Severe panic is sweeping through the Pakistani freelance community right now. Rumors are rapidly circulating that hackers have compromised Payoneer’s security infrastructure. A recent tweet claims that the two-factor authentication (2FA) at Payoneer has been cracked. The tweet warned that people are actively losing money. It has been estimated that Pakistani freelancers currently hold $800 million to a billion dollars on the payment platform. Consequently, the tweet urges users to send their money to local bank accounts immediately before they get scammed.
Local experts and content creators are echoing this dire warning. Experts suggest quickly withdrawing all extra assets into Pakistani banks. A digital creator noted that some individuals are already suffering losses between PKR 100,000 and PKR 200,000 per account. Furthermore, third-tier banks and platforms never compensate users for internal security breaches.
Is Payoneer’s 2FA Cracked, or is it Phishing?
The situation remains incredibly murky. Did hackers mathematically crack Payoneer’s system? Or did they launch a highly sophisticated phishing wave?
Customers are speculating that hackers successfully traced Payoneer’s OTP algorithm. Claims like OTPs are essentially just random numbers that anyone can generate once the algorithm is traced are floating out there. Some have even confidently predicted that all OTP systems will soon be cracked.
However, modern Time-Based One-Time Password (TOTP) systems actually rely on highly protected cryptographic shared secrets. They do not just use easily guessable mathematical sequences. Therefore, a platform-wide infrastructure breach is highly unlikely. Instead, victims are likely falling for targeted phishing campaigns or malware. In these attacks, hackers intercept session tokens to bypass the 2FA prompt entirely.
The Outrageous Response from Payoneer
Even if users are falling for complex phishing tricks, Payoneer’s response is completely unacceptable. We reviewed an official customer care email sent to a scam victim. In the email, a representative of Payoneer bluntly refused to issue a refund for the stolen payment. The security team determined they were unable to recover or return the funds.
Then, Payoneer did the unthinkable. The company explicitly told the victim to “contact and coordinate directly with the payment recipient regarding the funds”. Furthermore, they suggested the scammer might help resolve the matter or arrange a reimbursement. Telling a scammed user to politely ask a cybercriminal for their money back is an absolute slap in the face. It demonstrates a staggering lack of accountability for a financial platform handling millions of dollars.
A Captive Market Panic
Pakistani freelancers are now panicking, but they have nowhere to go. They are essentially a captive market. Users are forced to use this platform because Wise does not offer Business accounts in Pakistan. Additionally, Pakistan still lacks access to Stripe and PayPal.
The user base already heavily resents Payoneer. Early adopters call the platform a complete disaster of payment issues and pathetic support. Users widely label the company as totally anti-consumer. They constantly complain about exorbitant transaction fees. Payoneer charges a 1% fee upon arrival and up to a 3% fee on withdrawals. Furthermore, they slap arbitrary monthly fees on users with lower transaction volumes. It is worth noting that Payoneer now functions exactly like PayPal, heavily profiting off peer-to-peer sending fees.
As a result, many users are not waiting around to become the next victim. Several freelancers already follow a strict policy of instantly pulling out every single penny that lands in their accounts. Users are also questioning why Pakistanis do not just use Wise, pointing out that Payoneer is an Israeli company. Ultimately, until Pakistan secures better global payment gateways, local freelancers will remain completely at the mercy of platforms that refuse to protect them.
