Play store
Personal information of Bangladeshi citizens, including national identity (NID) details, call records and mobile phone location data, is being sold through Facebook, Telegram, WhatsApp and dedicated websites, an investigation by research and fact-checking platform Dismislab has found.
The investigation, published on Monday (31 August), identified more than 600 Facebook posts advertising personal data for sale over a one-month period. It also found 10 active websites offering such information.
Dismislab purchased and verified data from three sellers using bKash payments. The information on offer included NID and voter details, birth registration records, call detail records (CDRs), mobile tower locations, SMS lists, IMEI numbers, TIN and passport information, and mobile financial service account statements.
In one case, a seller provided a copy of an NID within 17 minutes of receiving a mobile phone number and Tk500. Dismislab said the information was verified with the subscriber and found to be accurate.
In another transaction, the platform obtained three months of call records for a Grameenphone number within two and a half hours after paying Tk1,050. The records, including numbers contacted, call times and durations, matched the subscriber’s actual call history.
Dismislab also obtained recent location information for a subscriber after paying Tk1,500.
Some sellers advertised fixed price lists, offering NID information based on a mobile number for Tk250, three months of call records for Tk900, six months for Tk1,800 and live location data for Tk1,500.
The investigation found that the trade in personal information has continued for at least three years.
An IT expert told Dismislab that access to real-time or updated information of this kind would likely require insider involvement within relevant government agencies or a breach of systems storing the data.
A mobile operator said it had raised concerns with authorities and provided evidence, but the illegal trade had continued.
The findings have raised serious concerns over the security of sensitive personal information and the systems used to store citizens’ data, particularly as call records and location information are generally accessible only to authorised agencies under Bangladesh’s legal and regulatory framework.