The money leaves in minutes, but a fast, calm response can still save it — here is the exact order: freeze first, then fight to get it back.

You open Nagad to check your balance and the money is simply not there. Or a transaction message arrives for a cash-out you never made. If your Nagad account is hacked, what to do in the next ten minutes matters more than anything that follows — mobile money moves fast, and so do the people who steal it. Do not panic, and do not start by calling numbers from random Facebook pages. This guide is the ordered version: freeze the account with one call, take your PIN back, file the dispute properly, involve the police and Bangladesh Bank — and spot the second scam that often targets victims within hours.

Please note: The Daily Tech Watch is an independent publication. This guide is not affiliated with, endorsed by, or published by Nagad. It is based on Nagad's own public statements and Bangladesh Bank's published complaint procedure, linked in the Sources at the end.

How Nagad accounts get hacked in the first place

Almost no Nagad theft involves a criminal "breaking into" Nagad's systems. The break-in almost always happens at your end, through your PIN or a one-time code. Understanding the trick that was used on you also helps when you report it, because Nagad and the police will ask how it happened.

The fake officer call. Someone calls claiming to be from "Nagad head office." Your account will be closed, your KYC needs updating, you have won a cashback prize — whatever the story, it ends with a request for the OTP that just arrived on your phone, or for your PIN. Nagad states plainly, in its own published terms, that it never asks customers to disclose their OTP or PIN, in any circumstances. The moment a caller asks, it is a criminal, whatever the caller ID says.

Fake pages and fake apps. Links circulate on Facebook and Messenger to pages that copy Nagad's branding and ask you to "log in" or enter a code to claim a remittance bonus. Others push a "Nagad" app through a direct download link instead of the Play Store. A real app never arrives by Messenger.

Fake support pages. Search Facebook for Nagad help and you will find pages and groups that look official, answer quickly — and exist to harvest account details from people already in trouble. This is also how the second-wave scam below finds its victims.

Guessed or watched PINs. A PIN that is a birth year, the last digits of your phone number, or four digits someone watched you type at an agent point is not much of a lock. And no genuine agent needs you to say your PIN out loud.

Identity-detail resets. Nagad's self-service PIN reset asks identity questions — your NID number, date of birth and recent transaction details. Anyone who collects those details about you (a carelessly shared NID photocopy, details given to a fake "officer") can attempt to use them against you. That is one more reason the reset questions must stay private.

Nagad account hacked: what to do in the first 10 minutes

Call 16167 — or 096 096 16167 from any phone — and ask Nagad to freeze the account. These are the only two helpline numbers Nagad itself publishes, and Nagad's own terms say it contacts customers only from these numbers. If your phone is lost, stolen or you suspect it is being watched, call from a family member's phone instead.

On the call, be specific: say your account has been compromised, that transactions you did not make have taken place, and that you want the account frozen immediately so nothing more can leave it. Give the details of each transaction you did not authorise. Then ask three things before you hang up: the complaint or reference number for your report, the name of the agent you spoke to, and what happens next in the dispute process. Write all of it down, with the time of the call.

Two things not to do in these minutes. First, do not share any OTP that arrives while you are dealing with the problem — the real Nagad will not ask for it, but the criminal who emptied your account may call again pretending to be "reversing" the transaction. Second, do not pay anyone a "processing fee" to unfreeze or reverse anything; Nagad's published terms say it will never ask you to make a payment to anyone.

Before anything can be deleted, screenshot the evidence: transaction messages, the scammer's number, any chat or page that tricked you. If your phone itself was stolen, also ask your operator to block the SIM, because whoever holds it can receive your OTPs.

Step 2: Take back the account — reset your Nagad PIN

Once the account is frozen, the PIN the criminal used must die. Nagad offers a self-service PIN reset by USSD, described in Nagad's official press release (reported by The Business Standard): dial *167# from your registered number, then press 8 to open the PIN-change option. You will see two choices — 1 for a forgotten PIN and 2 for resetting/changing the PIN. Choose 1 if you no longer know or control the PIN. You will be asked for your NID number, a confirmation text will be sent to your number, and you will then enter your date of birth and answer questions about your recent transactions — whether you made any in the last 90 days, what type they were, and the amount of the last one. Answer correctly and you can set a new PIN.

Three details from that same release matter. A new PIN's four digits must not be consecutive numbers, and you should also avoid birth years and phone-number digits — pick something a person who knows you could not guess. You get a maximum of five attempts at the self-reset; fail them and the reset option is blocked for four hours, during which the call centre (16167) is the route. And menus can change over time — if your *167# menu does not look like this, stop guessing and call 16167 rather than pressing random options on a compromised account.

