From Facebook ads to WhatsApp groups: The trap of stock market investment fraud

Impressive advertisements on Facebook and Instagram promise quick returns from the stock market. From the ads, users are directed to WhatsApp groups filled with staged praise and so-called expert advice. The next step involves registering on fake websites or Android apps, followed by instructions to send money via bKash or Nagad. This is how a multi-platform fraud network has been built to exploit unsuspecting investors.

A one-month investigation by Dismislab has revealed the scale and extent of this scheme. In September alone, hundreds of advertisements were running from at least 15 Facebook pages, all aimed at drawing users into newly created WhatsApp groups. At least 20 such groups have been identified, with their combined membership exceeding 3,000. These groups are operating under the names of two legitimate brokerage houses in Bangladesh: City Brokerage Limited (CBL) and BRAC EPL Securities.

Dismislab researchers joined multiple groups posing as potential investors and followed the entire process. In the group operating under the name of CBL, investors were directed to a fake Android app, while the BRAC group led them to a fake website. From there, users were instructed to transfer money directly into personal accounts through banks and mobile financial services like bKash and Nagad. By bypassing legitimate brokerage accounts, the fraudsters are funneling money directly into their own pockets.

Some of the ads have featured the names and images of prominent personalities, such as Dr. Muhammad Yunus, the chief advisor of the interim government, and Dr. Zahid Hussain, the former lead economist for the World Bank’s Dhaka office.

Brokerage firm officials told Dismislab that they have officially notified both the Bangladesh Securities and Exchange Commission (BSEC) and the Criminal Investigation Department (CID) of the police in writing about this scam. For its part, the BSEC has issued a warning but, at the time of writing this report, most of the WhatsApp groups were active, even as new advertisements were popping-up on Facebook every day. 

Similar scams have previously been reported in India, where social media, messaging platforms, and fake websites were used to lure ordinary users with promises of high returns from stock market, ultimately defrauding them of millions of rupees.

Exploiting the names of BRAC EPL and City Brokerage to deceive investors

Dismislab’s investigation reveals that this scheme is primarily divided into two branches: one  operating WhatsApp groups using the name of City Brokerage and the other under the name of BRAC EPL. In this investigation, seven groups were found using the name of CBL and 13 groups using BRAC EPL’s name. The actual number may be higher.

The groups identified as CBL collect money from investors through a fake Android app named CBLPG. In contrast, the scheme run under the name of BRAC EPL uses a fraudulent website named anmbracbxt.com. This is the primary difference between the two branches of the scam.

The two types of WhatsApp groups are operated by different individuals, each using separate phone numbers, distinct identities for the purported experts, and varying styles of communication  within the groups. However, the underlying method of the fraud remains the same.

For this investigation, Dismislab penetrated five groups operating under the name of BRAC EPL. Each group posts a tip or piece of advice exactly at 11:00 in the morning. In all cases, a person named “Nusrat Jahan” identifies herself as a BRAC EPL official and asks members to contact her. The language used in admin messages across these groups is identical. In contrast, the group using the CBL name features individuals claiming to be brokerage officials – Zahiruddin Shah and Anwesha Basu – who provide investment advice.  The tone and language of messages in this group differ significantly from those in the BRAC EPL group. 

The connection between the two sets of WhatsApp groups can be traced in the promotional strategy. At least seven Facebook pages were found actively promoting both sets of WhatsApp groups CBL and BRAC EPL. In at least six cases, identical graphics cards and messages were used in the campaigns for both sets, suggesting a shared approach.

The investigation revealed that the same Facebook pages consistently participate in these campaigns, opening new WhatsApp groups every week. Hundreds of users are joining these groups regularly. The type of advertisement is more or less the same; only the WhatsApp group linked to the advertisement gets changed over time. 

