The money is moving now, not later. Here is the exact order of steps that gives it the best chance of coming back — and the honest truth about when it cannot.

You open bKash and the balance is wrong. Money you never sent has left the account — or your PIN suddenly does not work, or a "customer care" call has just ended and your savings went with it. If your bKash account was hacked, what to do in the next ten minutes matters more than anything afterwards, because stolen money in mobile banking moves fast, hopping from account to account until it is cashed out and gone. This guide is the recovery plan, in order: freeze the account, dispute the transaction properly, involve the police and Bangladesh Bank, and understand your real chances of getting money back. (An independent guide from The Daily Tech Watch — not affiliated with bKash.)

How a bKash account gets taken over

Three common routes lead here, and the response to all of them starts the same way.

The PIN-reset takeover. The attacker does not need your phone. With your number and enough personal details — date of birth, NID information, recent transaction amounts — they convince customer care that they are you and the account is blocked or the PIN forgotten. Police described exactly this method in September 2026, when nine gang members were arrested in Bagerhat: according to The Business Standard, the gang digitally cloned victims' fingerprints to obtain replacement SIM cards, then called customer care claiming their accounts were blocked, armed with prepared answers to security questions. Access was restored to the wrong people, and Tk 2.5 lakh was stolen from two businessmen's bKash and Nagad accounts.

The OTP trick. You were talked into it: a call or message created fear or greed, and you read out a one-time code or your PIN. We covered that playbook in full in our bKash OTP scam guide (linked at the end) — this article is about what happens next, after the money has gone.

The lost or swapped SIM. Your phone is stolen, or your SIM suddenly loses signal because a replacement was issued to someone else. Everything tied to that number — including bKash — is now reachable by a stranger.

Whichever route it was, the first steps are identical — and the clock is running.

bKash account hacked? Your first 10 minutes: freeze it on 16247

Call 16247 immediately. Use your own phone if you still have it; if not, borrow any phone — the helpline works from any number, and bKash's call centre runs 24/7, so do not wait for morning. Your one goal on this call: get the account blocked before another taka leaves.

Say this:

• "My bKash account has been hacked. Money has been taken without my permission."
• Give your account number (your mobile number), full name and NID details when asked — bKash verifies identity and ownership from your registration information.
• "Please block my account right now so no more money can go out."
• Describe the transactions you did not make — amounts, times, and any recipient numbers visible in the app statement or SMS.
• Before hanging up, ask: "What is my complaint or reference number?" and "What happens next?" Write both answers down.

Three details matter on this call. First, bKash's terms state that call-centre calls may be recorded — so speak slowly and give exact times and amounts; that recording is evidence in your favour. Second, real bKash staff will never ask for your PIN, Secret Code or Security Code — the company says so itself. If anyone on any call asks for them, hang up and dial 16247 again yourself. Third, if the attacker changed your PIN, say so on this call.

While you wait on hold, screenshot your app statement and every transaction SMS. Do not delete anything.

The first hour: change the PIN and secure your phone, SIM and bank

Once the freeze request is in, use the first hour to close every other door.

Reset the PIN. If you can still get into the app or the *247# menu, change the PIN now — bKash's Terms of Use instruct users to change the PIN immediately on any suspicion of misuse. If you are locked out, use the "Forgot PIN?" route in the app, which verifies your identity against your registered information before letting you set a new one, or complete the reset through 16247. Choose a PIN you have never used anywhere — not your old PIN with one digit changed, not your birth year. And do not guess at a PIN the attacker may have set: too many wrong attempts temporarily blocks the account until the call centre resets it.

Secure the SIM. If your phone lost signal unexpectedly around the time of the theft, treat the SIM itself as compromised — that is the Bagerhat gang's method. Contact your mobile operator, explain the fraud, and ask whether a replacement SIM was recently issued for your number. If it was, that belongs in your police report too.

Secure the phone. Change the phone's lock PIN or pattern, and remove any app you do not recognise — especially anything installed around the time of a suspicious call or link.

Call your bank, if one is linked. If money may have been pulled through a linked bank account, call the bank's helpline too, tell them the connected bKash account was compromised, and ask them to flag the linked transactions. The bKash freeze does not cover the bank side.

Warn your circle. Tell close family and regular senders, on a voice call: scammers holding your number often ring relatives next, using your name and an emergency story.

Filing the transaction dispute: give bKash everything, in writing

The 16247 call stops the bleeding. The formal dispute creates your case for getting money back — make it detailed, documented and filed through more than one channel.

You can file and follow up through:

• 16247 — have the dispute recorded against every unauthorised transaction; keep the reference number.
• The bKash app's Self Complaint system — open Customer Service → Complaint from the home screen, choose the service category, enter the details and submit; track it under "View Previous Complaints" (The Business Standard reported the feature's launch). The categories centre on services like bKash-to-bank transfers, savings, mobile recharge and bill payment — so for a hacked account, treat the app as a supporting record alongside your 16247 case, not a replacement for it.
• Live Chat on bkash.com, or email — both listed on bKash's Security Tips page.
• A bKash Customer Care Centre in person — worth it for large amounts; bring your NID and evidence.