If you can still log in normally, change the PIN anyway, check your full statement in the app or by USSD for any transaction you do not recognise, and reinstall the app only from the Google Play Store if you suspect a fake app was involved. Never reset a PIN by following instructions from a Facebook page or a caller — only through *167#, the official app, or the helpline numbers above.

Step 3: File the dispute with Nagad — and what to tell them

The freeze call starts your case, but treat the dispute as a formal process. Nagad's investigators can only work with specifics, so gather your evidence, and put it in writing as well as on the phone. Nagad's published support email is info@nagad.com.bd — send the same details there, quoting the reference number from your call, so your complaint exists in a form you can later show to Bangladesh Bank.

Have these ready:

• Your Nagad account number and the name it is registered under
• The transaction ID (TrxID) of every transaction you did not make — these are in the confirmation SMS messages and your app statement
• The amount, date and time of each disputed transaction
• The number the money went to, if it is visible
• A short, honest account of how it happened: the call, message, page or app involved, and the number it came from
• Screenshots of the messages, the fake page, or the call log
• Your police GD number, once you have filed it (next step)

Ask Nagad directly how long the investigation should take, how you will be updated, and — if the answer goes against you — insist on the final response in writing. That written decision matters: Bangladesh Bank's complaint centre requires a copy of the provider's final response before it will take up your case. Keep a simple log of every call: date, time, who you spoke to, what was promised.

Step 4: File a GD at the police station

A General Diary (GD) entry at your nearest police station is the official record that a crime was reported, and it strengthens everything else you do — Nagad, Bangladesh Bank and any court process may all ask for it. Go in person; fraud is a criminal matter, so a station visit is the reliable route. Bring your NID, your phone, printed or saved screenshots, the transaction details, and your Nagad complaint reference.

Describe what happened in plain order: when you discovered it, which transactions are not yours, how you believe the compromise happened, and what you have already done (freeze call, dispute). Give the scammer's number if you have it. Make sure you leave with the GD number and a copy or clear photo of the entry — you will quote that number repeatedly. Online financial fraud cases can be referred onward to the police's specialised cyber units; if there is any immediate danger, the national emergency number is 999.

Do not skip this step because the amount seems small. Fraudsters run the same script on hundreds of people, and GD reports are how police connect those cases.

Step 5: If Nagad does not resolve it — complain to Bangladesh Bank

Bangladesh Bank's Customer Interest Protection Centre (CIPC) is the regulator's complaint desk for banks and mobile financial services, including Nagad. Its published procedure is a three-step ladder, and it expects you to climb the first two steps first: complain to the provider, then to the provider's own complaint cell if the first response fails. Only then does the CIPC take the case up — which is why the written final response from Nagad matters.

To reach the CIPC:

• Hotline: 16236, during office hours on working days
• Email: bb.cipc@bb.org.bd
• Online complaint form on the Bangladesh Bank website (bb.org.bd), or a written complaint to the CIPC at Bangladesh Bank's head office in Motijheel, Dhaka

Bangladesh Bank asks for a detailed description of the complaint with your name, address and contact information, a copy of Nagad's final response or decision, and copies of your supporting documents — your GD, screenshots and transaction records. Be accurate and complete — anonymous complaints, and third-party complaints without the account holder's written authorisation, are not accepted. The CIPC can press Nagad to review and answer your case properly, but it is an escalation route, not an instant refund button.

What Nagad can and cannot reverse — the honest answer

You deserve a straight answer here, because false hope is itself a tool scammers use. A completed mobile-money transfer is not like a card payment with a simple undo button. In practice, your chances depend mostly on speed and on where the money is now.

If you reported the theft within minutes and the money is still sitting in the recipient's wallet, Nagad has the best chance of freezing it in place while the dispute is investigated — this is the strongest argument for the immediate 16167 call. If the money has already been cashed out at an agent point or moved on through other wallets, recovery becomes much harder and usually depends on the police investigation catching those involved. If you were manipulated into sending the money or authorising the transaction yourself — the classic fake-officer script — expect an uphill fight: providers treat customer-authorised transactions differently from a pure account takeover, and no refund is guaranteed even with a GD and a complaint.

What is certain: Nagad will never require you to pay money to release, reverse or "process" your own stolen funds, and anyone who asks for such a payment is continuing the theft. File everything anyway. Disputes and GDs sometimes succeed weeks later, they cost you nothing but time, and unreported theft is theft the system never even counts.

