Start with a warning, because this one is doing active harm. Several guides currently tell Bangladeshi scam victims to report at cybercrime.gov.bd. That address is not a government portal. It serves an empty directory behind a certificate issued to an unrelated private domain and expired in December 2025. Do not send anything there.
Here is what actually works.
999, while the money is still moving
The national emergency number takes crime reports, and for a transfer made in the last few minutes it is the fastest lever you have. Use it before you start looking for a form.
The Cyber Police Centre
The Criminal Investigation Department runs the Cyber Police Centre, which is the unit that handles online fraud, account takeovers and blackmail. It answers around the clock on +8801320010148 and +8801320010146, and by email at [email protected]. In person, it is at the CID complex in Malibagh, Dhaka.
A note on the online complaint portal that carries this unit’s name: it runs on a .org address maintained by a private contractor rather than on a government domain. It looks legitimate and the contact details on it match the official ones, but a police portal on a non-government domain is also exactly what a cloned site looks like. If you use it, reach it from a link on an official page, and prefer the phone numbers above if you have any doubt.
Your bank or wallet first, then Bangladesh Bank
For money taken through a bank account, bKash, Nagad or Rocket, complain to the provider first and insist on a written final response. Bangladesh Bank’s complaint cell covers mobile financial services as well as banks, on 16236 and at [email protected] — but its published procedure requires a copy of the provider’s final decision before it will take the case. It is an escalation route, not a first stop.
So the sequence is: provider, in writing, then the central bank if the answer is unreasonable. Keep every reference number the provider gives you.
The technical incident: CIRT
The national computer incident response team takes reports at cirt.gov.bd/report-incident. It is shaped around security incidents rather than consumer money losses, so use it for the phishing site, the compromised account or the malware, and not as a substitute for the police report.
The impersonation to expect
CIRT itself published an alert about a scam platform telling users that the national CERT was supervising its finances, in order to extract “withdrawal processing” and “verification” fees. CIRT states plainly that it never handles money and never asks for payment. Neither does any other agency here. Any message claiming an official body is holding your funds pending a fee is the second scam, aimed at people already caught by the first.
What to have ready
Screenshots of the whole conversation with the number or profile visible, the transaction IDs from your wallet or bank statement, the receiving number or account, the dates and amounts, and the address of any web page involved. Take the screenshots before blocking anyone.
The website itself
None of these bodies takes a page offline quickly. The company hosting it and the registrar that sold its domain can, and usually within hours if you send them the exact address, a screenshot, and one line about what the page does.
Leave a Reply