Fake Indian Visa Application Centre site app.ivcabd.com drains bKash wallets
A Dismislab investigation found a fake Indian Visa Application Centre site, app.ivcabd.com, sent by SMS to Bangladeshi applicants, used a Tk9 "verification" fee to link and drain bKash wallets.
- First reported
- Reports
- 1
Source: tbsnews.net · published
What happened
The Business Standard reported on October 14, 2026 on a Dismislab investigation into a fake website posing as the Indian Visa Application Centre (IVAC) in Bangladesh. Applicants received SMS messages asking them to verify their appointment slots for a Tk9 fee.
The link led to app.ivcabd.com, which mimics IVAC's official domain ivacbd.com by swapping the letters "c" and "a". Domain records showed ivcabd.com was registered on September 18, 2026. In one documented case, 10 transactions drained Tk10,555 from an account within a minute; a second victim lost nearly Tk12,000. IVAC was impersonated, not involved.
How the scam works
The fake site showed an "IMPORTANT NOTICE" warning that applicants could lose their slot unless they verified immediately, and collected full names, passport or application numbers and phone numbers on a "Payment Verification" form.
It then showed a bKash screen for a Tk9 payment to "IVACBD". But the OTP sent to the applicant actually authorised auto-debit or account binding for a merchant platform. Once the OTP and PIN were entered, the account was linked and automated requests withdrew money without further OTPs or PINs.
IVAC's official website says applicants pay a standard Tk1,500 processing fee and no extra verification fee is needed to secure or confirm a slot. Both victims got messages on the phone numbers in their visa applications.
Source
The Business Standard, "Fake Indian visa appointment website used to steal money from Bangladeshi applicants: Dismislab" (October 14, 2026).
Red flags
- An SMS asking you to pay a small fee to "verify" a visa appointment.
- A web address that swaps letters in the official domain (ivcabd instead of ivacbd).
- A bKash OTP message mentioning "AUTO DEBIT" or "Account Binding" when you think you're making a one-off payment.
If you were targeted
- 1Go to IVAC's official website directly instead of following SMS links.
- 2Read OTP messages carefully and stop if they mention auto-debit or account binding.
- 3If you were affected, call bKash on 16247 to change your PIN and revoke active account bindings.