Mobile financial services depend on control of the phone, account credentials and identity-recovery process. Fraud can target any of those layers. This guide uses Bangladesh provider and national cyber-response guidance to explain practical protection without claiming that one security feature makes every account safe.
Treat identity recovery as part of payment security
A mobile wallet’s registered identity and phone number may be needed when access is lost. Keep those details accurate through the provider’s official process. Do not send a fresh identity-card image or face video to a stranger who says the account will otherwise be closed. The BGD e-GOV CIRT July 2026 advisory describes malicious mobile applications that steal identity and biometric information. It notes Bangladesh’s relevance while distinguishing current Android-focused activity from older iOS reporting. That is a reason to verify the request, not to claim every identity check is fraudulent.
Keep the account’s secrets under your control
bKash security guidance says to keep the PIN, secret code and security code private, and to use your own account. A family member helping with a phone should not need to learn the PIN to explain a menu. Check the operation, recipient and amount yourself before authorising. A message that promises a refund or account upgrade can still direct you to an outgoing transfer. A familiar logo or caller name is not proof of the sender’s identity. Use a contact route you independently know.
Concrete official safety references
| Reference | Published detail | Practical significance |
|---|---|---|
| bKash lost-phone support | 16247 | Contact the provider when phone control is lost |
| bKash agent withdrawal | Use cash-out function, not personal Send Money | Keep withdrawal operation and evidence correct |
| CIRT advisory | 21 July 2026; identity/biometric theft risk | Verify app and identity-document requests |
| Bangladesh Bank CIPC | 16236 during working-day office hours | Formal financial complaint route |
These are different functions. A cyber advisory explains a threat; the wallet provider can address its account access; the regulator handles financial complaints through its process. None should be presented as a universal instant recovery service.
Install and connect deliberately
Use the provider’s official application route and keep the operating system updated. Avoid an application package delivered through a messaging conversation, especially if it requests screen sharing, device administration or broad accessibility access unrelated to the task. Public Wi-Fi or a faster mobile connection does not authenticate a payment recipient. Before using a borrowed device, consider whether credentials, notifications or identity files will remain there. If a mobile operator changes a SIM or eSIM, follow its verified identity process and check the effect on linked accounts rather than assuming everything transfers automatically.
Respond to a lost phone or unexpected account activity
From another trusted device, contact the mobile operator and affected financial providers. Explain whether the phone is lost, the SIM has stopped working or transactions appeared without your approval. bKash’s published guidance identifies 16247 for a lost phone. Keep transaction references and the time the problem began. Do not let an unsolicited caller guide you into a second payment supposedly needed to reverse the first. If access is restored, review account activity and recipient records before returning to normal use.
Preserve evidence without exposing more information
Save suspicious messages, caller details, transaction references and provider case numbers. Use the provider complaint cell where relevant and the Bangladesh Bank CIPC route for the appropriate financial escalation. Do not publish identity documents or complete account numbers in a public complaint. If the phone may contain malicious software, seek the provider’s instructions from a clean device and consider what evidence must be retained before resetting it. Restoring the handset alone does not repair an email account that was also compromised.
Mobile-wallet security checklist
- Keep registered identity details accurate.
- Verify requests for ID images or face videos.
- Never share PIN, OTP or activation credentials.
- Use the correct agent cash-out function.
- Report lost-phone and unexplained transactions promptly.
- Review account and recovery settings after access returns.
A good recovery plan includes a trusted contact route outside the only active phone. Store support references securely and explain the plan to anyone who depends on you for payments. Keep the account owner in control of authorisation rather than creating a shared pool of secret codes.
Frequently asked questions
Does a request for a face video always mean fraud?
No. Legitimate identity checks exist, but the request and application must be verified through the provider’s official process. Unsolicited requests should not be trusted automatically.
Does a faster 4G or 5G connection make a payment recipient trustworthy?
No. Connection speed and recipient identity are different matters. Read the destination and operation before authorising.
Is restoring mobile service enough after a compromise?
No. Review wallet activity, email access, recovery details and any other affected accounts. Keep the provider’s investigation references.
Sources and verification
- GoldFactory mobile identity theft advisory — BGD e-GOV CIRT — 2026-10-23
- bKash account security — bKash — 2026-10-23
- bKash complaint management cell — bKash — 2026-10-23
- Customer Interest Protection Centre — Bangladesh Bank — 2026-10-23