One phone call, one six-digit code, and a whole month's salary gone in minutes — here is exactly how the bKash OTP scam works, and how to make sure it never works on you or your family.

In Bangladesh, bKash is how salaries arrive, how parents in the village receive money from their children in Dhaka, and how millions pay for everything from rickshaw fares to school fees — which is exactly why criminals target it. In November 2020, the CID's Cyber Police Centre told The Business Standard that mobile banking frauds made up about one-third of all crimes committed through online platforms, and that they received 1,200 to 1,500 complaints a day; the methods have only grown smoother since. Almost every theft depends on one moment: the victim is talked into revealing a code or a PIN. This guide explains how that moment is manufactured, how to recognise it, and what to do if it has already happened to you. (One note: this is an independent safety guide from The Daily Tech Watch — we are not affiliated with bKash.)

First, understand what an OTP and your PIN actually protect

Think of your bKash account as a locked almirah (steel cupboard) with two different keys.

Your PIN is the permanent key — the secret number you chose when you opened the account, used to approve transactions like sending money or cashing out. Whoever knows it can open the almirah whenever they like, until you change it.

An OTP (One-Time Password) is a temporary key — a short code, usually six digits, sent by SMS for one specific action at one specific moment, such as logging in. It works once, expires quickly, and proves to bKash that the person acting holds your phone.

Crucially, the system cannot tell you apart from a stranger holding your keys. In its app Terms of Use, bKash states that anything done using your PIN and OTP "will be considered that you are using this App yourself," and that users "must not share the PIN and/or OTP with anyone." A thief with your PIN and OTP is you, as far as the system knows.

Nobody breaks into bKash's servers to do this. Criminals hack the person: fear, greed or urgency make you hand over the keys yourself.

How the bKash OTP scam works: the full playbook

Police describe organised gangs behind this scam — members who collect numbers, call pretending to be customer care, and withdraw the money quickly across the country.

Step 1: Your number is collected. From agent-point registers, leaked lists sold online, social media, or random dialling.

Step 2: Trust is built. One arrested gang first sent victims Tk 1,000 to earn trust, The Business Standard reported. Caller ID can be faked, too — gangs have cloned helpline numbers, so calls can appear genuine.

Step 3: A problem or prize is announced. Your account "will be blocked tonight." A transaction "failed." You won cashback or an allowance. Money arrived "by mistake." Every version creates the same feeling: act now, or lose something.

Step 4: A real code is triggered. Mid-call, the scammer starts a genuine process on your account — a login or PIN reset — and a real OTP arrives from bKash. The scammer does not fake the code; he arranges for you to receive it.

Step 5: You are talked into reading it out. "Please read me the code that was sent for verification." It will expire, they warn; the account will be blocked — police describe this threat as standard script.

Step 6: The money vanishes. The account is emptied in quick transfers and cashed out through agents in different districts — often already cash within minutes.

No password was cracked, no system breached — the only door that opened is the one you hold the key to.

The 7 most common bKash scam tricks

1. The fake bKash officer: "Your account will be closed." The most common script. A caller claiming to be from bKash head office says your account has a problem and will be blocked today unless you "verify" with your PIN or code. Real bKash staff never ask for either.

2. Cashback, lottery and prize bait. A call or SMS announces a prize or cashback — you only need to "confirm" your account or share the verification code. bKash's Security Tips answer directly: never respond to lottery, prize or competition messages.

3. "I sent money to your number by mistake — please return it." A stranger, sometimes crying, begs you to return money sent "by accident." Sometimes a small amount really was sent (the trust trick). You are then guided into "returning" it in a way that sends your own money, or asked for a code to "reverse" it. But genuine mistaken senders resolve it through bKash; you never need a code or PIN to give money back.

4. Trouble at the agent point. People watch you type your PIN; a "helpful" stranger interferes; or you are told to cash out via Send Money to the agent's personal number. bKash's Security Tips warn explicitly: cash out only with "Cash Out from Agent," never via Send Money to a personal account. Confirm the number and amount on your screen and shield the keypad.

5. Fake apps, APK files and phishing links. The bait arrives by SMS, Messenger or Facebook: "Update your bKash app," "Verify or be blocked," "Claim your bonus." It leads to a fake page that harvests your PIN, or a look-alike app — and bKash's Terms of Use exclude liability for fake app versions. Install only from the Play Store or App Store; never enter your PIN on a page reached via a link.

6. Fake "bKash support" pages and groups. Fake "support" pages and groups copy bKash's name and pink logo; a fake agent then messages you and walks you into the OTP script. Real channels: helpline 16247, live chat on bkash.com, support@bkash.com, Customer Care Centres.

7. SIM-swap and the lost-phone danger. Your account is tied to your SIM, so whoever controls your number receives your codes — the CID has described criminals using cloned SIMs for exactly this. A lost phone hands a stranger your SIM and often a guessable PIN. bKash's Security Tips: if your phone is lost, immediately inform helpline 16247 — and have your operator block the SIM.

One scam, minute by minute

A made-up example — fictional people, but every step follows the real scripts above, so you can see where the theft could have been stopped.

