You open Nagad to check your balance and the money is simply not there. Or a transaction message arrives for a cash-out you never made. If your Nagad account is hacked, what to do in the next ten minutes matters more than anything that follows — mobile money moves fast, and so do the people who steal it. Do not panic, and do not start by calling numbers from random Facebook pages. This guide is the ordered version: freeze the account with one call, take your PIN back, file the dispute properly, involve the police and Bangladesh Bank — and spot the second scam that often targets victims within hours.

Please note: The Daily Tech Watch is an independent publication. This guide is not affiliated with, endorsed by, or published by Nagad. It is based on Nagad's own public statements and Bangladesh Bank's published complaint procedure, linked in the Sources at the end.

How Nagad accounts get hacked in the first place

Almost no Nagad theft involves a criminal "breaking into" Nagad's systems. The break-in almost always happens at your end, through your PIN or a one-time code. Understanding the trick that was used on you also helps when you report it, because Nagad and the police will ask how it happened.

The fake officer call. Someone calls claiming to be from "Nagad head office." Your account will be closed, your KYC needs updating, you have won a cashback prize — whatever the story, it ends with a request for the OTP that just arrived on your phone, or for your PIN. Nagad states plainly, in its own published terms, that it never asks customers to disclose their OTP or PIN, in any circumstances. The moment a caller asks, it is a criminal, whatever the caller ID says.

Fake pages and fake apps. Links circulate on Facebook and Messenger to pages that copy Nagad's branding and ask you to "log in" or enter a code to claim a remittance bonus. Others push a "Nagad" app through a direct download link instead of the Play Store. A real app never arrives by Messenger.

Fake support pages. Search Facebook for Nagad help and you will find pages and groups that look official, answer quickly — and exist to harvest account details from people already in trouble. This is also how the second-wave scam below finds its victims.

Guessed or watched PINs. A PIN that is a birth year, the last digits of your phone number, or four digits someone watched you type at an agent point is not much of a lock. And no genuine agent needs you to say your PIN out loud.

Identity-detail resets. Nagad's self-service PIN reset asks identity questions — your NID number, date of birth and recent transaction details. Anyone who collects those details about you (a carelessly shared NID photocopy, details given to a fake "officer") can attempt to use them against you. That is one more reason the reset questions must stay private.

Nagad account hacked: what to do in the first 10 minutes

Call 16167 — or 096 096 16167 from any phone — and ask Nagad to freeze the account. These are the only two helpline numbers Nagad itself publishes, and Nagad's own terms say it contacts customers only from these numbers. If your phone is lost, stolen or you suspect it is being watched, call from a family member's phone instead.

On the call, be specific: say your account has been compromised, that transactions you did not make have taken place, and that you want the account frozen immediately so nothing more can leave it. Give the details of each transaction you did not authorise. Then ask three things before you hang up: the complaint or reference number for your report, the name of the agent you spoke to, and what happens next in the dispute process. Write all of it down, with the time of the call.

Two things not to do in these minutes. First, do not share any OTP that arrives while you are dealing with the problem — the real Nagad will not ask for it, but the criminal who emptied your account may call again pretending to be "reversing" the transaction. Second, do not pay anyone a "processing fee" to unfreeze or reverse anything; Nagad's published terms say it will never ask you to make a payment to anyone.

Before anything can be deleted, screenshot the evidence: transaction messages, the scammer's number, any chat or page that tricked you. If your phone itself was stolen, also ask your operator to block the SIM, because whoever holds it can receive your OTPs.

Step 2: Take back the account — reset your Nagad PIN

Once the account is frozen, the PIN the criminal used must die. Nagad offers a self-service PIN reset by USSD, described in Nagad's official press release (reported by The Business Standard): dial *167# from your registered number, then press 8 to open the PIN-change option. You will see two choices — 1 for a forgotten PIN and 2 for resetting/changing the PIN. Choose 1 if you no longer know or control the PIN. You will be asked for your NID number, a confirmation text will be sent to your number, and you will then enter your date of birth and answer questions about your recent transactions — whether you made any in the last 90 days, what type they were, and the amount of the last one. Answer correctly and you can set a new PIN.

Three details from that same release matter. A new PIN's four digits must not be consecutive numbers, and you should also avoid birth years and phone-number digits — pick something a person who knows you could not guess. You get a maximum of five attempts at the self-reset; fail them and the reset option is blocked for four hours, during which the call centre (16167) is the route. And menus can change over time — if your *167# menu does not look like this, stop guessing and call 16167 rather than pressing random options on a compromised account.

If you can still log in normally, change the PIN anyway, check your full statement in the app or by USSD for any transaction you do not recognise, and reinstall the app only from the Google Play Store if you suspect a fake app was involved. Never reset a PIN by following instructions from a Facebook page or a caller — only through *167#, the official app, or the helpline numbers above.

