DEV Community: Mamun Sk

Facebook Account Hacked? How to Recover Your Profile Step by Step

Mamun Sk — Mon, 02 Nov 2026 02:17:22 +0000

Your password changed, your email swapped, a stranger posting as you — Facebook's own recovery routes can still get your profile back, if you pick the right one for your situation and act before the thief locks every door.

If your Facebook account was hacked, how to recover it starts with one address: facebook.com/hacked. That is Meta's own recovery flow, and it is free. But it is not the only door, and it does not work the same way for everyone. What decides your route is how much of the account you still control — an email or phone number that still receives codes, a session still logged in on an old phone, an inbox holding Facebook's "your email was changed" message. This guide sorts out which situation you are in, then walks the matching route in order, from minutes-fast to last resort.

Two honest notes before we start. First, this guide is about your personal profile. If what you lost is a Facebook Page you run for a shop or business, the recovery is different. Second, Facebook has no recovery phone number, no live agent you can call, and no paid fast lane. Anyone in a comment, a Telegram group or a search ad who claims otherwise is setting up the second scam.

One preparation, before any route: secure your email account first. Password resets and Facebook's most useful recovery messages land in your inbox. If the thief may know your email password too — especially if you reused it — change it now and turn on its two-factor protection. Otherwise the thief can simply watch your recovery emails arrive and take the profile back the same night.

Signs your Facebook account was hacked — and what the scammer does with it

Sometimes the takeover announces itself: your correct password suddenly "is wrong" and you are logged out on every device. Just as often it begins quietly. Treat any of these as an emergency:

Facebook emails or notifies you about a change you did not make — your password, email address or phone number was changed.
Posts, comments or Messenger messages appear that you never wrote, or your account suddenly joins groups and follows Pages you have never heard of.
Friends ask why you sent them a strange link, or asked for money — in Bangladesh this is most often a Messenger message asking for urgent bKash or Nagad help, written in your name.
Your name, profile photo or birthday changed.
A login alert names a device or a city you do not recognise.
You receive a password-reset code you never requested.

What the thief wants is rarely your photos. A stolen profile is a trusted mask: with it they send money requests to your friends, post fake investment schemes, sell counterfeit goods through Marketplace, run up charges in any ad account attached to you, or message you and demand payment to hand the account back. If the spam is heavy enough, Facebook may disable the profile for policy violations. Every hour matters.

First, pick your situation — the four cases

Guides that fail people usually fail here: they print one flow, but hacked accounts come in four different shapes. Find yours, honestly, before touching anything.

Case A — You are still logged in somewhere. An old phone, a tablet, the browser at home: if any session still opens your profile, you hold the fastest key of all. Do not log out. Go straight to Route 4.

Case B — You are locked out, but your email or phone number still works. The thief changed your password but did not get to your contact details. Codes still reach you. This is the classic facebook.com/hacked case — Route 1, often finished in minutes.

Case C — Your email and phone number were both changed. Codes now go to the thief. Route 1 alone will not save you; you will need the undo-email trick (Route 2) or the identity-verification route (Route 3).

Case D — Facebook disabled the profile after the hack. You log in and see a suspension or disabled message, because the thief's spam broke the rules. Recovery still starts with Routes 1–3 to prove the account is yours; the disabled-account appeal is a separate step that sits on top, and we come back to it in the FAQ.

One thing helps every case: work from a phone or computer you have logged in from before, on your usual network, with any VPN turned off. Facebook's systems weigh a familiar device and location as evidence that you are the owner. Use your original details everywhere, even if the thief has already replaced them on the account.

Route 1: Recover your profile at facebook.com/hacked

This is Meta's guided recovery flow for compromised accounts, and it is the right first door for Cases B and C.

Type facebook.com/hacked into your browser yourself. Do not tap a link from a message, a comment or a "support" page — fake copies of this page exist to steal the very login you are trying to save. Choose the option saying your account is compromised or someone else is using it.
Find your account with the email address, mobile number or name you used before the hack. If the first detail fails, try the others — an old email you added years ago still counts.
If Facebook asks for a password, enter a current or previous one. An old password you genuinely used helps Facebook confirm the account is yours.
Choose where the code goes — carefully. Read the masked email or number Facebook offers. If it is yours, request the code, enter it, and set a new password you have never used anywhere else. If the destinations shown belong to the thief, do not send codes there; look for the link saying you no longer have access to these, which opens Route 3.
If a code does not arrive, check spam, confirm you entered the original number with its country code, and wait a few minutes before asking again.