What to give them — for each stolen transaction, and as evidence:

• The TrxID (transaction ID) — from the app statement or the transaction SMS
• The amount, date and time, and the recipient number
• Your account number and NID details
• A short timeline: when you last used the account normally, when you discovered the theft, when you called 16247
• Screenshots of the app statement showing the unauthorised transactions
• The original transaction SMS messages — keep them, do not delete
• The phone numbers that called or messaged you, with call times, plus any chat screenshots from Messenger, WhatsApp or Facebook
• A note of anything the caller said — promises made, names used
• Your police GD number, once filed (next section) — send it to bKash for the case file

One honest gap: bKash does not publish a fixed dispute deadline on its site, so there is no official deadline number. The practical one is what matters: money still inside the system is far easier to stop and trace than money cashed out at an agent point across the country. File the same day — within the hour if you can.

The honest truth about getting your money back

No guide should promise you a refund, and this one will not. Here is the real picture.

If you were tricked into sending the money or sharing your PIN and OTP, the terms are against you. bKash's app Terms of Use state that activities done through the app using your PIN and OTP are treated as done by you, that the user is solely responsible for transfers made under any inducement or fraudulent activity, and that bKash is not liable for losses from unauthorised use of the PIN or account. Read plainly: when the correct PIN and code were entered, bKash's starting position is that the account holder authorised it.

If someone got in without you sharing anything — a cloned SIM, a PIN reset you never requested — your ground is stronger: you authorised nothing. State that distinction clearly, in writing, in your dispute and your police report.

So why file at all? Because "the terms are against you" is not the same as "recovery is impossible." A fast, documented report gives bKash's team something to act on while transactions can still be traced — and police action does recover money in real cases: in Bagerhat, police recovered Tk 80,000 when they arrested the gang. Recoveries happen case by case, through speed, evidence and a proper complaint trail — never through a guarantee, and never through anyone who phones you offering one (see the second-wave warning below).

Set expectations this way: the freeze protects what is left; the dispute, the GD and the escalation give the stolen money its only realistic chance of coming back. Doing nothing gives it none.

File a General Diary (GD) at the police station

Do this the same day, ideally right after the bKash filings. A General Diary — GD — is your official police record of the incident, and it strengthens everything else: bKash's process, a Bangladesh Bank complaint and any later court matter all carry more weight with a GD number attached.

Go to your nearest police station and bring:

• Your NID card
• Your bKash account number and the phone that holds the SIM, if you have it
• Printouts or phone screenshots of the unauthorised transactions, TrxIDs and amounts
• The numbers that called or messaged you, and your 16247 complaint reference number

Tell the duty officer plainly: your bKash account was hacked, money was stolen, and you want a GD recording it. You will receive a GD number — photograph the stamped copy, keep both safe, and send the GD number to bKash for your dispute file.

You can also report the cyber-fraud side to the CID's Cyber Police Centre on its hotline, 01320010148. These units investigate the organised gangs behind SIM cloning and MFS fraud — the Bagerhat arrests began with victims reporting. Your report is how gangs get found.

If bKash does not resolve it: escalate, in this order

Bangladesh Bank's Customer Interest Protection Centre (CIPC) publishes the official complaint ladder for banks and MFS providers. Climb it in order.

Step 1 — bKash itself. You have done this: 16247, the app complaint, the written record. Keep pushing until you get a clear final answer, in writing where possible.

Step 2 — bKash's Complaint Management Cell. If front-line support stalls, bKash's website lists a Complaint Management Cell with named senior officers and contact details, reachable during working hours (9:00 am–6:00 pm, Sunday to Thursday, excluding government holidays). Escalate with your complaint reference number, GD number, and a one-page summary of the case so far.

Step 3 — Bangladesh Bank's CIPC. If the complaint remains unresolved, or you are dissatisfied with bKash's outcome, CIPC is the regulator's door: hotline 16236 during office hours on working days, email bb.cipc@bb.org.bd, its online complaint form, or a written complaint to its Dhaka head office. CIPC covers MFS providers like bKash, and its procedure asks for a detailed description of the complaint with your name, address and contact details, a copy of the provider's final response, and supporting documents. That is why the earlier steps matter — they generate exactly this paper trail.

Keep every reference number, email and letter in one folder. Escalation is slow, unglamorous work, but it is the route that exists, and it costs nothing but persistence.

Beware the second wave: the "refund officer" scam

The cruellest part of this crime often comes after you report it. Within a day or two, expect a call or message like this: "I am calling from bKash about your complaint. Your refund is ready — I just need the OTP sent to your phone," or a demand for a "processing fee" before your refund is released.