The advertisement on the left is from September 6; it ran a campaign for a WhatsApp group bearing the CBL name. The advertisement on the right ran on September 25. The graphics card and information are the same, but following its “Apply Now” button leads to a WhatsApp group bearing the BRAC name. Both advertisements were run from a Facebook page named Colton Casey Olivia.

Dismislab launched this investigation  on September 6, 2025. Every advertisement documented during that week led to a WhatsApp group bearing  CBL’s name. This pattern shifted the following week. Every advertisement recorded on September 14 redirected researchers to a WhatsApp group under the BRAC name. Further documentation on September 20 and 25 revealed  new groups, each using the name and logo of BRAC or BRAC EPL, suggesting an evolving strategy to scam users.

During data collection, Dismislab found that each group had between 65 and 250 members. Across the 26 groups,  more than 3,000 members had already joined, all in the hope of making a profit. The investigation reveals that the app named CBLPG has been downloaded at least 1,200 times, showing how many users may have been misled by this scheme.

Ahsanur Rahman, chief executive officer of BRAC EPL Securities, told Dismislab that they have no links with these groups. He described the operation as a fraudulent scheme that has misled many of their clients and damaged their reputation. A representative from City Brokerage expressed concern over the scam and confirmed that they have reported the matter to the capital market regulator and the police.

WhatsApp groups and Dr. Zahid Hussain

In the first screenshot, the message announcing the arrival of Dr. Zahid Hussain is being delivered by Nusrat Jahan, and in the second screenshot, the purported Zahid Hussain introduces himself.

September 15, 10:00 AM. A message in the group  announces that Dr. Zahid Hussain will be joining the following week to hold a ‘live’ session and offer tips to minimize losses and ensure profits in share trading. The message was sent by Nusrat Jahan, who claimed that Dr. Zahid is her teacher. And because Dr. Zahid was busy preparing for a conference,   she, as his assistant, had been providing daily updates to the group members.

To lend credibility to Dr. Zahid’s arrival, a supposed investor named “Sajid Chowdhury” joined the discussion shortly after. He shared a news link in the group and stated, “I am also watching the latest news on Dr. Zahid Hussain, which is why I’m joining this group to learn.” The main content of the news was that an “AI Quantitative Trading Promotion Conference” would be held at the Inter Continental Hotel in Dhaka, to be organized by BRAC EPL Stock Brokerage with approval from BSEC. Dr. Zahid would chair it.

The news link is from a site named Digital Journal, known for publishing paid content. Each month, it publishes about 70,000 articles, a reason why spammers use the site to publish content.

Following the announcement and the staged approval, a series of messages flooded the group: “I have been waiting a long time for Dr. Zahid’s return,” “So cool! When Dr. Zahid Hussain guides us, we will be much more steady in trading,” and so on. Their names were variously Sumaiya Akter, Nawshin Jahan, or Ashikur Rahman.

The group is called “H111-BRAC Securities Trading Study Group,” one of the four using BRAC’s name that Dismislab joined for the purpose of this investigation. The other three groups are: J901 BRAC Investment Research Exchange, S1-BRAC Securities Strategy Group, and L215 BRAC Securities Investment Strategy. Strikingly, the messages or posts regarding the arrival of Dr. Zahid Hussain and the anticipation for it in the H111 group were posted at almost the same time, with the exact same content, in the same sequence, and sometimes even under the same names, in the other groups as well.

The groundwork for the fraud was prepared in advance by promoting advertisements on Facebook using the picture and name of Dr. Zahid Hussain.

Around 10:30 AM on September 22, an individual identifying himself as Dr. Zahid entered the WhatsApp group and wrote: “Dear friends! I am Zahid Hussain, currently the chief analyst of BRAC EPL Securities. Spending time with you here every day is very valuable to me.” He further stated that after retiring from the World Bank, he shifted focus on the development of Bangladesh’s capital market. He also expressed hope that he would be able to provide investors with “future-oriented market analysis” in the group.

This individual appeared in the four groups monitored by Dismislab at nearly the same time, and while his name was identical in each group, the phone numbers were different. Dismislab placed direct calls and WhatsApp calls to every number associated with his name, but received no response.

