Fake government websites posing as major Pakistani institutions are actively stealing citizen data, and the National Cyber Emergency Response Team (National CERT) wants every Pakistani online user to know about it right now. The agency’s Threat Intelligence Centre detected a coordinated phishing campaign on October 4, 2026, using websites that look almost identical to official government portals. The risk is real, and the domains are still live.
Which Fake Government Websites Were Found?
The scale of this campaign is wider than most people expect. National CERT’s Threat Intelligence Centre identified suspicious phishing domains using the names of the following institutions:
- NADRA (National Database and Registration Authority), including a domain called secure-login-nadra.com
- FBR (Federal Board of Revenue)
- FIA (Federal Investigation Agency)
- PTA (Pakistan Telecommunication Authority)
- HEC (Higher Education Commission)
- SECP (Securities and Exchange Commission of Pakistan)
- BISP (Benazir Income Support Programme)
- PM’s Youth Programme
- Directorate General Immigration and Passports
- Punjab Safe Cities, via a domain called secure-login-punjabsafecities.com
These are not minor, unknown portals. Scammers deliberately picked institutions that millions of Pakistanis interact with regularly for CNIC, tax, visa, and financial support services. That is exactly what makes this campaign so dangerous.
How Dangerous Are These Sites? The Threat Scores Say It All
National CERT did not just name these domains, it ranked them. The identified fake government websites scored between 87 and 99 percent on the agency’s threat monitoring platform. A score that high means the system is almost certain these are malicious. Most phishing sites try to look just credible enough to fool users for a few days before being shut down. The fact that these domains are still active after detection makes the risk even higher.
The fake NADRA domain, for example, was built to look like a secure login page, the kind of page where you might normally enter your CNIC number, password, or personal details. Once you type that in, the attackers have it. You would likely not notice anything wrong until your data is already misused.
One detail that stood out in the investigation: all the flagged domains were registered through NameCheap Inc., a US-based domain registrar. This tells us the attackers are using globally accessible, low-cost tools to run a campaign aimed squarely at Pakistani citizens.
Why This Matters More Than Ever in 2026
This is not an isolated event. Pakistan recorded 98 cyberattacks on government and public sector targets in just the first three months of 2026, with website hacking and data leaks being the most common types. Phishing and fake websites were also logged as separate, growing threat categories in that period.
As more Pakistanis go online for government services, checking FBR returns, verifying CNIC status, applying for BISP payments, the opportunity for scammers grows. People often trust a website that uses an institution’s name in its URL, especially if the page has a similar logo and layout. That trust is exactly what these fake government websites exploit.
It is also worth noting that this comes at a time when Pakistan’s digital payments ecosystem is growing fast, with more citizens linking their bank accounts and CNICs to online platforms. Any breach of personal identity data can have financial consequences well beyond a stolen password.
How to Protect Yourself Right Now
National CERT and cybersecurity experts advise the following steps:
- Check the URL carefully. Official Pakistani government websites end in .gov.pk. If a site uses .com, .xyz, .io, or any other extension while claiming to be a government portal, stop and leave immediately.
- Never enter your CNIC, password, or bank details on a site you reached through an SMS link, WhatsApp message, or email. Always open your browser and type the address yourself.
- Look for HTTPS in the address bar, but remember that HTTPS alone does not mean a site is real. Fake sites can also have HTTPS. The domain name still needs to match the official one.
- Bookmark official sites. For NADRA, the official portal is nadra.gov.pk. For National CERT alerts and advisories, visit pkcert.gov.pk.
- Report suspicious links to National CERT directly, and warn your family members who may be less familiar with online scams.
If you have already entered your details on any suspicious site, change your passwords immediately, alert your bank, and contact the relevant government department through its official helpline.
What National CERT Is Doing
National CERT, which was formally established in March 2024 under Pakistan’s Cabinet Division, said it is continuously monitoring threats involving fake government websites and institutional impersonation. The agency urged both citizens and government departments to stay alert to suspicious links, login pages, and unsolicited messages. This kind of coordinated action against cyber fraud is a sign that Pakistan’s cybersecurity infrastructure is maturing, but the attackers are moving fast too.
The agency has previously taken down nine fake NADRA-related domains in a joint operation between February and March 2026. That the threat has now expanded to over ten institutions shows the attackers are becoming bolder and more organised.
Frequently Asked Questions
How do I know if a government website is real or fake?
Always check that the web address ends in .gov.pk. Official Pakistani government sites use this domain. If the URL has words like ‘secure-login’ before the institution name, or uses .com/.xyz/.io, it is almost certainly fake. Do not enter any personal information on it.
What information are these fake sites trying to steal?
The phishing sites are designed to collect login credentials, CNIC numbers, passwords, identity details, and potentially financial information. This data can be used for identity theft, fraud, or to access other accounts you hold.
Which institutions had their names used by these fake sites?
National CERT found fake domains using the names of NADRA, FBR, FIA, PTA, HEC, SECP, BISP, the PM’s Youth Programme, the Directorate General Immigration and Passports, and Punjab Safe Cities. The campaign covers a very wide range of public services.
What should I do if I already entered my details on a suspicious site?
Change your passwords right away on any account that uses the same credentials. Contact your bank if you shared any financial information. Reach out to the relevant government institution through its official helpline, and report the incident to National CERT at pkcert.gov.pk.