Step 3: File the dispute with Nagad — and what to tell them

The freeze call starts your case, but treat the dispute as a formal process. Nagad's investigators can only work with specifics, so gather your evidence, and put it in writing as well as on the phone. Nagad's published support email is info@nagad.com.bd — send the same details there, quoting the reference number from your call, so your complaint exists in a form you can later show to Bangladesh Bank.

Have these ready:

• Your Nagad account number and the name it is registered under
• The transaction ID (TrxID) of every transaction you did not make — these are in the confirmation SMS messages and your app statement
• The amount, date and time of each disputed transaction
• The number the money went to, if it is visible
• A short, honest account of how it happened: the call, message, page or app involved, and the number it came from
• Screenshots of the messages, the fake page, or the call log
• Your police GD number, once you have filed it (next step)

Ask Nagad directly how long the investigation should take, how you will be updated, and — if the answer goes against you — insist on the final response in writing. That written decision matters: Bangladesh Bank's complaint centre requires a copy of the provider's final response before it will take up your case. Keep a simple log of every call: date, time, who you spoke to, what was promised.

Step 4: File a GD at the police station

A General Diary (GD) entry at your nearest police station is the official record that a crime was reported, and it strengthens everything else you do — Nagad, Bangladesh Bank and any court process may all ask for it. Go in person; fraud is a criminal matter, so a station visit is the reliable route. Bring your NID, your phone, printed or saved screenshots, the transaction details, and your Nagad complaint reference.

Describe what happened in plain order: when you discovered it, which transactions are not yours, how you believe the compromise happened, and what you have already done (freeze call, dispute). Give the scammer's number if you have it. Make sure you leave with the GD number and a copy or clear photo of the entry — you will quote that number repeatedly. Online financial fraud cases can be referred onward to the police's specialised cyber units; if there is any immediate danger, the national emergency number is 999.

Do not skip this step because the amount seems small. Fraudsters run the same script on hundreds of people, and GD reports are how police connect those cases.

Step 5: If Nagad does not resolve it — complain to Bangladesh Bank

Bangladesh Bank's Customer Interest Protection Centre (CIPC) is the regulator's complaint desk for banks and mobile financial services, including Nagad. Its published procedure is a three-step ladder, and it expects you to climb the first two steps first: complain to the provider, then to the provider's own complaint cell if the first response fails. Only then does the CIPC take the case up — which is why the written final response from Nagad matters.

To reach the CIPC:

• Hotline: 16236, during office hours on working days
• Email: bb.cipc@bb.org.bd
• Online complaint form on the Bangladesh Bank website (bb.org.bd), or a written complaint to the CIPC at Bangladesh Bank's head office in Motijheel, Dhaka

Bangladesh Bank asks for a detailed description of the complaint with your name, address and contact information, a copy of Nagad's final response or decision, and copies of your supporting documents — your GD, screenshots and transaction records. Be accurate and complete — anonymous complaints, and third-party complaints without the account holder's written authorisation, are not accepted. The CIPC can press Nagad to review and answer your case properly, but it is an escalation route, not an instant refund button.

What Nagad can and cannot reverse — the honest answer

You deserve a straight answer here, because false hope is itself a tool scammers use. A completed mobile-money transfer is not like a card payment with a simple undo button. In practice, your chances depend mostly on speed and on where the money is now.

If you reported the theft within minutes and the money is still sitting in the recipient's wallet, Nagad has the best chance of freezing it in place while the dispute is investigated — this is the strongest argument for the immediate 16167 call. If the money has already been cashed out at an agent point or moved on through other wallets, recovery becomes much harder and usually depends on the police investigation catching those involved. If you were manipulated into sending the money or authorising the transaction yourself — the classic fake-officer script — expect an uphill fight: providers treat customer-authorised transactions differently from a pure account takeover, and no refund is guaranteed even with a GD and a complaint.

What is certain: Nagad will never require you to pay money to release, reverse or "process" your own stolen funds, and anyone who asks for such a payment is continuing the theft. File everything anyway. Disputes and GDs sometimes succeed weeks later, they cost you nothing but time, and unreported theft is theft the system never even counts.

Warning: the second scam wave targets hacked Nagad account victims

Within hours of a theft, a second group often comes for what is left: you post in a Facebook group asking for help, or search for a "Nagad helpline number," and a helpful account messages you — a "Nagad support officer," a "recovery agent," sometimes a page with Nagad's logo and thousands of followers. They will ask for your OTP or PIN "to verify the reversal," or a fee sent to a personal number "to unlock the refund." Some victims are called by the original scammers, now posing as Nagad staff checking on the complaint.

