Kathmandu — Digital payments, mobile banking and e-commerce transactions rise sharply in Nepal during the festive season. Cybercriminals know this too, and they use the surge to run phishing campaigns, payment scams, ransomware and Distributed Denial-of-Service (DDoS) attacks against banks, payment providers and everyday users.

To address these risks, the Information Security Response Team Nepal (npCERT) has issued Cybersecurity Advisory 2026 (Ref: npCERT/2025-26/IS/006), urging financial institutions, payment gateways and consumers to stay alert throughout Tihar and the wider festive season. This article summarises the advisory's key recommendations.

Essential Security Controls for Financial Institutions and Payment Providers

The advisory asks all Banks and Financial Institutions (BFIs), Payment System Operators (PSOs), Payment Service Providers (PSPs) and Application Service Providers to put the following controls in place:

1. 24/7 SOC Monitoring: Maintain round-the-clock Security Operations Center monitoring to detect transaction anomalies, unusual traffic spikes and unauthorised access attempts immediately.
2. Advanced Phishing and Email Filtering: Use URL sandboxing and strict email security controls to block fraudulent messages offering fake festive cashback, discounts or employee bonuses.
3. Patch Management and App Protection: Promptly patch servers, network devices and VPNs. Make sure mobile banking apps use up-to-date SDKs and Runtime Application Self-Protection (RASP).
4. Anti-DDoS Defences and Offline Backups: Coordinate with Internet Service Providers to activate DDoS mitigation, and maintain isolated, offline (air-gapped) backups so you can recover quickly from a ransomware incident.
5. Real-time Fraud Detection: Tune fraud detection systems to instantly flag high-value or geographically unusual transactions, so accounts can be frozen quickly.
6. Holiday Incident Readiness: Keep incident response teams on call during public holidays, freeze non-critical changes, and report incidents to npCERT and the relevant regulator promptly.

Safety Tips for Online Banking and Digital Wallet Users

1. Beware of Fake Festive Offers

Do not click suspicious links received via SMS, email, WhatsApp, Viber or social media that promise lottery wins, free festive gifts or unrealistic cashback. Never install .APK files sent through messages; download apps only from the official Play Store or App Store.

2. Keep Your OTP, PIN and Passwords Private

Legitimate banks and wallet providers such as eSewa, Khalti and ConnectIPS will never ask for your One-Time Password (OTP), PIN or login credentials over a phone call, SMS or social media.

3. Verify Before Every QR Payment

Before completing a QR payment, check that the merchant name shown on your screen matches the business you are paying. Remember: you never need to scan a QR code or enter your PIN to receive money. Merchants should confirm payments in their own merchant app, not from a customer's screenshot.

4. Watch Out for Impersonation and Remote-Access Fraud

Fraudsters often pretend to be bank staff, wallet support, telecom operators or even police officers. npCERT, Nepal Police, banks and wallet providers will never ask you to install remote-access apps such as AnyDesk or TeamViewer, or to transfer money to "secure" your account. If a family member urgently asks for money, call them back on the number you already have saved to confirm.

5. Avoid Payments over Public Wi-Fi

Do not log in to mobile banking or make online payments over open Wi-Fi networks in cafés, parks or transport hubs. Use mobile data or a trusted network instead.

How to Report a Cyber Incident

If you notice suspicious activity, receive a phishing link or fall victim to online fraud, act immediately:

• Contact your bank or wallet provider straight away to block the transaction or freeze your account.
• Report the incident to the Nepal Police Cyber Bureau: Phone 01-5319044 or toll-free 16600141516, email cyberbureau@nepalpolice.gov.np, or visit the Cyber Bureau office at Bhotahity, Kathmandu, or your nearest District Police Office.
• Change any passwords that may have been exposed.
• Keep evidence: screenshots, transaction IDs, the fraudster's phone number or URL, and the time of the incident.

Stay Alert, Celebrate Safely

Festivals are a time for family and celebration, so don't let fraudsters take advantage of the busy season. Share these tips with your family members, especially elderly relatives, who are often targeted by scammers.

At One Cover Pvt. Ltd., we help organisations across Nepal strengthen their security through Vulnerability Assessment and Penetration Testing (VAPT), security audits and awareness training. To assess your organisation's readiness, contact us at info@onecovernepal.com.

— One Cover Team