Minute 0. Rahim, a garment worker in Gazipur, gets a call at lunch: "Assalamu alaikum, calling from bKash customer care. Your account verification is incomplete and it will be blocked tonight." Stop point one: real bKash never demands this — he could hang up and dial 16247 himself.

Minute 2. The caller asks Rahim to confirm his name and last transaction, making it feel official. Stop point two: strangers can buy such details; knowing them proves nothing.

Minute 4. "I have sent a verification code to your number — please read it to me." A genuine SMS from bKash arrives — the caller has just started a login on Rahim's account. Stop point three, the crucial one: a genuine SMS does not make the request safe — the message is real, the caller is not.

Minute 6. Rahim hesitates. "Sir, the code expires in two minutes — then your account is blocked with your salary inside." He reads it out. This is the moment the money was lost; everything after is just movement.

Minute 8. The caller completes the login and transfers the balance out in two quick transactions, dismissing the buzzes as "system messages."

Minute 12. The call ends politely — then Rahim sees two cash-out confirmations, an empty account, and a number that no longer answers.

Four chances to stop it — and the simplest costs nothing: the code is mine, and I do not read my codes to anyone.

12 warning signs that the call or message is a scam

1. They called you. bKash does not phone customers demanding verification. Treat such calls as suspicious until you verify via 16247.
2. They ask for your PIN, OTP or any code. bKash authorities never ask for these — at any time.
3. Urgency and threats. "Blocked in ten minutes." Fear is the tool; real institutions do not work this way.
4. A code arrives mid-call and you are asked to read it back. The signature move of the scam. Hang up.
5. Prize, lottery, cashback or allowance news — especially if a fee or code is needed.
6. "Money sent by mistake" stories with emotional pressure, ending in instructions to send money or share a code.
7. The caller knows your name or a recent transaction. It proves nothing — such details are collected and bought.
8. The number looks official. Gangs clone helpline numbers; caller ID can be faked. Always call back yourself.
9. You are told to keep the call secret. Secrecy protects only the scammer.
10. You are asked to install an app, download an APK or open a link to "fix" your account.
11. A Facebook page or "agent" offers bKash support and asks for your number and codes.
12. At an agent point, someone hovers or suggests Send Money to a personal number. Use only "Cash Out from Agent."

One sign is enough: hang up and check via official channels. A genuine problem survives ten minutes; a scammer's script does not.

The golden rules bKash itself gives you

bKash publishes its own security guidance — short enough to memorise:

• Keep your PIN, Secret Code and Security Code secret at all times — never write them down or share them. (bKash Security Tips)
• bKash authorities will not ask for your PIN, Secret Code or Security Code at any time. If someone asks, it is not bKash. (bKash Security Tips)
• Do not share your PIN and/or OTP with anyone — and if you suspect misuse of your PIN, change it immediately. (bKash App Terms of Use)
• Do not respond to lottery, prize or competition messages; verify suspicious calls by contacting the helpline yourself. (bKash Security Tips)
• The official helpline is 16247, staffed 24/7. Also official: support@bkash.com and live chat on bkash.com. (bKash Security Tips; App Terms of Use)
• If your phone is lost, inform 16247 immediately. (bKash Security Tips)
• Install the genuine app properly — bKash's terms make the user responsible for the correct version. (App Terms of Use)
• Check every transaction: verify the recipient and your balance, and confirm the SMS from "bKash." (bKash Security Tips)

How to protect your bKash account: the complete checklist

Work through this list once and you will be safer than most users:

• Choose a PIN nobody can guess — not your birth year, not 12345, not the end of your phone number — and change it if you suspect it was seen.
• Never save your PIN in your phone — not in a contact under a false name, a note, or a screenshot.
• Lock your phone — PIN, pattern, fingerprint or face — and never lend it to people you do not trust (another bKash don't).
• Keep the official app updated, installed only from the Play Store or App Store. Delete any "bKash" app received as an APK file.
• Use your own account — bKash's Security Tips warn against transacting through someone else's, and registration is free.
• At agent points, slow down. Confirm the agent number and amount on your screen; cash out only via "Cash Out from Agent"; shield your PIN entry.
• Check your balance before and after every transaction and confirm the SMS came from "bKash." Keep inbox space free for them.
• An unrequested code means someone is trying something. Never share it; if it repeats, call 16247 and consider changing your PIN.
• Phone lost or stolen: call 16247 from any phone, have your operator block the SIM, then change key passwords, email first.
• Save 16247 in your contacts now, before you need it.

Already shared your OTP or PIN? Do this right now

Do not waste a minute on shame — these gangs fool teachers, businessmen and bank customers too. Speed is all that matters:

1. Call 16247 immediately, from any phone. Say your OTP or PIN was shared and ask bKash to secure your account.
2. Change your PIN at once — bKash's terms instruct exactly this when misuse is suspected. If locked out, the 16247 call centre can guide a PIN reset.
3. Check your balance and recent transactions. Note what moved, when, and where to.
4. Write everything down while fresh: the caller's number, their story, when the code arrived, when the money left.
5. Keep the evidence — screenshots of the call log, SMS messages, confirmations and chats. Delete nothing.
6. Report to the police. File a General Diary (GD) at your nearest station and contact the CID's Cyber Police Centre (round-the-clock hotline 01320010148, or its Facebook page). If money may still sit in the receiving account, say so urgently — police say immediate contact lets them freeze it.
7. Warn family and close contacts not to trust money requests from your number until you say otherwise.
8. If your phone or SIM is involved, have your operator block the SIM too.