Defend yourself with the two fixed points Nagad itself publishes. Its helpline is only 16167 and 096 096 16167, it contacts customers only from those numbers, and it never asks for your OTP or PIN and never asks you to pay anyone. Any other number, page or agent — however official it looks — fails that test. Do not post your account number, TrxIDs or screenshots publicly while asking for help; you are handing the second wave its script.

Prevention checklist: make it hard to hack your Nagad account again

• Treat your PIN and any OTP as cash: nobody legitimate — not Nagad, not police, not a bank officer — will ever ask for them
• Set a PIN that is not consecutive digits, not your birth year, and not part of your phone number — and change it if anyone has ever seen you type it
• Use only the official Nagad app from the Google Play Store, and *167# for USSD; never install an app sent as a link or file
• If any call about your account feels urgent or frightening, hang up and call 16167 yourself — urgency is the scammer's main weapon
• Check your statement regularly in the app or by USSD, so a small test theft is caught before it becomes a big one
• Do not share copies of your NID, or your date of birth and transaction details, with strangers — together they are the keys to the PIN-reset questions
• Teach the same rules to your parents and family members; scammers deliberately target people who are newer to mobile money

Frequently asked questions

What is the very first thing to do if my Nagad account is hacked? Call 16167 (or 096 096 16167) immediately and ask Nagad to freeze the account and record your dispute. Speed is the single biggest factor in whether stolen money can still be stopped. Do this before calling anyone else, and do not share any OTP that arrives during the process.

What is Nagad's real helpline number? I have seen other numbers online. Nagad's official helpline is 16167, with 096 096 16167 as the longer form. Nagad's own terms say it contacts customers only from these two numbers. Other numbers circulating online — including 16216, which belongs to a different service — are not Nagad numbers, and pages or people directing you to them should not be trusted.

How do I reset my Nagad PIN if the hacker changed it or I forgot it? Dial *167#, press 8 for the PIN-change option, then choose 1 for a forgotten PIN. You will need your NID number, your date of birth, and answers about your recent transactions, such as the amount of your last transaction. You have up to five attempts; after that the option is blocked for four hours and the call centre at 16167 is your route.

Can Nagad actually give my money back? Sometimes, but never count on it. If you reported the theft fast and the money is still in the recipient's wallet, Nagad may be able to hold it during the investigation. Once money is cashed out, or if you were tricked into authorising the transaction yourself, recovery is much harder and may depend on the police case. Anyone who guarantees a refund — especially for a fee — is running the second scam.

Will Nagad ever ask for my PIN or OTP? No. Nagad states in its published terms that it never requests a customer's OTP or PIN, and never asks customers to make a payment to anyone. Any caller, page or "agent" who asks for any of these is a criminal, whatever name or number they show.

Nagad has closed my complaint and I am not satisfied. What else can I do? Escalate to Bangladesh Bank's Customer Interest Protection Centre: hotline 16236 during office hours on working days, or email bb.cipc@bb.org.bd. You will need your detailed complaint, supporting documents, and a copy of Nagad's final response — one more reason to insist on that response in writing.

Sources

• The Business Standard — "Nagad launches self PIN reset option" (Nagad press release: *167# PIN reset flow, attempt limits, call centre numbers, "Nagad never asks for the PIN"): https://www.tbsnews.net/economy/corporates/nagad-launches-self-pin-reset-option-272182
• Nagad Islamic (official Nagad site) — offer terms stating Nagad never requests OTP/PIN, never asks for payments, and contacts customers only from 16167 / 096 096 16167: https://nagadislamic.com.bd/en/offer/unlimited-cashback-as-gift-on-banglalink-recharge/
• Nagad official website: https://nagad.com.bd/
• Bangladesh Bank — Customer Interest Protection Centre complaint procedure (hotline 16236, bb.cipc@bb.org.bd, three-step escalation): https://www.bb.org.bd/en/index.php/services/cipc_procedure

Related reading: bKash OTP Scam: How It Works, Warning Signs, and How to Protect Your Money — https://dailytechwatch.blogspot.com/2026/11/bkash-otp-scam-protect-your-money.html · Clicked a Phishing Link? What to Do Next, Step by Step — https://dailytechwatch.blogspot.com/2026/11/clicked-a-phishing-link-what-to-do.html

Originally published on The Daily Tech Watch: https://dailytechwatch.blogspot.com/2026/11/nagad-account-hacked-what-to-do.html

A password is one secret, and secrets leak: they are guessed, reused, stolen in breaches and typed into fake login pages. Two-factor authentication and passkeys fix that weakness in two different ways — one adds a second check on top of your password, the other replaces the password with something that cannot be phished at all. Fifteen minutes from now, your most important accounts can be dramatically harder to break into.

