DIGITAL FINANCE / NEPAL / PUBLIC INTEREST

From eSewa and Hello Paisa to QR codes on almost every counter, Nepal’s payment story is a genuine achievement. A rising fraud threat is testing whether consumer protection can keep pace.

A reported public-interest feature • 31 October 2026 • Sources linked at the end

The first tap was a leap of faith

Before most Nepali people had smartphones, paying a bill meant cash, a counter and sometimes a queue. Banks introduced cards and ATMs earlier, but the real disruption arrived when payments began escaping the bank branch. F1Soft’s eSewa traces its launch to 2009, with a mobile application following in 2010. Its proposition was gloriously ordinary: recharge a phone, pay electricity, buy a ticket, send money—without leaving home.^[1]

Others saw the same opening from a different angle. Finaccess’s Hello Paisa proposed shared mobile-finance infrastructure for several banks, while Fonepay was emerging as an interoperable banking network. The GSMA described the promise of both in 2013: Nepal’s fragmented bank networks could pool their reach rather than each trying to build a nationwide system alone. Khalti’s creators were also experimenting with mobile services well before the wallet launched in 2017.^{[2] [3]}

Early digital finance was not a smooth parade of successful apps. It was a market discovering what people would actually use. Customers needed cash-in and cash-out points, merchant acceptance, recognizable brands, low charges and transactions that worked on modest phones. Platforms could win a software launch and still lose the battle for a viable agent network. Some projects stayed niche; others became infrastructure providers rather than consumer household names.

Donors helped pay for the difficult first mile

This was not a purely private-sector success story. USAID’s Nepal Economic, Agriculture and Trade (NEAT) project helped convene an early mobile-finance summit in 2012 and backed branchless and mobile banking work with Mega Bank and Laxmi Bank—including use of Hello Paisa. Its own 2013 account recorded more than 300 operational agents in 16 districts. That kind of support financed the unglamorous work: pilot rollouts, staff training, community demonstrations and lessons about what happens outside Kathmandu.^[4]

The GSMA’s Ecosystem Accelerator Innovation Fund awarded eSewa a grant in April 2017 to improve its agent application and extend services in eastern Nepal. UKaid’s Sakchyam–Access to Finance programme partnered with eSewa in 2019 on cash-point services. UNCDF’s work with Khalti to digitize neighbourhood businesses drew support from USAID and the International Labour Organization. These interventions did not guarantee winners; they reduced experimentation costs and improved financial inclusion where commercial returns were initially uncertain.^{[5] [6] [7]}

Equally indispensable were Nepal Telecom and Ncell. Their networks, airtime distribution and expanding mobile-data coverage created the route through which a payment application could reach the customer. They deserve credit for enabling this market, though the spread of connectivity should not be confused with proof that every household enjoyed reliable broadband or equal digital skills.

The crowded wallet market finds its shape

The wallet rush brought eSewa, Khalti, IME Pay, PrabhuPay, CellPay, QPay, Moru, Namaste Pay and many other names. Not all acquired comparable transaction volumes, merchant networks or loyal users. NRB’s July 2025 licensing list still showed 22 payment-service providers—but the sector had already begun consolidating: Khalti and IME Pay combined under IME Khalti, with Khalti continuing as the wallet brand. An app’s absence from popular conversation, however, does not by itself prove a business has closed.^[8]

What survived was less a clever slogan than a fit with local life: recharge and utility payments, domestic remittance, agent cash points, bus and air tickets, bills, QR acceptance and quick transfer into bank accounts. For years, mobile payments succeeded by working alongside cash, not by pretending cash had disappeared.