The moment you are back in, do not celebrate and stop — the thief may still hold a live session. Go directly to the lockdown checklist further down, in the same sitting.

Route 2: Undo the email change — Facebook's own "secure your account" message

When someone changes the email address on your account, Facebook writes to the old address to tell you. That message is the most valuable email in your inbox right now, because it can carry a link to reverse or undo the change — worded as "secure your account" or "revert this change". One tap rolls back the email swap and starts the securing process.

Search your inbox and spam folder now for Facebook's message about an email change. Legitimate Facebook security mail comes from an address ending in facebookmail.com.
Check the sender before tapping anything. Phishing copies of this exact email are common. If anything looks off, do not tap. Type facebook.com/hacked yourself and use Route 1 instead.
Act while it is fresh. The reversal works best soon after the change. If the password was also changed, undo the email change first, then run Route 1 to reset the password with codes that once again reach you.

If you never received this message, or it is too old, skip to Route 3.

Route 3: "No longer have access to these?" — identity verification

This is the last-resort door, for Case C, where the thief replaced everything. It begins from facebook.com/login/identify: find your account, choose the option that says you no longer have access to the email and phone shown, and Facebook will ask for a new email address or phone number that has never been used on this account — that is where its answer will come, so use one only you control, on the secured inbox you prepared at the start.

Facebook may then ask you to confirm your identity, typically by uploading a government photo ID — a passport, national ID card or driving licence. Practical details:

The name and date of birth on the ID should match the profile. If your Facebook name is a nickname, expect questions; answer honestly with the details you signed up with.
Upload a clear, complete photo of the document — all four corners visible, no flash glare, no editing or cropping out parts. Blurry or altered images are the commonest reason for rejection.
Use your familiar device and network, as with every route.
Then submit once, and wait. Duplicate requests do not speed anything up; they can create parallel cases that slow review down. Keep any confirmation or reference Facebook gives you, and watch the new contact address you provided — including its spam folder.

If the ID route is not offered on your first attempt, do not conclude the account is gone. Options vary by account and region; try again from the login screen after a pause, and work through the Help Center's hacked-account guidance (facebook.com/help, search "hacked account"). Some accounts are also offered a video-selfie style check instead of a document — follow whichever official check Facebook actually presents to you, on its own page, and never send ID photos to anyone who contacts you privately claiming to submit them "faster".

Route 4: Still logged in somewhere? Secure the account in place

For Case A, your surviving session is gold — people lose accounts by helpfully logging out of the last device that still worked. Stay logged in and work through this inside the account:

Change the password first (Settings → Accounts Center → Password and security). A long, unique one, used nowhere else. If you reused the old password on other accounts, change those too, starting with your email.
Open "Where you're logged in" in the same Password and security area and log out every device and location you do not recognise.
Check your contact details. In Accounts Center → Personal details, confirm the email addresses and phone numbers are all yours. A thief who added their own email keeps a key even after your password change; remove anything you did not add.
Turn on two-factor authentication with an authenticator app where you can, rather than SMS alone, and save the backup codes somewhere safe.
Turn on login alerts so the next unfamiliar sign-in reaches you immediately.

Then continue to the full lockdown checklist below.

While you wait: damage control that cannot wait for Meta

Recovery reviews take days. The scam being run in your name is happening tonight. In parallel:

Warn people from channels you still control. Post from a family member's profile, a second account, WhatsApp groups and Messenger groups you can reach another way: "My Facebook account was hacked. Ignore any message, link, money or code request from it — it is not me. Do not send bKash, Nagad or any money." Message close friends and family directly; a voice note carries more trust than copied text.
Ask a friend to report the profile as hacked. From your profile, a signed-in friend can use the ··· menu → Find support or report profile and follow the options for a hacked account / someone pretending.
Screenshot the evidence before it vanishes. The scam posts, the messages your friends received, any changed name, photo or bio, and any ransom demand — with times visible.
If money already moved, save the transaction details and contact your bank or mobile-money provider through its official channel the same day.

