What are phishing and OTP fraud?
Phishing means “casting bait”: fake calls, SMS, emails, Facebook messages or copycat websites that make you believe you are dealing with a real organisation. The aim is always the same: to get your PIN, password, card number or other secret details.
An OTP (one-time password) is the single-use code sent to your phone during a payment or login. It is the last lock on your account. Even someone who knows your PIN or password often cannot complete a transaction without it, so fraudsters invent some story to get exactly this code.
Say Nasrin gets a call one evening: “Apa, I’m calling from customer care. There’s a problem with your account and it will be closed unless we fix it now. A code has been sent to your phone; please read it out.” The voice is polite and the number looks almost genuine. Minutes after she reads out the code, the money is gone. The story is made up, but the trick is very common.
Why it matters to an investor
- Savings and investments now live largely on your phone: bank, mobile wallet, BO account, and the key to all of them is a PIN or OTP.
- This is not a rare problem: in a 2021 survey, nearly 1 in 10 mobile financial service users reported having faced some kind of fraud.
- Once the money has gone, it is hard to recover, and it gets more complicated when you yourself “approved” the transaction by giving the OTP.
- The same trick comes in investment clothing too: people posing as a “broker”, “fund manager” or “regulator” to ask for details or money.
Common tricks in Bangladesh
Police and media reports keep describing the same handful of tricks. Calls from numbers that look like a customer-care line, asking for your PIN; in December 2024 Police Headquarters warned that fraudsters were even calling from numbers made to look like the 999 emergency line to ask for mobile wallet and card PINs, although 999 never asks for such details.
- “I sent money to you by mistake, please return it”: in fact no money arrived, only a fake SMS.
- News that you have won a lottery, prize or scholarship, and a request for your PIN or a fee to “release” it.
- A link to a fake website saying “your account/SIM will be blocked, verify now”.
- An urgent request for money from a friend’s hacked Facebook or messaging account.
- SIM replacement or SIM swap: getting a new SIM issued on your number so the OTPs go to the fraudster.
Why smart people still fall for it
This fraud works on the mind, which is why it is called social engineering. Three ingredients are almost always present: authority (“I’m from the bank/police”), fear or greed (“your account will close” or “you’ve won a prize”), and urgency (“right now, within 5 minutes”). In a hurry, people do not stop to think, and that is exactly what the fraudster wants.
Habits that protect you
- Never share your PIN, password or OTP: banks, mobile wallets, the police and government bodies never ask for them over the phone.
- If someone calls saying they are “from the office”, hang up and call back yourself on the official number printed on your card or in the app.
- Instead of tapping a link in an SMS or message, open the app yourself and check your balance.
- Read the whole OTP message: it often says which transaction and what amount the code is for.
- If your phone suddenly loses signal and it does not come back, contact your mobile operator quickly; it can be a sign of a SIM swap.
Common mistakes
- Thinking “they were polite and knew my name and number, so they must be real”. Fraudsters often have these details already.
- Thinking “I only gave the code, not my PIN”. The OTP is often the final key to the transaction.
- Waiting out of embarrassment or fear. The faster you report it, the better the chance of freezing the account.
- Using the same PIN or password everywhere, so one leak opens every account.
Your OTP and PIN are for you alone; whoever asks, however urgent their story, the answer is always no.