The QR sticker changes the street

Then the black-and-white QR square moved onto the vegetable stall, pharmacy counter, restaurant table and small-town shop. Fonepay’s QR rollout, NepalPay QR and other schemes helped make digital acceptance far cheaper than installing a card terminal. COVID-era shifts accelerated acceptance, while bank apps and wallets learned to speak to payment switches and to one another.^[10]

75.6m

QR transactions

81.2m

Mobile-banking txns

51.5m

Wallet transactions

0.94m

Card POS transactions

NRB’s latest available monthly figures: mid-August to mid-September 2026. Categories overlap and must not be added together. [9]

At mid-September 2026, NRB counted about 30.5 million mobile-banking subscriptions, 28.2 million wallet registrations and 13.8 million debit cards. These are accounts, subscriptions and cards—not unique individuals, and not proof that everyone is financially included. Yet the direction is unmistakable. Payments that were once novel are now part of daily life.^[9]

Plastic grew first, but the phone ran faster

Nepal’s card history matters because it shows the first generation of electronic-payment risk. Himalayan Bank traces its proprietary cards to 1993 and its first ATM to 1994; other NRB histories date the first operational ATM to 1995. Credit and debit cards expanded through ATMs, card networks and point-of-sale terminals. But the hardware, acquiring costs and merchant economics were more demanding than printing a QR sticker.^[10]

Cards brought their own scams: stolen PINs, skimmers, counterfeit cards and compromised ATM switching. In 2019, an ATM cash-out operation involving cloned cards and processing-system weaknesses shook Nepal’s banking industry, prompting temporary cross-bank restrictions and investigations. That was a lesson in technical system security, not merely in customers choosing better passwords.^[11]

Mobile and online fraud share the theft of identity and money, but their favourite doorway is different. Card fraud may involve physical credentials or compromised merchant and ATM infrastructure. Account-to-account scams increasingly rely on impersonation: a fake online store, urgent “KYC update”, screen-sharing request, manipulated OTP or a fraudulent receiving account. A single phone can provide both the conversation with the victim and the pathway to several accounts. Clicking a link alone does not usually empty a bank account; investigators must determine whether the attack involved captured credentials, malicious software, exposed authorization codes or another mechanism.^{[13] [19]}

The common story of loss, fraud and disappointment

Consider three incidents, which have not been independently verified against bank or police records: a young woman lost NPR 17,000 after a supposed TikTok trouser sale led to phone screen-sharing; a senior chartered accountant reportedly lost access to substantial savings after a caller posed as a bank employee updating KYC; and another woman discovered unauthorized withdrawals after what she remembered as a reassuring “fraud-awareness” phone call. Their circumstances differ; the manipulation of trust is common to all. And the issue a very close experience to a significant number of Nepali digital banking clients.

The young buyer was reportedly sent between local police and the Cyber Bureau and told a case below NPR 50,000 could not proceed. No publicly verified law or Bureau rule establishing such a minimum has been identified for this article; it would be wrong to present that amount as an established legal threshold. The Cyber Bureau’s published process does provide an online-financial-fraud complaint route. What remains is fraud call centers in each financial institution, asking client to provide police report, central bank grievance cell reporting, cyber crime bureau reporting, etc. to do anything beyond recognize and agree with the client that they have been a fraud victim.

But even an unverified account of being turned away raises the right institutional question: if small victims give up, who connects the small payments flowing into the same criminal network?^[15]

THE MISSING MIDDLE

A scammer persuades the victim to send or authorize money. The financial system then has a second chance: recognize unusual behaviour, spot a high-risk receiving account, slow the transfer, alert another institution and preserve a path to recovery. Fraud prevention cannot stop at “never share your OTP.”

When the money starts moving, it moves fast

FIU–Nepal’s 2024 strategic analysis describes criminals using multiple accounts across banks and payment providers, accounts opened shortly before suspicious activity, rapid layering and cash withdrawals. In short, the receiver may be only one link in a wider chain. A newly opened wallet or bank account becomes valuable to criminals if onboarding checks are weak and suspicious transfers are not challenged soon enough.^[13]

None of that proves that every institution is negligent or that every failed claim is the bank’s fault. Consumer-authorized payments induced by deception present different legal and operational issues from a transfer made after a technical account compromise. Still, an unfamiliar recipient, near-total balance drain, newly registered device, unexpected late-night activity or immediate onward movement are obvious candidates for risk-based friction. Good security is a collection of controls that work together—not a single OTP.