Warning: the "recovery agent" scam — the second wave

Within hours of a public hack, a second set of criminals arrives dressed as rescuers: Facebook pages and Telegram sellers advertising "Facebook account recovery service — 100% guaranteed", commenters recommending a "brilliant hacker" who fixed theirs, and phone numbers pasted into guides and videos claiming to be a Facebook helpline. In Bangladesh the script is consistent: a few thousand taka up front by bKash or Nagad, then a request for your password or a login code "to finish the process" — which hands them whatever you have left.

Be blunt: Facebook does not charge for recovery, has no helpline to call, nobody outside Meta can restore an account, and no legitimate helper will ever ask for your password, a login code or a copy of your NID. The only real doors are the ones in this guide: facebook.com/hacked, facebook.com/login/identify, the undo link in Facebook's own email, and the Help Center. If you already paid an agent or shared a code, assume the code was used: change your email password, change any account sharing the Facebook password, and restart Route 1 from a familiar device.

After you get it back: the lockdown checklist

Getting in is half the job. Work through it in one sitting:

Password: new, long, unique, used nowhere else.
Sessions: Accounts Center → Password and security → Where you're logged in. Log out everything you do not own, everywhere. A password change alone does not always evict a thief's live session.
Contact details: Personal details — every email and number must be yours. Remove additions, and add a recovery email you actually check.
Two-factor authentication: on, preferably with an authenticator app; save backup codes offline.
Third-party apps and websites: Settings → Apps and websites. Revoke anything you do not recognise.
Pages, groups and ad accounts: check every Page you admin and any ad account for strangers added as admins, new payment methods or campaigns you never made.
Clean up the mess: delete the scammer's posts and messages, restore your name, photo and details, unfollow and leave what the thief added, and post a short note telling friends the account is yours again and which earlier messages were fake.
Sweep your email too: repeat the same check there — forwarding rules you did not create, recovery addresses that are not yours.

How long does Facebook account recovery really take?

Honestly, by route. Case B — codes still reach you — is commonly minutes to an hour at facebook.com/hacked. Route 2, the undo-email tap, is as fast as finding the message, if you catch it early. Route 3, identity verification, is measured in days, and can stretch to weeks: Facebook reviews documents by hand and queue, and blurry ID photos or mismatched details restart the wait. Case D adds an appeal on top of that. Two habits genuinely change the timeline: a familiar device with your original details, and one clean submission instead of a pile of duplicates.

FAQ

Can I recover my Facebook account if the hacker changed my email and phone number?
Often, yes. First look for Facebook's message to your old email with the link to reverse the change (Route 2). If that is gone, start at facebook.com/login/identify, choose "no longer have access to these", give a new email or number never used on the account, and complete Facebook's identity check — usually a government photo ID such as a passport, national ID card or driving licence (Route 3).

Is there a Facebook customer care number I can call for recovery?
No. Facebook offers no phone helpline for account recovery, and Meta never charges for it. Numbers and "agents" in search results, YouTube comments and Telegram groups are scams. Use only facebook.com/hacked and the Help Center.

Facebook disabled my account after it was hacked. Is it the same process?
Partly. A disabled or suspended message after a hack usually means the thief's spam broke Facebook's rules. First recover the account with the routes above, so you can show the takeover was real; the disable itself is then handled through the appeal prompt Facebook shows at login.

My ID was rejected. What should I do differently?
Upload a clear, complete, unedited photo of an accepted document — passport, national ID card or driving licence — with all corners visible and no glare, and details that match the profile's name and date of birth. Submit from your usual device, then submit once and wait.

My friends are receiving money requests from my hacked account. What can they do?
Tell them not to send anything and not to tap links or share codes. Ask a friend to open your profile and use the ··· menu → Find support or report profile to report it as hacked, and warn your wider circle from any channel you still control. Screenshot the scam messages — if money was actually sent, the victim should contact their bank or mobile-money provider's official helpline the same day.