Warning: the second scam wave targets hacked Nagad account victims

Within hours of a theft, a second group often comes for what is left: you post in a Facebook group asking for help, or search for a "Nagad helpline number," and a helpful account messages you — a "Nagad support officer," a "recovery agent," sometimes a page with Nagad's logo and thousands of followers. They will ask for your OTP or PIN "to verify the reversal," or a fee sent to a personal number "to unlock the refund." Some victims are called by the original scammers, now posing as Nagad staff checking on the complaint.

Defend yourself with the two fixed points Nagad itself publishes. Its helpline is only 16167 and 096 096 16167, it contacts customers only from those numbers, and it never asks for your OTP or PIN and never asks you to pay anyone. Any other number, page or agent — however official it looks — fails that test. Do not post your account number, TrxIDs or screenshots publicly while asking for help; you are handing the second wave its script.

Prevention checklist: make it hard to hack your Nagad account again

• Treat your PIN and any OTP as cash: nobody legitimate — not Nagad, not police, not a bank officer — will ever ask for them
• Set a PIN that is not consecutive digits, not your birth year, and not part of your phone number — and change it if anyone has ever seen you type it
• Use only the official Nagad app from the Google Play Store, and *167# for USSD; never install an app sent as a link or file
• If any call about your account feels urgent or frightening, hang up and call 16167 yourself — urgency is the scammer's main weapon
• Check your statement regularly in the app or by USSD, so a small test theft is caught before it becomes a big one
• Do not share copies of your NID, or your date of birth and transaction details, with strangers — together they are the keys to the PIN-reset questions
• Teach the same rules to your parents and family members; scammers deliberately target people who are newer to mobile money

Frequently asked questions

What is the very first thing to do if my Nagad account is hacked?
Call 16167 (or 096 096 16167) immediately and ask Nagad to freeze the account and record your dispute. Speed is the single biggest factor in whether stolen money can still be stopped. Do this before calling anyone else, and do not share any OTP that arrives during the process.

What is Nagad's real helpline number? I have seen other numbers online.
Nagad's official helpline is 16167, with 096 096 16167 as the longer form. Nagad's own terms say it contacts customers only from these two numbers. Other numbers circulating online — including 16216, which belongs to a different service — are not Nagad numbers, and pages or people directing you to them should not be trusted.

How do I reset my Nagad PIN if the hacker changed it or I forgot it?
Dial *167#, press 8 for the PIN-change option, then choose 1 for a forgotten PIN. You will need your NID number, your date of birth, and answers about your recent transactions, such as the amount of your last transaction. You have up to five attempts; after that the option is blocked for four hours and the call centre at 16167 is your route.

Can Nagad actually give my money back?
Sometimes, but never count on it. If you reported the theft fast and the money is still in the recipient's wallet, Nagad may be able to hold it during the investigation. Once money is cashed out, or if you were tricked into authorising the transaction yourself, recovery is much harder and may depend on the police case. Anyone who guarantees a refund — especially for a fee — is running the second scam.

Will Nagad ever ask for my PIN or OTP?
No. Nagad states in its published terms that it never requests a customer's OTP or PIN, and never asks customers to make a payment to anyone. Any caller, page or "agent" who asks for any of these is a criminal, whatever name or number they show.

Nagad has closed my complaint and I am not satisfied. What else can I do?
Escalate to Bangladesh Bank's Customer Interest Protection Centre: hotline 16236 during office hours on working days, or email bb.cipc@bb.org.bd. You will need your detailed complaint, supporting documents, and a copy of Nagad's final response — one more reason to insist on that response in writing.

Sources

• The Business Standard — "Nagad launches self PIN reset option" (Nagad press release: *167# PIN reset flow, attempt limits, call centre numbers, "Nagad never asks for the PIN"): https://www.tbsnews.net/economy/corporates/nagad-launches-self-pin-reset-option-272182
• Nagad Islamic (official Nagad site) — offer terms stating Nagad never requests OTP/PIN, never asks for payments, and contacts customers only from 16167 / 096 096 16167: https://nagadislamic.com.bd/en/offer/unlimited-cashback-as-gift-on-banglalink-recharge/
• Nagad official website: https://nagad.com.bd/
• Bangladesh Bank — Customer Interest Protection Centre complaint procedure (hotline 16236, bb.cipc@bb.org.bd, three-step escalation): https://www.bb.org.bd/en/index.php/services/cipc_procedure

Related reading: bKash OTP Scam: How It Works, Warning Signs, and How to Protect Your Money · Clicked a Phishing Link? What to Do Next, Step by Step