The law caught up—unevenly

Nepal’s regulatory path did not simply begin with a BAFIA clause and end there. Early electronic transactions and banking instructions were followed by NRB’s national payment-system strategy, payment licensing policies, and ultimately the Payment and Settlement Act, 2075 (2019), with its own bylaws and unified directives. BAFIA, 2073 (2017), chiefly governs banks and financial institutions; payment-system operators and non-bank wallet providers also sit within a separate payment-law framework. The distinction matters when asking who is liable for what.^[12]

NRB has since added oversight reporting, cyber-resilience guidance, consumer grievance channels, stricter onboarding expectations and supervisory examinations. Its 2023/24 oversight report nevertheless recorded failures among some providers—including poor governance, deficiencies in risk controls and transactions by users whose KYC had not been verified. These are findings by the regulator, not speculation about fintechs.^{[10] [12]}

Know-your-customer rules illustrate the trade-off between inclusion and integrity. Wallet providers published a limited NPR 5,000 transaction allowance for non-KYC customers; NRB later flagged such use as a possible avenue for misuse. Identification requirements have become progressively tighter, including moves to link wallet onboarding to national identity data. But it would be inaccurate to suggest that a fully verified KYC record has historically been a precondition for every minor digital transaction, or that checking a document alone reliably establishes the true controller of an account.^{[10] [25]}

Then comes the anti-money-laundering dimension. Nepal’s FIU receives suspicious-transaction information and analyses patterns, while FATF and the Asia/Pacific Group assess the broader effectiveness of anti-money-laundering and counter-terrorist-financing safeguards. Nepal was placed under FATF increased monitoring in February 2025 and remained there in the statement dated 30 October 2026. The identified work includes better risk-based supervision, investigations, coordination and tracing of criminal proceeds. FATF guidance also warns against indiscriminate exclusion of legitimate customers: strong KYC should be risk-based, not a new barrier for poorer Nepalis.^{[13] [14]}

There is progress to applaud. A 2026 requirement for banks to support temporary account freezes at the request of authorized investigators, including outside ordinary hours, is a practical response to the speed of fraud. NRB’s September 2026 fintech strategy framework emphasizes secure infrastructure, resilient delivery, consumer trust and cooperation. The hard test will be whether those intentions translate into shorter response times and recovered money.^{[20] [23]}

Other countries learned the same lesson

Kenya’s M-Pesa-led ecosystem proved that mobile money can become everyday infrastructure well before universal bank access. It also confronted SIM-swap scams, social engineering, identity theft and confusing complaint routes. The Central Bank of Kenya’s 2022–2025 payments strategy explicitly identified fraud and weak redress as threats to trust, and called for common standards, improved consumer protection and coordination. Nepal can borrow the institution-building lesson without copying the exact Kenyan business model.^[17]

India’s UPI scaled instant account-to-account transfers dramatically, exposing a wider population to impersonation and unauthorized transactions. The Reserve Bank of India’s 2017
customer-liability rules are valuable for another reason: they distinguish circumstances and reporting timelines rather than assuming every electronic loss is automatically the customer’s responsibility. Nepal needs its own clear, enforceable loss-allocation rules for compromised accounts and deceptive-authorized payments.^[16]

The Philippines, where mobile wallets became mainstream, went further by enacting the Anti-Financial Account Scamming Act in 2024. It targets mule-account and social-engineering abuses and gives institutions a firmer basis to intervene. GSMA research similarly finds impersonation and other social-engineering schemes across mobile-money markets. The global message is consistent: public-awareness posters are useful; shared intelligence, intervention powers and meaningful redress are essential.^{[18] [19]}

A realistic roadmap for Nepal

Stage I: make reporting and containment work

Create one always-available fraud-intake route for bank, wallet, telecom and police referrals. Give every report a case number irrespective of loss size, with clear jurisdictional routing and a response-time standard. Train first-contact officers; publish any monetary thresholds that apply to specialised investigation rather than complaint acceptance. Require banks and wallets to staff live emergency channels, preserve evidence and rapidly act on lawful requests to restrict suspicious accounts. This is a coordination project before it is a grand technology project.