Will I lose my photos, posts and friends when the account is recovered?
Normally, no — content and friend lists survive recovery. The real risks while you are locked out are the thief deleting material or Facebook disabling the profile for the thief's spam, which is why starting in the first hour, warning friends the same day, and keeping screenshots all matter.

Sources

US Federal Trade Commission — How To Recover Your Hacked Email or Social Media Account: https://consumer.ftc.gov/articles/how-recover-your-hacked-email-or-social-media-account
Facebook — Report a Compromised Account: https://www.facebook.com/hacked
Facebook — Find Your Account: https://www.facebook.com/login/identify
Robots.net — How to Recover a Hacked Facebook Account: https://robots.net/communication-platforms/recover-hacked-facebook-account/
NordPass — How to Recover a Hacked Facebook Account: https://nordpass.com/blog/how-to-recover-a-hacked-facebook-account/

Originally published on The Daily Tech Watch
https://dailytechwatch.blogspot.com/2026/11/facebook-account-hacked-how-to-recover.html

bKash Account Hacked: How to Freeze It, Dispute the Transaction and Try to Get Your Money Back

Mamun Sk — Sun, 01 Nov 2026 13:53:57 +0000

The money is moving now, not later. Here is the exact order of steps that gives it the best chance of coming back — and the honest truth about when it cannot.

You open bKash and the balance is wrong. Money you never sent has left the account — or your PIN suddenly does not work, or a "customer care" call has just ended and your savings went with it. If your bKash account was hacked, what to do in the next ten minutes matters more than anything afterwards, because stolen money in mobile banking moves fast, hopping from account to account until it is cashed out and gone. This guide is the recovery plan, in order: freeze the account, dispute the transaction properly, involve the police and Bangladesh Bank, and understand your real chances of getting money back. (An independent guide from The Daily Tech Watch — not affiliated with bKash.)

How a bKash account gets taken over

Three common routes lead here, and the response to all of them starts the same way.

The PIN-reset takeover. The attacker does not need your phone. With your number and enough personal details — date of birth, NID information, recent transaction amounts — they convince customer care that they are you and the account is blocked or the PIN forgotten. Police described exactly this method in September 2026, when nine gang members were arrested in Bagerhat: according to The Business Standard, the gang digitally cloned victims' fingerprints to obtain replacement SIM cards, then called customer care claiming their accounts were blocked, armed with prepared answers to security questions. Access was restored to the wrong people, and Tk 2.5 lakh was stolen from two businessmen's bKash and Nagad accounts.

The OTP trick. You were talked into it: a call or message created fear or greed, and you read out a one-time code or your PIN. We covered that playbook in full in our bKash OTP scam guide (linked at the end) — this article is about what happens next, after the money has gone.

The lost or swapped SIM. Your phone is stolen, or your SIM suddenly loses signal because a replacement was issued to someone else. Everything tied to that number — including bKash — is now reachable by a stranger.

Whichever route it was, the first steps are identical — and the clock is running.

bKash account hacked? Your first 10 minutes: freeze it on 16247

Call 16247 immediately. Use your own phone if you still have it; if not, borrow any phone — the helpline works from any number, and bKash's call centre runs 24/7, so do not wait for morning. Your one goal on this call: get the account blocked before another taka leaves.

Say this:

"My bKash account has been hacked. Money has been taken without my permission."
Give your account number (your mobile number), full name and NID details when asked — bKash verifies identity and ownership from your registration information.
"Please block my account right now so no more money can go out."
Describe the transactions you did not make — amounts, times, and any recipient numbers visible in the app statement or SMS.
Before hanging up, ask: "What is my complaint or reference number?" and "What happens next?" Write both answers down.

Three details matter on this call. First, bKash's terms state that call-centre calls may be recorded — so speak slowly and give exact times and amounts; that recording is evidence in your favour. Second, real bKash staff will never ask for your PIN, Secret Code or Security Code — the company says so itself. If anyone on any call asks for them, hang up and dial 16247 again yourself. Third, if the attacker changed your PIN, say so on this call.

While you wait on hold, screenshot your app statement and every transaction SMS. Do not delete anything.