It is not bKash. It is the same gang, or a second one working from the same leaked information, taking another swing at someone desperate to recover money. Remember the fixed rules:

• bKash authorities never ask for your PIN, Secret Code or Security Code.
• Nobody legitimate asks you to send money to get your own money back.
• A genuine resolution comes through your complaint channels — never through a code you read out on a call.

If such a call comes, hang up, note the number, and verify everything by dialling 16247 yourself. Add the number to your GD and dispute file.

If you lost your phone or SIM too

A stolen phone is more urgent: the thief holds both the account and the number that receives its codes. bKash's Security Tips page is blunt — if your phone is lost, immediately inform the Helpline 16247, from any borrowed phone.

Then work this order:

1. Block the bKash account on the 16247 call, exactly as above.
2. Get a replacement SIM for the same number from your operator's customer care, with your NID and biometric verification — and be quick: the Bagerhat case shows attackers use replacement SIMs as a weapon, so be the one who gets there first.
3. Include the stolen phone in your GD, with its IMEI if you have it (on the phone's box or purchase receipt).
4. Once the replacement SIM is active, reset the bKash PIN via 16247 or "Forgot PIN?", then review the full statement for the period the phone was gone and dispute anything you did not do.
5. Change the important passwords the phone could open — email first, then Facebook and anything else signed in on it — from a device you trust.

After you recover the account: lock it down

When access is restored, spend ten minutes making sure this cannot simply happen again:

• Keep the new PIN truly new — never write it down, never store it in the phone, never share it with anyone, including anyone claiming to be bKash.
• Check your balance and statement regularly, and verify the transaction SMS from "bKash" after every transaction — bKash's own Security Tips page recommends both habits.
• Keep your registration information accurate and current. It is what bKash uses to verify your identity and ownership — in a crisis, it is your proof the account is yours.
• Only ever call 16247 yourself. Any "customer care" number that arrives by SMS, Facebook page or a caller's mouth is guilty until proven innocent.
• Read our OTP scam guide (linked below) with your family. Most bKash thefts begin with one conversation — make sure everyone in the house knows how it sounds.

FAQ

Can bKash reverse a transaction after my account was hacked?

Sometimes, but never count on it. Under bKash's Terms of Use, transactions completed with your PIN and OTP are treated as authorised by you, and transfers made under inducement are the user's responsibility. Outcomes are decided case by case: a fast report, a formal dispute and a police GD give the money its best chance — especially if it has not yet been cashed out — but nobody can promise a reversal.

What number do I call if my bKash account is hacked, and is it open at night?

Call 16247. bKash's Terms of Use state it maintains a 24/7 call centre for assistance and complaints — call the moment you discover the problem, not in the morning.

The hacker changed my PIN and I am locked out. What do I do?

Call 16247 — PIN resets run through the call centre after identity verification against your registered information (the app also offers a "Forgot PIN?" route). Do not keep guessing: too many wrong attempts temporarily blocks the account until the call centre resets it.

Is there a deadline for disputing a bKash transaction?

bKash publishes no fixed dispute deadline on its website. Treat speed as the deadline: report on 16247 within the hour if you can, file the same day — money is far easier to trace before it is cashed out.

When I call about my hacked account, will bKash ask for my PIN or OTP?

No. bKash states on its Security Tips page that its authorities will not ask for your PIN, Secret Code or Security Code at any time. If anyone on any call asks for them — including someone who says they are processing your refund — hang up and dial 16247 yourself.

Is it worth filing a police GD for a small amount?

Yes. A GD costs a trip to the station and nothing else, and the GD number strengthens your bKash dispute and any Bangladesh Bank escalation. Small reports also connect: gangs get caught when many victims' reports point at the same numbers.

Sources

• bKash — Security Tips: https://www.bkash.com/en/page/security-tips
• bKash — Terms of Use, bKash App: https://www.bkash.com/en/page/terms-of-use-bkash-app
• bKash — Complaint Management Cell: https://www.bkash.com/en/customer-service/complaint-cell
• Bangladesh Bank — Customer Interest Protection Centre (CIPC), complaint procedure: https://www.bb.org.bd/en/index.php/services/cipc_procedure
• The Business Standard — bKash introduces self complaint system for faster service (19 January 2026): https://www.tbsnews.net/economy/corporates/bkash-introduces-self-complaint-system-faster-service-1338251
• The Business Standard — 9 arrested in Bagerhat over SIM cloning, mobile banking fraud (29 September 2026): https://www.tbsnews.net/bangladesh/crime/9-arrested-bagerhat-over-sim-cloning-mobile-banking-fraud-1557496

Related reading: bKash OTP Scam: How It Works, Warning Signs, and How to Protect Your Money · Clicked a Phishing Link? What to Do Next, Step by Step