The actual Dr. Zahid Hussain is a distinguished economist and was the Lead Economist for the World Bank’s Dhaka office. He currently serves as a Director of BRAC EPL Stock Brokerage Limited and as an Independent Director of BRAC Bank. Dr. Zahid told Dismislab that he has no connection to these groups or the advertisements. He stated that the news about the purported conference is fake, and he was surprised to see such advertisements on Facebook. Dr. Zahid advised everyone to be cautious about this type of fraud. He said, “Any  investment opportunities should be thoroughly verified before proceeding.”

Diverse deceptions in WhatsApp groups

The introductory message in each group under BRAC’s name comes from Nusrat Jahan. For example, upon Dismislab researchers joining the “H111” group, she sent the message, “Welcome to the Official Stock Strategy and Investment Discussion Group.” The message promises trading advice, market trend analysis, and sessions at specific times every morning and noon. She concludes by sharing a link for personal contact. In the other groups, Nusrat Jahan also introduces herself as an official of BRAC EPL Stock Brokerage Limited, and promises to share information about  recommended stocks in the group at 11:00 AM daily. More information is offered via personal chat with her.

In the screenshots of two separate groups, the praisors have the same post, the same name or profile picture but different phone numbers.

Within minutes, the group floods with staged posts and feedback full of praise.  For instance, in “S1-BRAC,” several accounts named “Jahidul Islam,” “Rokea Begum,” “Naim Hasan,” and “Ziaul Haque” quickly wrote, one after another, that they are happy with the group’s advice, are preserving daily records, and have ranked the group at the top. The exact same message is repeated verbatim, within minutes, in the other three groups under Dismislab’s observation.

The profiles of the praising accounts also reveal a distinct pattern. For example, the photo of “Rokea Begum” in one group is used under the name “Salma Khan” in another. Similarly, names like “Sajid Chowdhury” or “Khalil Ahmed” are recurrent in the same types of messages. At least six praising accounts with the same names were found in each group, though their phone numbers differ from group to group.

While the groups using the name of CBL feature different individuals, the underlying scheme remains the same: one “expert” and one “assistant” (like Nusrat and Zahid in the BRAC group), and a host of supporters praising the group. In the “D1826 CBL Official Stock Strategy Community” group, the first message came from an account named “Assistant Anwesha Basu.” It promised “high-quality stock recommendations and exclusive insider information” at 11:00 AM daily. “Zahiruddin Shah,” who identifies himself as the institution’s CIO, regularly posts messages in this group and provides market analysis and guidance. However, no such name or picture was found in the management or directorial team of City Brokerage Limited, making it obvious that these are all fictitious names, made up only to deceive users.

In the first screenshot, the post is from “Assistant” Anwesha Basu of the group bearing the CBL name, and in the second, it is from “Expert” Zahiruddin Shah.

Dismislab was able to access only one group operating under the CBL name for observation. Much like the BRAC groups, this one also featured a set of approvers who post praise or supportive messages immediately after Zahiruddin or Anwesha post something in the group. Several accounts even used foreign-sounding names. For example, at 9:39 PM on September 16, “Raymond Dlamini” (original name in English) wrote, “Tonight’s class was very beneficial for me…” On September 18, “Michael Makgoba” wrote, “CBL team is willing to take responsibility with courage, so I trust them.” Following this, “Jason Botha” wrote, “This is the most responsible team I have ever seen.” (Original messages in English)

Even the names of group members reflect a noticeable foreign pattern –Andile Ndlovu, Bafana Ndlovu, Erika Thomas, Hendrik Miller, just to name a few. The bio or description of several accounts is written in Hindi. For example, the bio of an account named Stephen De Villiers reads, “आइए हम एक साथ स्वास्थ्य और खुशी की राह पर चलें” (Let us walk together on the path of health and happiness).