The first hour: change the PIN and secure your phone, SIM and bank

Once the freeze request is in, use the first hour to close every other door.

Reset the PIN. If you can still get into the app or the *247# menu, change the PIN now — bKash's Terms of Use instruct users to change the PIN immediately on any suspicion of misuse. If you are locked out, use the "Forgot PIN?" route in the app, which verifies your identity against your registered information before letting you set a new one, or complete the reset through 16247. Choose a PIN you have never used anywhere — not your old PIN with one digit changed, not your birth year. And do not guess at a PIN the attacker may have set: too many wrong attempts temporarily blocks the account until the call centre resets it.

Secure the SIM. If your phone lost signal unexpectedly around the time of the theft, treat the SIM itself as compromised — that is the Bagerhat gang's method. Contact your mobile operator, explain the fraud, and ask whether a replacement SIM was recently issued for your number. If it was, that belongs in your police report too.

Secure the phone. Change the phone's lock PIN or pattern, and remove any app you do not recognise — especially anything installed around the time of a suspicious call or link.

Call your bank, if one is linked. If money may have been pulled through a linked bank account, call the bank's helpline too, tell them the connected bKash account was compromised, and ask them to flag the linked transactions. The bKash freeze does not cover the bank side.

Warn your circle. Tell close family and regular senders, on a voice call: scammers holding your number often ring relatives next, using your name and an emergency story.

Filing the transaction dispute: give bKash everything, in writing

The 16247 call stops the bleeding. The formal dispute creates your case for getting money back — make it detailed, documented and filed through more than one channel.

You can file and follow up through:

16247 — have the dispute recorded against every unauthorised transaction; keep the reference number.
The bKash app's Self Complaint system — open Customer Service → Complaint from the home screen, choose the service category, enter the details and submit; track it under "View Previous Complaints" (The Business Standard reported the feature's launch). The categories centre on services like bKash-to-bank transfers, savings, mobile recharge and bill payment — so for a hacked account, treat the app as a supporting record alongside your 16247 case, not a replacement for it.
Live Chat on bkash.com, or email — both listed on bKash's Security Tips page.
A bKash Customer Care Centre in person — worth it for large amounts; bring your NID and evidence.

What to give them — for each stolen transaction, and as evidence:

The TrxID (transaction ID) — from the app statement or the transaction SMS
The amount, date and time, and the recipient number
Your account number and NID details
A short timeline: when you last used the account normally, when you discovered the theft, when you called 16247
Screenshots of the app statement showing the unauthorised transactions
The original transaction SMS messages — keep them, do not delete
The phone numbers that called or messaged you, with call times, plus any chat screenshots from Messenger, WhatsApp or Facebook
A note of anything the caller said — promises made, names used
Your police GD number, once filed (next section) — send it to bKash for the case file

One honest gap: bKash does not publish a fixed dispute deadline on its site, so there is no official deadline number. The practical one is what matters: money still inside the system is far easier to stop and trace than money cashed out at an agent point across the country. File the same day — within the hour if you can.

The honest truth about getting your money back

No guide should promise you a refund, and this one will not. Here is the real picture.

If you were tricked into sending the money or sharing your PIN and OTP, the terms are against you. bKash's app Terms of Use state that activities done through the app using your PIN and OTP are treated as done by you, that the user is solely responsible for transfers made under any inducement or fraudulent activity, and that bKash is not liable for losses from unauthorised use of the PIN or account. Read plainly: when the correct PIN and code were entered, bKash's starting position is that the account holder authorised it.

If someone got in without you sharing anything — a cloned SIM, a PIN reset you never requested — your ground is stronger: you authorised nothing. State that distinction clearly, in writing, in your dispute and your police report.

So why file at all? Because "the terms are against you" is not the same as "recovery is impossible." A fast, documented report gives bKash's team something to act on while transactions can still be traced — and police action does recover money in real cases: in Bagerhat, police recovered Tk 80,000 when they arrested the gang. Recoveries happen case by case, through speed, evidence and a proper complaint trail — never through a guarantee, and never through anyone who phones you offering one (see the second-wave warning below).

