Pakistan’s Banks Put on Alert
Pakistan’s banks and sensitive institutions are on high cybersecurity alert after the country’s National Cyber Emergency Response Team (NCERT) warned of a rising threat from artificial intelligence-driven cyberattacks. The warning, issued in an advisory dated November 5, 2026, covers financial institutions as well as the operators of critical infrastructure, from power grids to water supplies.
The advisory, titled “Emerging AI-Enabled Cyber Threats Targeting Financial Institutions and OT/Critical Infrastructure”, was issued by NCERT Director General Dr Haider Abbas and addressed to senior officials across NADRA, the State Bank of Pakistan, the Pakistan Telecommunication Authority, the Federal Board of Revenue, provincial chief secretaries and Safe City authorities.
It does not report a specific attack. It warns that the growing use of AI, automated bots, botnets and agentic tools is making cyberattacks faster, broader and harder to detect, and it urges banks and infrastructure operators to strengthen their defences now. That distinction matters, because social media has already begun exaggerating the warning into claims of breaches and shutdowns that have not happened.
What Exactly Did NCERT Warn About?
According to the advisory, hackers and criminal groups are increasingly using AI tools to speed up every stage of an attack: finding weaknesses in systems, stealing login details, and launching coordinated attacks on a much larger scale than before. Automated bots can try thousands of logins in minutes, while agentic AI tools can carry out multi-step attacks with little human direction.
For banks, the advisory names four main targets: core banking systems, digital banking platforms, payment systems and customer-facing applications. It warns of three specific risks: disruption of online banking services, automated credential attacks on customer accounts, and manipulation of the account balances displayed to customers in banking apps.
That last risk is the most unusual. NCERT cautioned that attackers could alter the balances customers see on screen, potentially triggering confusion and panic among account holders even when the underlying funds remain unchanged. The warning is about what customers see, not about money disappearing from the system.
The advisory also lists warning signs that banks should watch for: frequent automated login attempts, repeated authentication failures, credential stuffing, abnormal API requests, unauthorised changes to application settings, and irregular transaction patterns. Banks have been advised to review the security of core banking systems, APIs, third-party integrations, payment gateways and digital banking applications.
Why Critical Infrastructure Is Included
The warning goes well beyond banking. The same advisory covers operational technology, the computer systems that run physical processes such as valves, pumps and power grids. The sectors named are oil and gas facilities, water supply networks, power generation and transmission systems, industrial operations, manufacturing and transport infrastructure.
Financial services and operational technology systems were singled out because a successful breach could have serious financial, commercial and physical consequences. An attack on a bank can steal money or data; an attack on a power grid or water system can switch off essential services.
To illustrate the point, the advisory cited recent cyber incidents involving European supermarkets, where attacks on connected refrigeration and freezer systems showed how compromising operational systems can cause real physical and commercial damage. However, it clarified that AI involvement in those European incidents has not been confirmed, so they are an example of what connected-system attacks can do, not proof of an AI-driven campaign.
NCERT’s recommendations for infrastructure operators include separating operational networks from regular IT systems, limiting the internet exposure of connected industrial devices, monitoring for bot-driven attack attempts, and maintaining the ability to respond quickly when an incident occurs.
What the Advisory Does Not Say
It is important to be clear about what has and has not happened. The advisory does not name any Pakistani bank or institution as a victim of an attack. It does not name a threat actor or a country behind the threat. It gives no timeline for an attack and confirms no breach of any system.
That has not stopped alarming claims from spreading online. One viral video claims banks were shut down and gives an example of Rs1 million being altered in an account, but those claims do not appear in the advisory and are not supported by any official statement. Another message circulating on social media warns that ATMs will be closed for two to three days because of a ransomware attack affecting 74 countries.
That ATM message is an old hoax. Similar warnings have been circulating since 2016, and fact-checking has repeatedly found them unfounded. There has been no official confirmation or warning from the State Bank of Pakistan or any bank about a ransomware attack or ATM closures, and banks have confirmed that ATMs remain fully operational and digital transactions are proceeding without interruption.
The advisory is, in short, an advance warning. It tells institutions to prepare for a threat that is growing, not that an attack has already succeeded.
The Wider Context: Over 1,000 Attacks in 2026
The warning comes against a background of heavy cyber activity against Pakistan. NCERT Director General Haider Abbas told the parliamentary IT committee on November 3 that Pakistan has faced more than 1,000 cyberattacks in 2026, underlining why the advisory treats the threat as urgent rather than theoretical.
Banking customers in Pakistan also face a separate, everyday threat that the State Bank has warned about repeatedly: fake banking apps. Fraudsters distribute fake Android app files outside the Google Play Store that copy real bank logos to steal logins, CNIC numbers and one-time passwords. The State Bank has urged customers to download apps only from the Google Play Store or their bank’s official website, and never to install an app file sent through a link or message.
The State Bank has also warned customers never to share account PINs, passwords or card details with anyone, and has noted that genuine banking alerts come from the bank’s designated SMS short code, typically a four-digit number, rather than from a private mobile number. A bank never asks for such details through a phone call or text message.
What Banks Have Been Told to Do
NCERT has advised financial institutions to enforce multi-factor authentication, regularly reconcile the balances shown to customers against core banking records, review third-party integrations and payment gateways, and monitor automated login attempts and unusual transaction patterns in real time.
IT administrators have been advised to set up real-time alerts for unauthorised application configuration changes and unusual transaction patterns, and institutions have been urged to conduct immediate readiness assessments against bot-driven AI attack methods.
The advisory carries no binding enforcement or budget of its own. Its force depends on the institutions themselves acting on it, and on the State Bank’s own mandatory audit and reporting requirements for banks. What it does provide is a clear, dated statement of the threat from the country’s official cyber emergency team, which banks and regulators can now be measured against.
What Customers Should Do
For ordinary account holders, the advice is to stay alert, not afraid. There is no confirmed breach and no reason to panic-withdraw money, which is exactly the reaction the advisory warns attackers could try to provoke by manipulating displayed balances.
Practical steps are straightforward: turn on two-step verification for banking apps, never share an OTP, PIN or password with anyone, do not click unknown links or open suspicious files, and download banking apps only from the official store or the bank’s website. If an account balance ever looks wrong, check it against the bank’s official helpline or branch rather than trusting a screenshot or a social media post.
If money or account details have been shared with a scammer, the advice is to inform the bank immediately through its official helpline and to report the fraud to the FIA Cyber Crime Wing or the National Cyber Crime Investigation Agency through its official reporting channels.
What Happens Next?
The advisory puts Pakistan’s banks and utilities formally on notice. What matters now is whether institutions act on it: tightening authentication, watching for automated attacks, and making sure the balances customers see match the records in their core systems.
For the public, the story to watch is not a single dramatic hack, but whether the warning turns into visible improvements in banking security, and whether the alarming rumours circulating online fade as the facts become clear. The threat NCERT describes is real and growing, but so far it remains a warning, and the best response to a warning is preparation, not panic.
Disclaimer: This article is based on reports from Aaj News, Business Recorder, Dawn, 24NewsHD and Bloom Pakistan as of November 7, 2026, and on the National CERT advisory dated November 5, 2026. The advisory is a warning about emerging threats; it does not confirm any specific breach, victim or attacker. This is not financial advice.