Stage II: share signals, not customers’ secrets

Build a legally governed, near-real-time fraud-intelligence exchange under NRB-led oversight and with FIU/police participation: confirmed mule-account indicators, high-risk beneficiaries, repeat device and phone identifiers where lawful, transaction patterns and fraud reports. Establish proportional risk triggers for new payees, unusual transfers, fresh devices and abrupt balance depletion. Combine them with transparent appeals and strong privacy controls; false positives must not become a new form of financial exclusion.^[22]

Stage III: modernize identity, liability and audit

Use reliable digital ID verification, biometric or liveness safeguards where justified, device binding and phishing-resistant authentication for higher-risk actions. Audit the entire chain—from agent onboarding and telecom SIM replacement to wallet-to-bank transfer and cash withdrawal. Publish comparable metrics: fraud reports per million transactions, funds stopped before settlement, recovery rates, resolution time, and complaints closed fairly. Set clear legal rules for restitution when institutions fail basic safeguards while recognizing the difficulty of payments willingly made under deception.

Stage IV: reach global-grade operational resilience

Stress-test payment switches and critical providers; strengthen secure APIs, card-industry standards, 24/7 incident coordination and cross-border investigation. Keep QR interoperability, inclusiveness and service quality high. Regulators should assess whether the system becomes materially safer—not merely whether a stack of policies has been issued. This roadmap complements, rather than replaces, NRB’s own 2026–2031 fintech strategy.^{[20] [27]}

Credit where due. Expectations where needed.

Nepal Rastra Bank. Credit: For guiding a market through innovation, licensing and an increasingly sophisticated payment system. Next step: Now publish measurable fraud-response standards, enforce weak-control findings and make dispute outcomes visible.^{[12] [20]}

Nepal Telecom and Ncell. Credit: For the connectivity, reach and airtime ecosystem without which mobile money could not have scaled. Next step: Now strengthen SIM-swap controls, verified sender identification and rapid fraud-number escalation while respecting privacy.^{[4] [5]}

Banks, wallets and payment switches. Credit: For turning phones and QR stickers into useful everyday infrastructure. Next step: Now compete on fraud prevention, swift freezes, fair redress and independent security testing as seriously as on convenience.^{[9] [10]}

Nepal Police and the Cyber Bureau. Credit: For building dedicated cybercrime complaint capacity in an increasingly complex environment. Next step: Now make every victim reportable, clarify any internal thresholds in writing, and investigate linked networks rather than only callers.^[15]

GSMA, USAID, UKaid, UNCDF and other partners. Credit: For supporting early experimentation, agent networks, knowledge-sharing and inclusion. Next step: Now prioritize institutional fraud response, supervisory technology and measurable consumer protection.^{[4] [5] [6] [7]}

Customers and merchants. Credit: For adopting new tools and demonstrating that Nepal can innovate quickly. Next step: Now verify unusual calls independently, never share a screen or secret code with an unverified caller, and report suspicious activity promptly.^[19]

The mark of a mature digital economy is not that nobody is ever fooled. It is that a citizen who is fooled is not left alone.

Nepal’s digital-payment revolution deserves celebration. Its next chapter will be judged by a harder standard: whether the woman who loses NPR 17,000 is treated as a customer worth protecting, a citizen worth hearing, and a source of information that might stop the next hundred frauds.

SOURCE NOTES & FURTHER READING

Numbers in the article refer to these clickable source descriptions. Sources were reviewed against material available by 31 October 2026. Product claims are attributed; anecdotes are not independently verified.

ORIGINS, DONORS & MARKET EVOLUTION

[01] eSewa company history and 2009 launch

[02] GSMA, Hello Paisa and Fonepay interoperability in Nepal

[03] Khalti, account of its early development (2017)

[04] USAID Nepal NEAT, mobile banking and Hello Paisa, 2013 newsletter

[05] GSMA Ecosystem Accelerator, eSewa grant profile

[06] eSewa / UKaid Sakchyam partnership, 2019

[07] UNCDF: Khalti, USAID and ILO support to MSME digitization

[08] NRB licensed PSO/PSP list, including IME Pay–Khalti merger

ADOPTION, REGULATION & NEPAL-SPECIFIC FRAUD

[09] NRB monthly payment-system indicators, Bhadra 2083 (September 2026)

[10] NRB Payment Systems Oversight Report 2023/24