Set expectations this way: the freeze protects what is left; the dispute, the GD and the escalation give the stolen money its only realistic chance of coming back. Doing nothing gives it none.

File a General Diary (GD) at the police station

Do this the same day, ideally right after the bKash filings. A General Diary — GD — is your official police record of the incident, and it strengthens everything else: bKash's process, a Bangladesh Bank complaint and any later court matter all carry more weight with a GD number attached.

Go to your nearest police station and bring:

Your NID card
Your bKash account number and the phone that holds the SIM, if you have it
Printouts or phone screenshots of the unauthorised transactions, TrxIDs and amounts
The numbers that called or messaged you, and your 16247 complaint reference number

Tell the duty officer plainly: your bKash account was hacked, money was stolen, and you want a GD recording it. You will receive a GD number — photograph the stamped copy, keep both safe, and send the GD number to bKash for your dispute file.

You can also report the cyber-fraud side to the CID's Cyber Police Centre on its hotline, 01320010148. These units investigate the organised gangs behind SIM cloning and MFS fraud — the Bagerhat arrests began with victims reporting. Your report is how gangs get found.

If bKash does not resolve it: escalate, in this order

Bangladesh Bank's Customer Interest Protection Centre (CIPC) publishes the official complaint ladder for banks and MFS providers. Climb it in order.

Step 1 — bKash itself. You have done this: 16247, the app complaint, the written record. Keep pushing until you get a clear final answer, in writing where possible.

Step 2 — bKash's Complaint Management Cell. If front-line support stalls, bKash's website lists a Complaint Management Cell with named senior officers and contact details, reachable during working hours (9:00 am–6:00 pm, Sunday to Thursday, excluding government holidays). Escalate with your complaint reference number, GD number, and a one-page summary of the case so far.

Step 3 — Bangladesh Bank's CIPC. If the complaint remains unresolved, or you are dissatisfied with bKash's outcome, CIPC is the regulator's door: hotline 16236 during office hours on working days, email bb.cipc@bb.org.bd, its online complaint form, or a written complaint to its Dhaka head office. CIPC covers MFS providers like bKash, and its procedure asks for a detailed description of the complaint with your name, address and contact details, a copy of the provider's final response, and supporting documents. That is why the earlier steps matter — they generate exactly this paper trail.

Keep every reference number, email and letter in one folder. Escalation is slow, unglamorous work, but it is the route that exists, and it costs nothing but persistence.

Beware the second wave: the "refund officer" scam

The cruellest part of this crime often comes after you report it. Within a day or two, expect a call or message like this: "I am calling from bKash about your complaint. Your refund is ready — I just need the OTP sent to your phone," or a demand for a "processing fee" before your refund is released.

It is not bKash. It is the same gang, or a second one working from the same leaked information, taking another swing at someone desperate to recover money. Remember the fixed rules:

bKash authorities never ask for your PIN, Secret Code or Security Code.
Nobody legitimate asks you to send money to get your own money back.
A genuine resolution comes through your complaint channels — never through a code you read out on a call.

If such a call comes, hang up, note the number, and verify everything by dialling 16247 yourself. Add the number to your GD and dispute file.

If you lost your phone or SIM too

A stolen phone is more urgent: the thief holds both the account and the number that receives its codes. bKash's Security Tips page is blunt — if your phone is lost, immediately inform the Helpline 16247, from any borrowed phone.

Then work this order:

Block the bKash account on the 16247 call, exactly as above.
Get a replacement SIM for the same number from your operator's customer care, with your NID and biometric verification — and be quick: the Bagerhat case shows attackers use replacement SIMs as a weapon, so be the one who gets there first.
Include the stolen phone in your GD, with its IMEI if you have it (on the phone's box or purchase receipt).
Once the replacement SIM is active, reset the bKash PIN via 16247 or "Forgot PIN?", then review the full statement for the period the phone was gone and dispute anything you did not do.
Change the important passwords the phone could open — email first, then Facebook and anything else signed in on it — from a device you trust.

