Pay Tk9 to confirm Indian visa appointment: How fraudsters steal from applicants’ bKash
An applicant waiting for an Indian visa appointment received an SMS on their mobile phone with instructions to “verify.” The message asked them to pay Tk9 to confirm the appointment. Clicking the link in the message opened a page built to resemble the website of the Indian Visa Application Centre (IVAC). After they followed the payment process there, the fraudsters took more than Tk10,000 from their bKash account in several steps within a minute. Another visa seeker told Dismislab that they were defrauded in the same way.
To apply for an Indian visa, Bangladeshi citizens must take an appointment through the Indian Visa Application Centre (IVAC). According to information published on IVAC’s website, applicants can book a slot through the online appointment system to submit documents. SM Amanur Rahman Rafat was waiting for this very appointment after booking a slot.
Rafat told Dismislab that he applied online for an Indian visa in September this year. His appointment to submit his visa documents was at noon on October 8. At 5:17pm on October 7, he received a message on his mobile phone. It read, “Your appointment slot date has been given; verify to get the visa from the IVAC center.” A short link to a website was attached to the message.
At 6:02pm the same day, Rafat posted about this in a Facebook group. In the post, he wrote, “Straight off, I got fooled out of Tk10 thousand+. Although I am usually very careful about such matters, this time I myself became the victim of a scam.”
Rafat told Dismislab that clicking the link in the SMS took him to a website. There, his name, passport, and mobile number were requested. After he provided the information and went to the next step, a page resembling a bKash payment window appeared. Since he was asked to pay only Tk9, the matter did not seem unusual to him.
At the time, Rafat was busy with office work. The bKash OTP was also taking some time to arrive. Later, after he entered the OTP and PIN, he was taken to IVAC’s main website. But while he was searching to find out whether the payment had been confirmed, messages about money being deducted began arriving on his mobile phone one after another.
He said that while he was logging into his bKash account to try to understand the matter, several transactions were completed. He later realized that he had been a victim of fraud. He then contacted bKash customer service and changed his account PIN.
Account binding
The message sent to Rafat came from the number “+880 9638-011300,” with a link to a website shortened using cut.bd. When a shortened link like this is used, the address of the original website cannot be seen from the message. As a result, it can be difficult to identify which website the link leads to before clicking it.
After collecting the short link from a screenshot, Dismislab found that the link leads to a website with a web address reading “app.ivcabd.com.” The actual web address of IVAC is “ivacbd.com,” and its appointment portal is “appointment.ivacbd.com.”
Although the two web addresses, or URLs, look almost the same, there is one important difference. The “ivac” part of the original website’s name is replaced with”ivca” in the suspicious domain. That is, the positions of two letters have been swapped. Dismislab used who.xy to find the registration information of the fake website. It shows that the domain ivcabd.com was registered on September 18, 2026, only 19 days before the fraud. The domain’s information was last updated on October 7, the day Rafat was defrauded.
The domain was registered through the US-based Global Domain Group LLC. However, the identity of its current owner could not be learned from the records. This technique of creating a different domain by making a slight change to the name of a known organization’s website is called ‘typosquatting’. If a general user enters a link quickly, such a difference can escape notice.
It was not only the domain. The language of the website also pushed visitors toward a quick decision. At the very top of the page was written “IMPORTANT NOTICE,” or an urgent notice. It claimed that an opportunity to verify the appointment had opened for the applicant. If they did not verify right away, they would not get the appointment date.
Below this, a form called “Payment Verification” asked for the applicant’s full name, passport or application number, and mobile number. Only after the information was submitted did the site move on to the payment step.
At this step, there was a push to verify quickly in order to get the appointment. A “cautionary message” saying the appointment would not be obtained unless the user verified immediately was used to create pressure for a quick decision. As a result, there was a possibility of moving to the next step without properly checking the website’s address or the payment terms.
In the next step of the website, a payment window with the bKash logo appears. At the top of it, “IVACBD” is written, while showing Tk9 as the payment amount. Then a field appears for entering a bKash account number. In the following step, a six-digit verification code is requested. But the OTP that arrived on Rafat’s mobile from bKash showed a different reason, which he failed to notice immediately.
The SMS read, “Your bKash OTP to enable AUTO DEBIT in App or Website of MyCirkle.” That is, the OTP was sent to enable auto debit on an app or website named “MyCirkle.”
In this auto debit, or automatic payment, system, once the customer gives the necessary authorization, there is no need to enter a new OTP or PIN each time for subsequent payments to the merchant concerned.
The same method is explained in the “Linked Apps and Their Benefits” section of bKash’s customer service website. It says that to link a bKash account with a merchant platform, the account number, OTP, and PIN must first be provided. Once the account is linked, no OTP or PIN is needed for subsequent payments. bKash has named companies such as Foodpanda, Uber, and Grameenphone as examples.
On the fake website, Rafat was shown an instruction to pay only Tk9 in the name of IVAC. From there, the OTP and PIN were taken, and auto debit was enabled. The OTP that came from bKash therefore mentioned auto debit.
Confirmation of this came in the next SMS from bKash. It said that account binding with “ROBI AXIATA PLC-RM61469” was successful. The merchant had been permitted to deduct money from the bKash account for future purchases.
