in as you.
3. Fake online shops with festival discounts
Social media ads show branded shoes, phones or sarees at half price for Tihar, with payment demanded in advance. After the transfer the page blocks you or the goods never arrive. NRB’s advice is to pay in advance only on official, trusted websites and to choose pay-on-delivery with unfamiliar sellers.
4. Accounts opened with other people’s documents
Criminals open bank or wallet accounts using someone else’s citizenship copy, photo or forged papers, then route stolen money through them. That is why NRB told banks to verify identity carefully for digital account opening and to watch for several accounts sharing one address or phone number. For you, it is a reason never to send a citizenship photo to an unknown “recruiter” or “prize office”.
Two more scripts to expect this week
NRB’s 20 October alert added two scripts that spike during festival shopping.
The “account blocked” call. Someone claiming to be from your bank’s “head office” says your account is frozen and can be unblocked if you confirm the OTP they just sent. That OTP is the code for a transfer or password reset the caller has started on your account. Banks never ask for OTP, PIN or password over the phone. Hang up and call the bank’s official number.
“Scan this QR to receive your money.” A marketplace buyer or “cashback agent” says they are sending you money and you only need to scan their QR and enter your PIN to “accept” it. In Nepal’s QR system, scanning and entering a PIN is how you pay; nobody needs your PIN for money to arrive. At shops, read the merchant name shown on your app before confirming, because a QR sticker can be replaced.
A one-minute verification routine before you tap
- Check the sender, not the message. Real bank SMS in Nepal comes from a short sender ID, not a 98XXXXXXXX number. A WhatsApp or Viber message with a bank logo is not from the bank.
- Read the full web address. Tap and hold the link to see the actual URL. Your bank’s domain ends in its own name and “.com.np” or “.com”; anything with extra words, hyphens or a different ending is not it.
- Ask who gets the money. If an offer requires you to pay first (tax, fee, courier, “activation”), it is a scam by definition. Legitimate prizes do not need your advance payment.
- Open the app yourself. If a message says your KYC is incomplete or your account is blocked, close it and open the official app from your home screen or call the official helpline. Our guide to eSewa KYC verification shows what the real process looks like.
- Never type an OTP into a web page or read it aloud. OTPs belong only inside the app or site you opened yourself, for an action you started.
- Check the merchant name after scanning any QR. If the name on screen does not match the shop or person, cancel.
- Pay on delivery for unknown sellers. A seller who refuses pay-on-delivery for a “festival offer” has told you everything you need to know.
For the credentials side of this, our earlier post on OTP, PIN and password safety in Nepal goes deeper.
What to do in the first hour after clicking or paying
Money moved through a wallet or ConnectIPS can be forwarded to a second account within minutes; the 14 October directive exists so banks can hold it before that happens.
- Minute 0 to 5: cut the access. If you entered a password, change it immediately from the official app. If you entered card details, block the card in the app or call the bank. If you shared an OTP, call the bank’s 24-hour number at once and ask them to hold the account and reverse any pending transfer.
- Minute 5 to 15: tell the receiving side. Ask your bank or wallet to note the destination account or wallet number from your transaction history and to contact the receiving institution. Under the festival directive, each bank and wallet has a focal person for exactly this coordination.
- Minute 15 to 30: collect evidence. Screenshot the message, the link (with the full URL visible), the transaction receipt and the scammer’s number or profile. The Cyber Bureau requires URLs and clear screenshots with every complaint.
- Minute 30 to 60: file the complaint. Download the online financial fraud form from the Cyber Bureau site, fill it in Nepali or English, attach a copy of your citizenship, national ID, passport or licence, and submit it in person at any police office or by email to cyberbureau@nepalpolice.gov.np. Our step-by-step Cyber Bureau complaint guide covers the form.
- Same day: warn your contacts. If the scammer got into your Facebook, WhatsApp or wallet, your contacts are next. Post a short warning and change passwords on any account that shared the same password.
Keep every reference number you are given. If your SIM was involved, read our note on SIM swap fraud in Nepal, because a replaced SIM can defeat OTP protection entirely.
Why the festival window is different
Banks run on holiday staffing from 8 to 12 November, people shop and send dakshina digitally, and a message about a “Tihar bonus” feels normal rather than suspicious. Nepal Police counted 20,526 cybercrime complaints in FY 2082/83 (mid-July 2025 to mid-July 2026), up from 18,926 the year before, with 744 of them tied directly to eSewa, Khalti, bank accounts and SMS (Himalayan Times, 14 August 2026). Only 155 people were arrested in that year. Our reading: recovery depends on your first hour, not on an eventual arrest.
Nepal Police is also setting up an Anti-Scam Centre linking NRB, banks, wallets, ISPs and telecom companies; Republica reported on 15 October 2026 that the Home Ministry has approved the proposal, pending budget. Until it exists, the focal-person system is what you have.
Not sure a festival offer, link or call is real?