In the CBL group, the bios (or descriptions) of various accounts are seen written in the Hindi language.

From WhatsApp groups to MFS

The group using the name of City Brokerage introduced a new concept of a “Customer Representative” on September 18. Announcing the initiative at 9:54 AM, “Anwesha Basu” welcomed all members, and  a few minutes later, she identified herself as that Customer Representative and shared a link.

When clicked, the link opens a new chat window where an account named “Customer Service No. 086” had already posted an automatic message: “Hello, I would like to apply for a membership”. After Dismislab sent that message, it returned a brief about CBL Securities, promising  “30% to 80% return within 15 days.” When researchers expressed interest, she instructed them to download an app named “CBLPG” from the Google Play Store.

After installing the app, one must register in the group. This involves providing a mobile number, a six-character password, a CAPTCHA, and an “Official Code.” This code comes from the Customer Representative. The app can be accessed only after registration, when it displays various slides using City Brokerage’s name. Features such as IPO, Block Trade, Loan, Deposit, Withdraw, Bank Account, and Wallet are also visible there. There are two options for depositing money: Bank and Wallet. The minimum deposit is BDT 5,000.

After September 22, the same pattern emerged in the groups using the name of BRAC EPL. An account named “Sadia” identified herself as a BRAC EPL customer service staff member, stating that she was responsible for answering any questions either in the group or in private chat. This exact message, sent on the same day, was found in all four groups associated with the BRAC name.

The app using the name of CBL and the website using the name of BRAC

After sending the message, she sent a link which, once clicked, opened her personal WhatsApp chat. The name “Sadia” was also visible in the profile. Upon contact, she instructed researchers to type and send “1” to initiate investment services. She then sent a link to a website named anmbracbxt.com. This site, bearing the name and logo of BRAC EPL, presented an option to open a “High Net Worth Trading Account,” and requested registration. For the registration, she sent an “Official Code”. After registration, options for depositing money via Bank and Wallet appeared – with the minimum deposit requirement being BDT 10,000. The next step involves submitting a KYC (Know Your Customer) information, although Dismislab did not proceed further due to security concerns.

While two separate schemes are operating under two names of BRAC and CBL, the way they pocket money is identical. Although one uses an app and the other a website, their visual design and structure are demonstrably the same. When screenshots and links of the app and website were sent to the Chief Executive of BRAC EPL and market experts, they confirmed that these have no connection with City Brokerage or BRAC EPL and are unauthorized.

Accepting deposits using bKash and Nagad on the fake app and fake website

Both schemes have options for depositing money via Bank and MFS (Mobile Financial Service) channels like Nagad and bKash. For bank deposits, a special “channel password” must be provided, which the “Customer Service Representative” supplies. However, for mobile wallets, there is no password restriction. Here, customers are asked to directly send money to two specific numbers via the Send Money option. The account becomes active simply by sending the money and sharing the reference number. Due to the simplicity of the process, many users choose MFS. This allows scammers to target personal numbers, and divert funds  directly into their personal wallets, without any connection to any authorized brokerage accounts.

How do the Ordinary users fall victim?

Dismislab entered the WhatsApp groups upon noticing the fake advertisements, proceeded to the website and app, and even followed the instructions for deposit, but did not send money at the final stage. This is where ordinary, unsuspecting investors are defrauded. This is because the fabricated environment within the group, the fake website, and the easy transaction structure of the MFS seem real enough to entice them to send money. The question then is, how do the fraudsters profit once the money is deposited? An identical scam in India offers some crucial insights. 

On April 29, 2025, Nithin Kamath, co-founder of Zerodha, one of India’s leading financial institutions, posted a warning on his official X account. He wrote, “Among all investment scams, the one that has claimed the most victims is the WhatsApp investment scam.” According to his description, the fraud had four steps:

1. Victims were added to fake groups named “Zerodha Elite Traders” or “Premium Investors Club.” The logo, color, and license number were used in such a way that they appeared genuine. Admins identified themselves as co-founders or employees of Zerodha.

