A viral post claims Payoneer’s 2FA has been cracked. Security practice and past cases point to phishing, but victims’ anger over refunds is real
KARACHI, Nov 5 (Focus Pakistan) - A viral warning that hackers have “cracked” Payoneer’s two-factor authentication has triggered alarm among Pakistani freelancers, with social media users urging account holders to pull out their funds. So far, no public evidence shows a breach of the payment company’s systems.
The alarm started with a post on X that urged users to move their money into local banks before scammers got to it. The post put Pakistani freelancers’ balances on the platform at $800 million to $1 billion. Focus Pakistan could not verify that figure.
Content creators quickly amplified the warning. One digital creator spoke of people losing Rs100,000, even Rs200,000, from a single account.
Cracked Code or Clever Bait?
Some users claim hackers have worked out the formula behind Payoneer’s one-time passwords. Security practice points elsewhere.
Modern time-based codes rely on a secret key held by the server and the user’s device, not on a sequence anyone can guess. Attackers rarely bother breaking them. Instead, fake login pages harvest a victim’s password and live code in real time, or malware steals a session that has already passed the 2FA check.
Payoneer faced similar allegations before. In January 2024, users in Argentina woke up to emptied accounts, some reporting losses of $5,000 to $60,000. The company blamed SMS phishing and said fraudsters had lured “a very limited number” of customers to fake sites. Plenty of victims swore they hadn’t clicked anything.
Also Read: Punjab Moves to Ban Spy Cameras Hidden in Pens, Glasses and Watches
Payoneer, for its part, says on its website that it watches for odd account behaviour and throws up extra checks when something looks off.
Anger in Pakistan now centres on how Payoneer treats victims. Then there’s the email. Screenshots doing the rounds show what looks like a Payoneer customer-care reply telling one victim the money is gone. Focus Pakistan has not been able to verify it.
It goes further. It tells the user to get in touch with whoever received the transfer and sort out a refund with them. If authentic, the email raises questions about why Payoneer advised a customer reporting fraud to seek reimbursement directly from the disputed payment recipient.
A Captive Market
The stakes run high. Freelancers brought home a record $1.76 billion in FY26, up 78% on the year before, State Bank of Pakistan data show. In the first quarter of FY27, from July to September 2026, they earned about $550 million more, up 46% from a year earlier.
And still, a Pakistani can’t open a PayPal or Stripe account. That leaves New York-based Payoneer as one of the few practical routes for payouts from global platforms such as Upwork and Fiverr. Freelancers then move the money on to local banks and mobile wallets such as JazzCash.
The government has said for years that it is negotiating with global payment gateways. None has yet opened full service for Pakistani residents.
Users have long complained about conversion and withdrawal charges and annual fees on low-activity accounts. Now some say they withdraw every dollar the moment it lands. It feels safer. It also means paying the conversion cost over and over.
Staying Out of the Scammers’ Reach
Payoneer’s own advice is simple enough. Don’t read out or forward a one-time code to anyone, not even someone who says they work for Payoneer. Log in only through the official Payoneer website or app, saved as a bookmark, and look hard at any link that claims to come from the company. Spot something odd in the account? Call support straight away.
Anyone who has lost money can also lodge a complaint with the National Cyber Crime Investigation Agency, or NCCIA.
Freelancing in Pakistan isn’t slowing down. Until the country wins wider access to global payment gateways, a single viral post can still send freelancers across Pakistan into panic, whether or not the hack is real.
