By Suman Tiwari, Cybersecurity Professional । Imagine a family searching Facebook for news of a relative missing after a flood. Among hundreds of urgent posts, they see a donation appeal carrying a distressing photograph and a QR code. Wanting to help, they transfer money immediately. Days later, they discover that the appeal was fraudulent. The disaster was real; the fundraiser was not.
This is a hypothetical example, but the risk is well established. Criminals exploit major disasters by creating fake charities, impersonating trusted organisations and sending phishing messages. At the same time, inaccurate posts can spread rapidly as frightened people try to help. A humanitarian emergency can therefore create a second crisis online because urgency can weaken the caution people would normally exercise.
Nepal’s earthquakes, floods and landslides have shown how quickly people turn to social media for information, assistance and family updates during a crisis. Mobile phones and social media can carry warnings, reconnect families, identify safe routes and mobilise support within minutes. The National Disaster Risk Reduction and Management Authority provides official alerts, disaster bulletins and digital disaster-management services. For Nepalis abroad, online communication is the fastest way to check on relatives and contribute to relief efforts. As emergency information and relief payments move online, verifying their source becomes increasingly important.
The same speed that helps responders also benefits criminals and misinformation actors. A scammer can copy the name and logo of a recognised organisation, create an account and circulate a payment request before the genuine organisation has issued an appeal. Fraudulent QR codes, altered account numbers and links to imitation websites can be shared repeatedly through Facebook, TikTok, WhatsApp and messaging groups. A familiar logo or an emotional photograph does not prove that the request is genuine.
Old images create another problem. Photographs from an earlier earthquake, flood or even another country may be reposted as evidence of a current event. Artificial intelligence now makes it easier to create convincing images, audio and video. Such material may exaggerate damage, falsely identify victims or provoke anger against officials or communities on false grounds. Even an innocent user can amplify the harm by forwarding a dramatic post without checking its date, source or location.
Privacy is often overlooked in the rush to assist. People share citizenship cards, telephone numbers, medical reports and bank details while trying to locate relatives or raise funds. Photographs of injured people and children are circulated without consent. Once copied, this information can be used for impersonation, identity fraud, harassment or further scams long after the immediate emergency has ended. People should share only the information that rescuers or verified agencies actually need.
Nepal needs a clearer system for trusted digital communication during disasters. The government should maintain a single, easy-to-find emergency information page linked to verified accounts at national, provincial and local levels.
Updates should use consistent formats and include the time, location and issuing authority so that citizens and newsrooms can distinguish an active warning from an outdated screenshot.
Nepal should also have a rapid-response team for misinformation during emergencies. It could verify widely circulated claims, identify false donation requests and publish corrections in Nepali and relevant local languages. Media houses and fact-checkers should have a direct channel for confirming urgent claims. Corrections should appear on the same platforms where the false claim spread; a notice placed only on a government website may never reach the people who saw the original post.
Banks and digital-wallet providers also have a role. Relief appeals using payment accounts should display the verified name of the recipient, and institutions should provide a quick process for reporting suspected fraud. Telecom operators can distribute short safety alerts during major emergencies.
Social-media companies should be encouraged to prioritise reports involving impersonation, false fundraising and manipulated disaster content during emergencies. These arrangements should be agreed before a crisis, not improvised under the pressure of an unfolding tragedy.
Citizens can reduce the risk through a simple habit: pause, verify, then share. Before donating, check the appeal through the organisation’s official website or verified account rather than relying on a forwarded link. Confirm that the account holder matches the stated beneficiary. A simple reverse-image search can often reveal whether a photograph came from an earlier disaster or another country. Be cautious when a message demands immediate payment, secrecy or personal credentials. Do not publish identity documents, medical records or children’s details unless there is a clear and legitimate need.
Suspicious accounts and messages should be reported to the platform, the relevant bank or wallet provider and the Nepal Police Cyber Bureau. People should also preserve screenshots, payment receipts, account details and links. Rapid reporting may help institutions block an account before more victims transfer money.
Nepal has learned that roads, hospitals, communications and early-warning systems are essential during disasters. Trustworthy information should now be treated as part of that critical infrastructure. A fake appeal can divert money from genuine relief. A false warning can send people towards danger. An exposed identity document can turn a survivor into a fraud victim months later. Protecting the digital space during an emergency is therefore both a cybersecurity responsibility and a humanitarian duty. In the digital age, protecting people during disasters also means protecting the information on which they depend. Resilience requires not only rescue teams and relief supplies, but also the ability to recognise trustworthy information and reject deception.
About the Author:
Suman Tiwari is a cybersecurity professional based in Ireland who writes about cybersecurity, emerging technology and public policy. His work explores how digital developments affect individuals, institutions and developing countries such as Nepal.
