Financial intelligence agency flags data privacy breaches and digital extortion
BFIU Warns Against 31 Illegal Loan Apps
- 31 unauthorized lending apps blacklisted for breaching device data privacy and extorting users
- Digital lending without central bank approval violates financial regulations and anti-money laundering laws
- Public advised to protect sensitive NID and banking credentials while avoiding upfront processing charges
The Bangladesh Financial Intelligence Unit (BFIU) has issued a security warning against 31 unauthorized mobile applications and digital platforms exploiting fintech infrastructure under the pretext of instant loans. The anti-money laundering watchdog released the list on Thursday, 27 August, urging citizens to avoid engaging with illicit lending applications.
Technical assessments by BFIU revealed that these unlicensed apps harvest sensitive endpoint data—including stored contact lists, private photo galleries, national identity records, and personal files—upon installation. Operators subsequently exploit this metadata to conduct algorithmic harassment, blackmail, extortionate fee collection, and unauthorized data exposure.
The 31 apps listed by BFIU comprise: Sathi Loan, PopCash, FinCash, Quick Loan, Quick Taka, Dhaka Fin, LoanVibe, Dosto Loan, Taka Cash Loan, Kewonza Loan, SSH Money, LoanBuddy, Saathi Loan, CashHora, Alo Cash, Fast Loan, Easy Taka, Dhoirjo Loan, Fin Dot Do, Taka Cash Loan, BongoCash, Asha Loan, Subidha Loan, Smart Loan BD, Online Loan BD, City Online Loan, BD Sohoj Loan, Cash Loan, Sonali, LoanHaat, and TakaNow.
The regulatory agency highlighted that credit disbursement is a strictly supervised financial activity in Bangladesh. No entity holds regulatory clearance to operate lending services via mobile applications without Bangladesh Bank approval. Under Sections 2(Sh)(5) and 4 of the Money Laundering Prevention Act 2012, fraudulent digital financial activities constitute punishable offenses.
Users have been strongly advised against granting device permissions, sharing banking credentials or NID data, and paying advance processing charges to unverified platforms.
//DBTech/DMO/SME//