Dismislab asked bKash about the security of account binding and the transaction limit on it. In response, Shamsuddin Haider Dalim, bKash’s head of Corporate Communications, said that an auto-binding service with various merchants is in place to make financial transactions easy and time-saving. In his words, “There is no scope for such a service to be activated without the customer’s consent and the proper PIN and OTP.”
To stay alert against fraud, Dalim advised against opening unknown and unsolicited links. He said that to make a payment, the customer must go to the proper gateway on their own. It is not right under any circumstances to click on a link sent by anyone, known or unknown, by message or in any other way. Making transactions by giving a PIN and OTP without verification can be dangerous.
10 transactions in a minute, money went to Robi merchant
Analysis of the bKash transaction SMS messages provided by Rafat shows that money was deducted from his account one after another at 5:34 pm on October 7.
Before the transactions, the account held Tk10,639 and 57 poisha (a poisha is one hundredth of a taka). After the last transaction, 84 taka and 57 poisha remained. In bKash’s messages for some transactions, a notification that the money was “reserved” came first, followed later by a message that the payment was successful. In the SMS for every successful transaction, the identity of the merchant that received the money is written as “ROBI AXIATA PLC-RM61469.”
The MyCirkle service that was mentioned in the OTP for enabling auto debit is the name of a mobile app of the Cirkle brand run by Robi. Cirkle’s own website also describes it as a brand of Robi Axiata PLC.
However, although the transaction messages carried a Robi merchant identity, it could not be confirmed which mobile number, account or service recipient the money ultimately went to.
Rafat said that after realizing the money was being deducted, he contacted bKash customer service. According to him, because the money had already gone into another payment system, bKash customer service could not say anything definite about getting it back.
Dismislab contacted Robi to ask whether the actual recipient can be identified in such transactions, and what steps are possible to trace the destination of the money and recover it when a fraud complaint is received. Until the publication of this report, no statement was received from Robi.
More applicants defrauded by the same tactic
Besides Rafat, several others have fallen victim to the same kind of fraud. One of them, on condition of anonymity, told Dismislab that they received the SMS asking them to “verify” the appointment on the same mobile number they had used to apply for the visa.
The applicant said that because of the uncertainty over getting an Indian visa appointment, an SMS like this carries special weight for applicants. As with Rafat, they were asked to pay Tk9 in the same way, and nearly Tk12,000 was deducted from their bKash account.
After speaking with customer service, they learned that a binding with another service had been created on their bKash account. They claimed they were told that the money had been transferred to a payment system linked to mobile recharge. However, they did not learn which number or account the money went to.
Warning from Indian High Commission
Both victims said the fraudulent SMS came to the same mobile number they had used in their Indian visa applications. This raises an important question: how are fraudsters reaching people who have applied for Indian visas?
Rafat said he did not take help from any third party in applying or depositing the fee. However, he took help from a colleague for slot booking. The other victim told Dismislab that they took help for slot booking from a third party, which helps people get slots in exchange for money.
IVAC’s website already carries a warning about fraud committed in the name of providing visa appointments. It says that some unscrupulous people are collecting money in exchange for confirmed appointments by posing as officials or representatives of the Indian High Commission.
IVAC’s warning also says that, apart from the fixed visa processing fee of Tk1,500, there is no need to pay any extra money to get an appointment or to speed up the work. It advises people not to believe anyone who, posing as a representative of the High Commission, claims to give an appointment in exchange for money.
How to recognize fraud
To identify this kind of fraud, the first thing to do is verify the website’s address. A website does not become an organization’s official website just because it carries the organization’s name or logo. If a fake website is created by changing one letter of a domain, or the position of its letters, the difference may go unnoticed unless one looks very carefully. Therefore, especially when going to a website from a shortened link, it is necessary to check the original address in the browser’s address bar.
According to the guidelines of Digital Safety School, phishing carried out through SMS is called “smishing.” When a shortened link is used in a mobile browser, the real address is not easily noticed. For this reason, people are advised to look at the full URL of a link before clicking. On a desktop, the web address can be seen by holding the mouse over the link, and on a smartphone by long-pressing the link.
If the address seems unfamiliar or contains spelling mistakes, it is better not to enter it. If in doubt, the link can be checked with a tool such as VirusTotal. But the safest way is to avoid the link in the message and type the organization’s address directly into the browser. In this case, to verify the appointment, it would have been safer to go directly to IVAC’s main website instead of using the link in the SMS.
The language of a message can also often give away a fraud. Messages such as “If you do not verify right now, you will not get the appointment” or “Your account will be closed” deliberately create pressure so that there is no time to think. Spelling or grammar mistakes are also a warning sign. No legitimate organization asks for passwords, PINs or bank-related information by SMS, email, or phone call. So if something like this is asked for, that itself is a major reason for suspicion. Beyond this, advice has also been given to keep two-factor authentication turned on for important accounts, keep phone and browser software updated, and report suspicious messages to the relevant authority.
The same caution is needed for payments. It is not enough to look only at how much money is being asked for. What the OTP has come for must also be read. In this case, although payment of Tk9 was mentioned, the bKash OTP clearly stated that auto debit was being enabled.
bKash’s security advice also says to verify the recipient’s identity and the amount before every transaction and to keep the PIN and security-related information secret. For suspicious transactions, it advises contacting bKash customer service at 16247.
