A fake website posing as the Indian Visa Application Centre (IVAC) is being used to target Bangladeshi visa applicants with fraudulent SMS messages, tricking them into authorising mobile wallet access and losing thousands of taka, according to an investigation by Dismislab.
The investigation by Md. Himel Hasnat Rafi and Md. Touhidul Islam found that scammers sent applicants messages asking them to verify their appointment slots for a fee of Tk9. Victims who followed the links were directed to a website impersonating IVAC and prompted to submit personal information and authorise a payment through bKash.
The fraudsters exploited bKash's auto-debit and account-binding feature to withdraw money from victims' accounts without requiring further one-time passwords (OTPs) or PINs, the investigation found. In one documented case, 10 consecutive transactions drained Tk10,555 from an account within a minute.
SM Amanur Rahman Rafat, who applied for an Indian visa online in September 2026, received a fraudulent SMS on October 7, a day before his scheduled document submission appointment. After entering his OTP and PIN in response to the Tk9 payment prompt, 10 transactions were carried out at 5:34 p.m., leaving him with Tk84.57 in his bKash account.
A second victim, who received a similar message on the phone number provided during visa registration, lost nearly Tk12,000, according to the report.
The investigation traced the fraudulent link to app.ivcabd.com, a website that mimicked IVAC's official domain, ivacbd.com, by switching the positions of the letters "c" and "a".
Domain records showed that ivcabd.com was registered on September 18, 2026, and updated on October 7, the report said.
The fake website displayed an "IMPORTANT NOTICE" warning applicants that they could lose their appointment slots if they did not complete verification immediately. It then asked them to provide their full names, passport or application numbers, and mobile phone numbers through a form labelled "Payment Verification".
The payment process presented a bKash screen showing a Tk9 payment to "IVACBD". However, the OTP sent to the applicant's phone was intended to authorise auto-debit or account binding for a merchant platform called "MyCirkle", associated with Robi Axiata PLC under the merchant identity ROBI AXIATA PLC-RM61469, the investigation found.
Once users entered the OTP and PIN, their bKash accounts were linked to the merchant platform, allowing subsequent deductions without additional OTP or PIN verification. Automated transaction requests then withdrew money from the accounts in rapid succession.
bKash Corporate Communications Head Shamsuddin Haider Dalim said account binding was a feature intended to make payments more convenient for customers and was used by merchants including Uber, Foodpanda and Grameenphone. Activating the feature required customers to enter an OTP and PIN, he said.
Dalim urged users not to click unknown links or enter their credentials on unverified payment gateways.
Robi Axiata PLC did not provide a comment before the report's publication, according to Dismislab.
The cases also raised questions about how the scammers obtained applicants' contact details. Both victims received messages on the phone numbers listed in their visa applications. Rafat had used a colleague to book his appointment slot, while the second victim had paid a third-party agency, the report said.
IVAC's official website states that applicants are required to pay a standard processing fee of Tk1,500 and that no additional money or verification fee is needed to secure or confirm an appointment slot.
The investigation advised applicants to check website addresses carefully, avoid shortened links from unknown sources and access IVAC's official website directly rather than following links in SMS messages.
It also urged bKash users to read OTP messages carefully and stop if a prompt refers to "AUTO DEBIT" or "Account Binding" when they believe they are making a one-time payment.
Users who suspect they have been scammed should contact bKash support at 16247 to change their PIN and revoke active account bindings, the report said.