After you recover the account: lock it down

When access is restored, spend ten minutes making sure this cannot simply happen again:

Keep the new PIN truly new — never write it down, never store it in the phone, never share it with anyone, including anyone claiming to be bKash.
Check your balance and statement regularly, and verify the transaction SMS from "bKash" after every transaction — bKash's own Security Tips page recommends both habits.
Keep your registration information accurate and current. It is what bKash uses to verify your identity and ownership — in a crisis, it is your proof the account is yours.
Only ever call 16247 yourself. Any "customer care" number that arrives by SMS, Facebook page or a caller's mouth is guilty until proven innocent.
Read our OTP scam guide (linked below) with your family. Most bKash thefts begin with one conversation — make sure everyone in the house knows how it sounds.

FAQ

Can bKash reverse a transaction after my account was hacked?
Sometimes, but never count on it. Under bKash's Terms of Use, transactions completed with your PIN and OTP are treated as authorised by you, and transfers made under inducement are the user's responsibility. Outcomes are decided case by case: a fast report, a formal dispute and a police GD give the money its best chance — especially if it has not yet been cashed out — but nobody can promise a reversal.

What number do I call if my bKash account is hacked, and is it open at night?
Call 16247. bKash's Terms of Use state it maintains a 24/7 call centre for assistance and complaints — call the moment you discover the problem, not in the morning.

The hacker changed my PIN and I am locked out. What do I do?
Call 16247 — PIN resets run through the call centre after identity verification against your registered information (the app also offers a "Forgot PIN?" route). Do not keep guessing: too many wrong attempts temporarily blocks the account until the call centre resets it.

Is there a deadline for disputing a bKash transaction?
bKash publishes no fixed dispute deadline on its website. Treat speed as the deadline: report on 16247 within the hour if you can, file the same day — money is far easier to trace before it is cashed out.

When I call about my hacked account, will bKash ask for my PIN or OTP?
No. bKash states on its Security Tips page that its authorities will not ask for your PIN, Secret Code or Security Code at any time. If anyone on any call asks for them — including someone who says they are processing your refund — hang up and dial 16247 yourself.

Is it worth filing a police GD for a small amount?
Yes. A GD costs a trip to the station and nothing else, and the GD number strengthens your bKash dispute and any Bangladesh Bank escalation. Small reports also connect: gangs get caught when many victims' reports point at the same numbers.

Sources

bKash — Security Tips: https://www.bkash.com/en/page/security-tips
bKash — Terms of Use, bKash App: https://www.bkash.com/en/page/terms-of-use-bkash-app
bKash — Complaint Management Cell: https://www.bkash.com/en/customer-service/complaint-cell
Bangladesh Bank — Customer Interest Protection Centre (CIPC), complaint procedure: https://www.bb.org.bd/en/index.php/services/cipc_procedure
The Business Standard — bKash introduces self complaint system for faster service (19 January 2026): https://www.tbsnews.net/economy/corporates/bkash-introduces-self-complaint-system-faster-service-1338251
The Business Standard — 9 arrested in Bagerhat over SIM cloning, mobile banking fraud (29 September 2026): https://www.tbsnews.net/bangladesh/crime/9-arrested-bagerhat-over-sim-cloning-mobile-banking-fraud-1557496

Related reading: bKash OTP Scam: How It Works, Warning Signs, and How to Protect Your Money — https://dailytechwatch.blogspot.com/2026/11/bkash-otp-scam-protect-your-money.html · Clicked a Phishing Link? What to Do Next, Step by Step — https://dailytechwatch.blogspot.com/2026/11/clicked-a-phishing-link-what-to-do.html

Originally published on The Daily Tech Watch: https://dailytechwatch.blogspot.com/2026/11/bkash-account-hacked-recovery.html

Maximum-Severity GitLab Flaw Is Under Active Attack — and It Nearly Broke Into Alpine Linux

Mamun Sk — Sun, 01 Nov 2026 13:23:25 +0000

CISA has added GitLab's CVE-2026-97229, a perfect 10.0, and a Cisco firewall flaw to its exploited list. Federal agencies have until 1 November to patch.