2. Within a few hours, the chat filled with false praise, screenshots, and promises of 100-200% daily returns.

3. Customers were told to download a fake app to receive “premium signals.” Although the app resembled Zerodha’s Kite app, the profits shown there were imaginary.

4. When someone attempted to withdraw the profit or the capital, they were asked to pay new processing fees, taxes, or verification charges. After collecting these fees, the fraudsters would disappear and block the customer.

In Nithin’s post, one user commented that they had received an invitation and joined such a group but became suspicious due to a slight difference in the Zerodha logo and reported the matter to the cybersecurity team. They also shared a screenshot of a fraudulent group named “B1 India Chief Wealth Planner.” It is notable that the structure of the group’s name, the use of the logo, and the description align with those of the fake groups in Bangladesh. The Dhaka Stock Exchange has reported that many investors in Bangladesh have also lost money after being lured by the temptations of this type of fraud ring.

On June 27, Indian media outlet Mint published a report on fraud conducted through similar WhatsApp groups. The report stated that a retired academician from Andhra Pradesh named Dr. M. Batmanabane Mounissamy lost about two crore rupees this way. He is the former director and professor of the prestigious Jawaharlal Institute of Postgraduate Medical Education and Research (JIPMER) in Pondicherry.

Similarity between fraudulent WhatsApp groups in India and Bangladesh

Earlier on June 18, Dr. Mounisamy lodged a complaint with the police that fraudsters had cheated him by identifying themselves as representatives of the financial institution Nuvama. He was initially added to a WhatsApp group named “H-10 Nuvama Health Group.” The group offered various investment tips and promises of insider information. Since he had already invested with Nuvama, he thought the group was genuine. Later, as he proceeded to pay in stages, he lost two crore rupees.

This scam does not trap victims immediately, it rather unfolds gradually over time. Initially, small investments are encouraged and modest profits are shown to gain trust. Once trust is built, victims are slowly lured into making bigger investments. While the fake platform displays an imaginary balance of millions, the real problem arises when the victim attempts to withdraw the money. At this point, new funds are demanded in the name of processing fees or taxes. Most victims don’t realize at the beginning that they are being defrauded. By the time they do, they have already suffered significant financial loss – too late for them to seek legal redress.  

How technology facilitates fraud

Every step of this scheme involves  use of technology, raising questions about the responsibility of tech platforms. From Facebook and Instagram, hundreds of ads are run using obscure accounts,  drawing users into WhatsApp groups that serve as the entry points to this deceptive scheme. During the four days of data collection from the Meta Ad Library for this investigation, more than 50 advertisements were running from various pages on a single day alone. These ads originated from 15 pages that have been active for more than a year. These pages have no other activity on their profiles other than running ads, and most of their administrators are located in Vietnam or the United States. Two admins are located in Bangladesh.

Next comes the encrypted messaging platform WhatsApp, where customers are  lured into investments under fake names and identities, using the names of well-known investment companies. Twenty such groups have been documented in this single investigation. Numerous mobile numbers from Grameenphone, Robi, and Banglalink are being used for this activity, raising questions about how and in whose name they were registered. This investigation documented more than 29 phone numbers belonging to the admins, experts, and advocates in the 5 WhatsApp groups that Dismislab monitored in September. 

Then there is the use of AI, which begins with the advertisements. The language of the Facebook advertisements (about 40) that were analyzed is robotic, and some of the images appear to be AI-generated upon initial inspection. For example, in an advertisement from a page named “Jessica Peggy Bolin,” the image of Dr. Muhammad Yunus has been edited with AI tools. The graphics card for the advertisement in Bangla language reads, “Target price: ৳569. Expected next month. It has increased to ৳1268. Buy 50 shares. Buy now and get ৳60000.” But the sentence structure resembles that of the English language, meaning they were likely translated from English. Another advertisement with the same caption featured an image of Dr. Zahid Hussain. 