What two-factor authentication actually is

Two-factor authentication (2FA), also called two-step verification or multi-factor authentication (MFA), means proving who you are with two different kinds of evidence instead of one. The US Cybersecurity and Infrastructure Security Agency (CISA) describes the factors as something you know (a password), something you have (a phone or key), or something you are (a fingerprint or face). The UK's National Cyber Security Centre (NCSC) puts it more simply: 2FA "double checks" that you really are who you claim to be. The payoff is straightforward: even if a criminal steals your password — from a breach, a guess or a phishing page — they still cannot get in, because they do not have the second factor.

Why the text-message code is the weakest option

Not all second factors are equal, and CISA ranks them from strongest to weakest. At the bottom sit codes sent by SMS text message or voice call. CISA's fact sheet is blunt: SMS codes are vulnerable to phishing, to weaknesses in the phone network's signalling system, and to SIM swap attacks, where a criminal convinces your mobile carrier to transfer your number to a SIM card they control — and receives your codes. Text codes should, in CISA's words, be used only as a last resort. If SMS is all an account offers, keep it — any second factor beats none — but switch wherever an app or a passkey is available.

Passkeys: the strongest option, and the easiest to use

Passkeys are built on the FIDO/WebAuthn technology that CISA calls the gold standard — the only widely available form of authentication that is resistant to phishing. A passkey is a cryptographic key stored on your phone or computer. You sign in with the fingerprint, face scan or screen-lock PIN you already use to unlock that device; there is no code to type and no shared secret travelling over the internet. Google's support pages stress the consequence: unlike passwords, passkeys cannot be shared, copied, written down or accidentally given away to a fake site — a passkey created for the real site simply will not work on a lookalike. The same technology works as a small hardware security key, if you prefer a separate physical device.

The 15-minute setup, in the right order

Work through your accounts in this order — it matters:

1. Your email account first. The NCSC singles out email for a reason: anyone who controls your inbox can use it to reset the passwords on your other accounts. Turn on 2FA in the account's security settings, or create a passkey. For a Google account, passkeys are created at myaccount.google.com/signinoptions/passkeys; Google warns to create passkeys only on devices you personally own, never on a shared computer, because anyone who can unlock that device can then access your account.
2. Banking and money apps next. These are the accounts where a break-in costs you directly. Choose an authenticator app or passkey if offered; keep SMS only if nothing stronger exists.
3. Social media and messaging after that. A hijacked social account is used to scam your friends and family in your name, so it deserves the same treatment.
4. Everything else as you meet it. Shopping, gaming, cloud storage — switch on 2FA or a passkey whenever you next log in, rather than trying to do every account in one sitting.

Authenticator apps vs passkeys: which should you pick?

An authenticator app generates a fresh six-digit code on your phone every few seconds, or asks you to approve a sign-in, ideally with number matching — typing into the app a number shown on the login screen. CISA rates app-based codes and number-matched approvals well above SMS: they cannot be intercepted by a SIM swap, because they never travel over the phone network. They can still be phished, though — a convincing fake page can trick you into typing the code into it. A passkey removes even that risk, because there is no code to type and the key is bound to the real website. In short: passkey where one is offered, authenticator app everywhere else, SMS only as a last resort.

Save your backup codes like cash

Every good 2FA setup eventually meets a lost, broken or flat phone. The NCSC's advice is to plan for it in advance: many services let you set up more than one second step, and backup codes — a short list of one-time codes the service gives you when you switch 2FA on — are ideal, because they work even if you lose your phone. Treat those codes like spare house keys: keep them somewhere safe that is not the phone itself — printed at home, or in a password manager — never in a note that syncs to the account they protect.

Lost your phone? Here is the recovery path

1. Sign in from another device you trust and use one of your backup codes to get in.
2. Remove the lost device's access: delete its passkey and sign it out of the account. Google's instructions, for example, let you remove a passkey and sign out sessions for a lost device from your account's security settings.
3. Set up 2FA or a fresh passkey on your new phone, and generate a new set of backup codes.
4. If your authenticator app cannot be restored, use each service's account-recovery process — this is exactly the moment the saved backup codes earn their keep.

Your password was never a strong lock; it was just the only one most accounts had. Add the second factor where you can, move to passkeys where they are offered, and keep the backup codes safe. Fifteen minutes of setup closes the door on the most common way accounts are stolen.

Sources

• CISA, "Implementing Phishing-Resistant MFA," October 2022 — https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf
• UK National Cyber Security Centre, "Setting up 2-Step Verification (2SV)," updated 12 March 2025 — https://www.ncsc.gov.uk/guidance/setting-two-factor-authentication-2fa
• Google Account Help, "Sign in with a passkey instead of a password" — https://support.google.com/accounts/answer/13548313

Originally published on The Daily Tech Watch: https://dailytechwatch.blogspot.com/2026/10/passkeys-two-factor-authentication-setup.html