Some vulnerabilities are theoretical. These are not. On Thursday, the US Cybersecurity and Infrastructure Security Agency (CISA) added two more flaws to its Known Exploited Vulnerabilities (KEV) catalog — the official list of bugs attackers are using right now. One is a flaw in GitLab, the code-hosting platform used by development teams everywhere, with the highest severity score that exists: 10.0 out of 10. The other can knock Cisco firewalls offline. One of them has already been fired at a real target — and the defenders say it came close to working.

A 10-out-of-10 flaw in GitLab

The GitLab vulnerability, tracked as CVE-2026-97229, affects both the Community Edition and Enterprise Edition of the software. It is an integer overflow flaw rooted in weak validation of regular expressions: by sending a specially crafted regular expression inside a CI/CD configuration, an unauthenticated attacker — someone with no account and no password — can execute arbitrary code on the GitLab server itself.

That last part is what makes a 10.0 score. GitLab servers hold source code, build pipelines and often the keys that deploy software to production. An attacker who can run code on one, without logging in, potentially owns everything that flows through it. Anyone running their own GitLab instance should treat this as patch-first, ask-questions-later.

The night it was aimed at Alpine Linux

We know this flaw is being used because one target has told the story in public. Alpine Linux, the security-focused Linux distribution, disclosed that an unknown attacker tried to exploit the flaw against its GitLab instance on 20 and 21 October.

The attacker probed the unpatched server by sending crafted CI configurations, which crashed the GitLab worker processes eight times. In four of those crashes, the exploit then failed at the next step. The attacker also downloaded Alpine's GitLab container image — likely to study it for a better attempt — and further tries to get back in on 25 and 26 October were blocked.

Alpine's maintainers were candid about how near a thing it was. "The attack came close to working," they said. "We have found no evidence that it succeeded, but we cannot rule it out, so we treated the instance as compromised and rebuilt it from scratch." Their checks showed that the aports repository, the packages and the 21 October releases were not tampered with — the outcome every software project hopes for, and one that depended on the exploit stumbling at the final step.

The Cisco firewall flaw travelling with it

The second addition, CVE-2026-76418, scores 8.6 and affects Cisco's Secure Firewall ASA and FTD software — the appliances many organisations use as their front door to the internet. A flaw in how the software handles a return value can let an unauthenticated remote attacker force the device to reload unexpectedly: in plain language, knock the firewall offline at will, repeatedly.

Cisco said it became aware of active exploitation of this vulnerability earlier in October. It has not publicly identified who the attackers are, how many organisations they targeted, or what they did after getting in — a silence that usually means the picture is still developing. A denial-of-service flaw in a firewall sounds less dramatic than code execution, but a front door that can be slammed shut on demand is a powerful tool during a larger attack.

The deadline

Because both flaws are confirmed to be under exploitation, CISA's KEV listing comes with a clock. US Federal Civilian Executive Branch agencies are expected to apply the fixes by 1 November 2026. Everyone else gets no formal deadline — just the knowledge that attackers are already scanning for these bugs, and that the interval between "flaw disclosed" and "flaw mass-exploited" is now measured in days.

It is worth noting how quickly this moved. The Alpine Linux attack happened on 20–21 October; by the end of the month the flaw had a name, a maximum score and a federal patch deadline. Defenders had roughly a week of warning, most of which existed only because a small open-source project chose to publish its near-miss.

What this means for you

If your team self-hosts GitLab, patch it now. This is the whole ballgame: unauthenticated code execution on the machine that holds your code. Do not wait for a maintenance window.
If you run Cisco ASA or FTD firewalls, apply Cisco's updates and watch for unexpected reloads — they may be a symptom, not a glitch.
Treat "we run it ourselves" as a responsibility, not a saving. Self-hosted tools like GitLab are only safer than cloud versions if someone is watching for exactly this kind of alert.
Ordinary users: you cannot patch someone else's server, but this is a reminder of why services you use sometimes go down for "emergency maintenance." This week, some of that maintenance is this.

Sources

The Hacker News, "CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV," 30 October 2026 — http://thehackernews.com/2026/10/cisa-adds-actively-exploited-gitlab-rce.html

Originally published on The Daily Tech Watch: https://dailytechwatch.blogspot.com/2026/10/gitlab-cve-2026-97229-active-exploitation-cisa.html