An analysis of at least 40 advertisements shows that their content is mechanical (machine-generated) and the message is nearly identical. In the promotion of every group, graphics cards with several specific themes are being created from the same pages, and there is no human oversight with knowledge of Bangla.

Uses of the nearly similar message, identical graphic cards, and mechanical Bangla (machine-translated language) in advertisements run from two different pages.

The same applies for the WhatsApp group messages.  Dismislab observed that the messages delivered by the so-called experts or admins use mechanical language and are often literal translations of English text. For example, Nusrat Jahan wrote in a group in Bangla (translation ours), “Friendship Souvenir: The group will soon enter a temporary silence state. For the purpose of ensuring clear information transmission and securing every member’s account, the group will undergo a temporary silence time period.” Here, in Nusrat’s Bangla post, “বন্ধুত্বপূর্ণ স্মরণিকা” (Bondhuttapurno Shoronnika) is a literal translation, likely with AI, of “Friendly Reminder.” Even the messages from the so-called “approvers” are mechanical. The timing of message delivery in the group, the similarity in the wording in the messages, and the identical answers to questions indicate automation in group operation as well.

Similarly, Google is allowing the space for the fake trading app, modeled after City Brokerage, on its Play Store. By using payment platforms like bKash and Nagad, the fraudsters are availing the opportunity to transfer money into their personal accounts.

On the use of MFS in this fraud, economist Dr. Zahid Hussain said, “Whether MFS institutions have legal liability or not, they certainly have a moral liability. Because their platform is being used to perpetrate fraud.” He further added, “This will lead users to lose trust in them, which will hinder the expansion of their future business.”

Shamsuddin Haider Dalim, Head of Corporate Communications and PR at bKash, one of Bangladesh’s leading MFS (Mobile Financial Service) providers, told Dismislab, “bKash has the appropriate technology and trained personnel deployed for regular monitoring and taking necessary measures to prevent all related illegal transactions, including online fraud.” He further stated that as part of a coordinated initiative to prevent various types of illegal transactions, they provide all necessary assistance in the investigations of law enforcement agencies through the regulatory body.

Scale of the fraud increasing

Evidence gathered by Dismislab indicates that this is a fraudulent scheme. The identity of reputable institutions is being faked, individuals are posing as officials of well-known personalities or institutions to advise people to invest in specific stocks, and unauthorized sites or apps are being created to facilitate transactions. India offers an example of how people are losing money to fraud networks. 

The Facebook pages, the nature of the advertisements, and the fraud scheme itself indicate the involvement of both domestic and foreign groups. Dismislab called 23 of the 29 numbers found during the investigation—belonging to admins and alleged experts—directly and 12 numbers via WhatsApp. Attempts to contact via direct calls failed, as the numbers were found switched off. No one answered the WhatsApp calls. A representative of Dismislab was immediately removed from one group immediately after joining the group.

Reports on similar scams have already appeared in various national media outlets in Bangladesh. These reports described how scammers first gain trust of potential investors by showing small profits, then entice victims into making larger investments by promising higher returns, and ultimately sever contact after siphoning off funds. Increasingly, these fraudulent networks are leveraging artificial intelligence (AI) to deceive people through social media platforms.

After becoming aware of the matter, City Brokerage formally notified the BSEC and the police. BRAC EPL authorities filed a General Diary (GD). The SEC has also advised people to be vigilant. However, the problem has not been resolved.

Ahsanur Rahman, Chief Executive Officer of BRAC EPL, said, “Many people are joining and trusting these groups after seeing their name and logo. This not only puts investors at risk but can also damage the reputation of the institution.”

As of the writing of this report, the advertisements are still running, and new WhatsApp groups are popping-up every week. On September 26 alone, four new groups surfaced, which are outside the groups documented in this research. New members continue to join the groups. 

Md. Abul Kalam, spokesman and director of the BSEC, did not respond.