Digital Solution in Pokhara helps individuals and small businesses with safe KYC and portal form filling, digital-skills training and secure social media setup, so you know what the real process looks like before a scammer shows you a fake one. शंका लागे पहिले हामीलाई सोध्नुहोस्।
Frequently asked questions
Is the “Tihar bumper” SMS from my bank real?
Almost certainly not. Banks announce festival schemes on their official websites and apps, never through a link that asks for login details or a fee.
My bank called and asked for an OTP to “unblock” my account. Should I give it?
No. NRB’s 20 October 2026 alert states that banks do not ask for OTP, PIN, username or password by phone. End the call and ring the bank’s official number.
Someone wants me to scan a QR code so they can send me money. Is that how it works?
No. In Nepal’s QR payment system, scanning a code and entering your PIN makes a payment from your account. Money sent to you arrives without you scanning anything.
I paid a scammer through my wallet. Can I get it back?
Sometimes, if you act within minutes. Call the wallet or bank immediately so they can hold the receiving account, then file a Cyber Bureau complaint with screenshots. Nothing is guaranteed.
Where do I complain if I live outside Kathmandu?
Any district police office, ward or area police office or police circle accepts the Cyber Bureau complaint form, and you can also email it to cyberbureau@nepalpolice.gov.np. A citizenship copy and clear screenshots with URLs are mandatory.
When are the Tihar holidays this year?
Kartik 22 to 26, 2083, which is 8 to 12 November 2026, according to the Ministry of Home Affairs public holiday list. Chhath follows on 15 November.
Conclusion
Every festival offer scam in Nepal relies on one of three asks: pay a fee first, enter your login on a page you did not open, or scan and enter a PIN to “receive” money. NRB’s October 2026 alerts name all three. Refuse those asks, read merchant names and web addresses before confirming, and if something slips through, use the first hour to call your bank and then the Cyber Bureau. The holiday focal-person system means someone is on duty to freeze the money, but only if you call quickly.
Sources
- Onlinekhabar English, “Online fraud may rise during festivals, NRB urges public to keep OTPs and passwords confidential” (16 Oct 2026): https://english.onlinekhabar.com/online-fraud-rise-during-festivals.html
- Insurance Khabar, “Nepal Rastra Bank (NRB) has issued an advisory to be aware of online fraud” (16 Oct 2026): https://english.insurancekhabar.com/nepal-rastra-bank-nrb-has-issued-an-advisory-to-be-aware-of-online-fraud-2/
- ShareSansar, “Nepal Rastra Bank Urges Public to Stay Alert Against Digital Fraud During Dashain” (20 Oct 2026): https://www.sharesansar.com/newsdetail/nepal-rastra-bank-urges-public-to-stay-alert-against-digital-fraud-during-dashain-2026-10-20
- ShareSansar, “Nepal Rastra Bank Urges Banks to Strengthen Cyber Fraud Monitoring During Festive Holidays” (14 Oct 2026): https://www.sharesansar.com/newsdetail/nepal-rastra-bank-urges-banks-to-strengthen-cyber-fraud-monitoring-during-festive-holidays-2026-10-14
- ShareSansar, “NRB Directs Payment Service Providers to Strengthen Cyber Fraud Monitoring During Festive Holidays” (14 Oct 2026): https://www.sharesansar.com/newsdetail/nrb-directs-payment-service-providers-to-strengthen-cyber-fraud-monitoring-during-festive-holidays-2026-10-14
- Republica, “NRB directs banks to designate 24-hour contacts to curb cyber fraud” (15 Oct 2026): https://myrepublica.nagariknetwork.com/news/nrb-directs-banks-to-designate-24-hour-contacts-to-curb-cyber-fraud-42-13.html
- Nepal Police Cyber Bureau, Report Cyber Crime (accessed 29 Oct 2026): https://cyberbureau.nepalpolice.gov.np/report-cyber-crime/
- The Himalayan Times, “Cybercrime complaints top 20,000 in Nepal but only 155 arrests made” (14 Aug 2026): https://thehimalayantimes.com/nepal/cybercrime-complaints-top-20000-in-nepal-but-only-155-arrests-made
- The Rising Nepal, cybercrime complaints report (13 Aug 2026): https://risingnepaldaily.com/news/84941
- Pradhan Law, “List of Public Holidays, 2083 (2026/27)” summarising the Ministry of Home Affairs notice of 2 Mar 2026: https://pradhanlaw.com/publications/list-of-public-holidays-2083-202627
- Nepal Rastra Bank home page (checked 29 Oct 2026, no fraud notice listed for October): https://www.nrb.org.np/
This article is general information based on public sources as of 29 October 2026; it is not legal or financial advice. Contact your bank or Nepal Police directly in an emergency.
Rabin Paudel
Rabin Paudel is the Founder of Digital Solution, a Content Creator, and an AI Trainer. He shares practical and easy-to-understand content on Artificial Intelligence, Digital Literacy, Online Services, FinTech, and Technology. His mission is to make technology simple, accessible, and useful for everyone.
View all posts by Rabin Paudel →