If money was stolen: can you get it back?

Honesty first: sometimes yes, often no — and the biggest factor is how many minutes passed before you reported it.

Stolen money is cashed out within minutes, often in other districts; cash is then nearly untraceable. But money still sitting in the receiving account can be frozen — and frozen money can come back. The Business Standard reported both outcomes: a Dhaka University student called the CID hotline immediately, police froze the account before withdrawal, and he recovered his money within hours. A Noakhali businessman who shared his PIN with a fake "mobile banking official" lost everything, and the provider could not refund him.

The hard reason: bKash's Terms of Use treat transactions made with your PIN and OTP as made by you, and make the user responsible for transfers under any "inducement or fraudulent activity." If you handed over the keys, recovery is an uphill fight, not an entitlement. Anyone promising a guaranteed refund — for a fee, or incredibly, for another code — is running the scam's second act.

The realistic path: complain to bKash first (16247, with transaction details and your GD) — Bangladesh Bank's procedure starts with the provider. File the GD and inform the Cyber Police Centre. If bKash's response leaves you dissatisfied, escalate to Bangladesh Bank's Customer Interest Protection Centre (CIPC): hotline 16236 in office hours on working days, email bb.cipc@bb.org.bd, or its online complaint form. Keep every reply bKash gives you — escalation needs their final response.

Nobody honest can promise recovery. But those who recover money are almost always those who called within minutes. Act first; feel bad later.

Teach this to your parents and family

Scammers love elderly users. Many parents received their first bKash account from their children, use it mainly to receive money, and were raised to be polite to phone "officials." A confident voice saying "I am from the bKash office, your account will be closed" lands differently on a 65-year-old in a village than on a Dhaka office worker — especially with weak eyesight and fear of a technical mistake.

Do not just forward this article. Sit with your parents for five minutes and say it like this:

"Abba/Amma, listen to one thing. Bad people may call pretending to be from bKash. They will say your account will be closed, or that you won a prize. They will ask for a code that comes to your phone, or for your PIN. Never give it. Never. Real bKash people will never ask — not by phone, not by SMS, not in person. If anyone asks, cut the call and phone me. If you cannot reach me, call 16247. No problem is too urgent to wait ten minutes for your own son or daughter."

Then make it physical: save 16247 in their phone as "bKash Helpline — Real One," write it on a card kept with their documents, and set a family rule: any money-and-codes call is checked with family first.

Give everyone one sentence to memorise:

"No code, no PIN — for anyone, ever."

FAQ

Can a bKash agent ask for my OTP?

No. For cash-out you use "Cash Out from Agent" and enter your PIN yourself. An agent who asks for your OTP or PIN, or suggests Send Money to their personal number: walk away and call 16247.

Does bKash ever call and ask for a code?

No. bKash's Security Tips state its authorities never ask for your PIN, Secret Code or Security Code. If worried, hang up and dial 16247 yourself.

Someone says they need my OTP to SEND me money. True?

False — a classic lie. Receiving money requires nothing from you: no code, no PIN, no "confirmation." Anyone asking is trying to take money out, not put it in.

I entered my PIN on a website link. What now?

Emergency: change your PIN immediately (bKash's terms say to do this when misuse is suspected), call 16247, check your balance, and follow the emergency steps above.

Is the bKash app safer than USSD *247#?

Both are official. The app's danger is fake copies — install only from official stores, as bKash's terms require. USSD (*247#) needs no internet and is what bKash's tips use for balance checks. Either way: a scammer with your code wins; never sharing it keeps you safe.

How do I check my recent transactions?

View activity in the official app; cross-check confirmation SMS messages from "bKash" and your balance via *247#, as bKash's tips advise. If a transaction is not yours, call 16247.

Sources

• bKash — Security Tips (official): https://www.bkash.com/en/page/security-tips
• bKash — Terms of Use, bKash App (official): https://www.bkash.com/en/page/terms-of-use-bkash-app
• Bangladesh Bank — Customer Interest Protection Centre (CIPC) complaint procedure (official): https://www.bb.org.bd/en/index.php/services/cipc_procedure
• The Business Standard — "Why mobile banking frauds rising in pandemic" (27 November 2020), on CID Cyber Police Centre methods, hotline and case outcomes: https://www.tbsnews.net/bangladesh/crime/why-mobile-banking-frauds-rising-pandemic-164065
• The Financial Express — "CID seeks information on individuals involved with MTFE" (26 August 2023), on Cyber Police Centre contact channels and the 999 emergency service: https://thefinancialexpress.com.bd/national/crime/cid-seeks-information-on-individuals-involved-with-mtfe

Related reading: WhatsApp Account Hacked? How to Recover It Step by Step · AI Phishing in 2026: How to Spot a Fake Email, Message or Voice Call