E-passport fraud: Bank accounts emptied with Tk 9 ‘bait’

Personal information of citizens applying for e-passports is falling into the hands of fraudsters. They then send text messages containing links to fake websites, known as phishing links. When applicants visit these websites and attempt to correct their information by paying a Tk 9 fee, fraudsters use deceptive tactics to steal all the money from their mobile financial service accounts.

Experts have described the unauthorized exposure of citizens’ personal information as a “dangerous risk.” The Department of Immigration and Passports has said it will identify the source of the problem through a technical committee and take immediate action.

The fact that applicants’ names, mobile phone numbers and the latest status of their applications are reaching fraudsters within 24 to 48 hours of submission at passport offices indicates a major vulnerability in the e-passport server and data protection system.

After applications are submitted at passport offices, applicants receive text messages from several numbers, including 09612-343176, 09648-902629 and 09648-902640. The messages, written in English, claim that passport applications have been put on hold because the names do not match those on the National Identity Card (NID) or birth registration certificates. A shortened link (shorturl.at/...) is included in the message to allow applicants to correct their names.

When applicants visit the link, they are taken to a website (pass.correction-center.sbs) that looks almost identical to the official website of the Department of Immigration and Passports (epassport.gov.bd). The fraudsters have meticulously copied the government website’s monogram, colors, layout and even the footer and copyright text.

However, while the official government website ends with the “.gov.bd” domain extension, the fake website uses the non-governmental “.sbs” extension. The website has a dedicated page for correcting names.

After entering the fake website, applicants are initially asked to provide their names and mobile phone numbers. An instruction below states that the name correction process is completely free. However, it claims that a fee of only Tk 9 will be charged to verify the applicant’s identity.

As the amount is small, applicants are easily falling into the trap. After entering their bKash or other mobile financial service account numbers and PINs, applicants unknowingly hand over complete control of their accounts to the fraudsters. The money is then withdrawn from the accounts within moments.

On October 18, Afroza Sultana, an assistant professor at Government Hazi Muhammad Mohsin College, applied for an e-passport at the Mansurabad Divisional Passport and Visa Office in Chattogram city. She also received a similar text message.

After visiting the link, she was asked to provide her name and mobile phone number according to her NID. She was then instructed to pay Tk 9 to correct her name. After providing her bKash number and entering the one-time password (OTP) and PIN, all the money in her account was withdrawn.

Mohammad Anwar Hossain, a businessman who submitted his passport application at the same office on the same day, also received a similar fraudulent text message.

Earlier, on October 17, college teacher Farzana Akter submitted passport applications for herself and her child at the Chandgaon Regional Passport Office in Chattogram. She provided her own mobile number for her application and her husband's number for her child's application. Later, both numbers received similar text messages. However, her husband remained cautious and she did not visit the link.

Miraj Ahmed Chowdhury, managing director of Digital Rights, a digital rights and research organization, told Agamir Somoy, “Citizens’ personal information falling into the hands of fraudsters in this way is risky. The Department of Immigration and Passports should identify the point from which the information is being leaked and take action. An urgent investigation should be conducted to identify those involved and reassure citizens.”

Mohammad Nurul Hafiz, additional director general of the Department of Immigration and Passports, said, “Someone informed me about this a few days ago. However, he did not contact me again. A special warning has been posted on the Department of Immigration and Passports website so that people do not fall into the traps of such fraudsters. Nevertheless, we will sit with the technical committee to identify the issue and take action very soon. This should not happen from our server because it is secure.”