Unauthorised app transfers drain salary from Rupali Bank account; customer left helpless

A customer of the state-owned Rupali Bank branch in Bhola's Daulatkhan has alleged that almost his entire salary was transferred from his account through unauthorised transactions.

The customer, Golam Mawla, a lecturer at Hajipur Islamia Fazil Madrasah, said he discovered the issue on 2 March when he went to withdraw money and found that the funds had already been transferred to another bank account.

Mawla told The Business Standard that he has never used the bank's mobile app, Rupali eBank, or card to withdraw money from the automated teller machine (ATM).

"I don't know what happened. I have never used a mobile app. I do not even use an ATM card," he said. "As the bank is close to my home, I usually withdraw my salary through cheques.

"When I went to withdraw money on 2 March, I found that the money had already been transferred to another bank account."

According to the account statement, Mawla received his January salary of Tk26,760 in his account on 10 February.

On 15 February, Tk5,000 was transferred from the account through BEFTN (Bangladesh Electronic Funds Transfer Network) to an agent banking account under Pubali Bank's Gopalganj branch. Later the same day, Tk21,500 was transferred to the same account.

The following day, on 16 February, Tk50 was used to recharge a mobile number belonging to a stationery shop owner in Rangabali, Patuakhali.

When contacted, the owner of the number, Harun Or Rashid, told TBS he was unaware of the recharge.

"I often recharge my phone at shops. I do not know when this money was added to my number," he said.

'Not possible for us to recover the money'

Rupali Bank Daulatkhan branch Manager Nesar Uddin confirmed that Mawla has a Teachers' Savings Account at the branch.

"When he came to withdraw money on 2 March, he found almost no balance in the account. After reviewing the statement, we saw that the money had been transferred to another account through BEFTN using Rupali Bank's mobile app [Rupali eBank]," he told TBS.

He said the customer later submitted a written complaint denying that he made the transfers.

"We informed the bank's IT division at the head office. They said the transactions were made from the customer's app and that SMS notifications were sent to his mobile phone during each transaction.

"It is not possible for us to recover the money at the moment," the manager said.

The bank has not launched any inquiry into this matter as of 5 March.

However, Mawla said he received a message only when his salary was deposited. He claimed he did not receive any SMS notifications for the three transactions made from his account.

From Bhola to Gopalganj

According to Manager Nesar, the transferred money went to an account belonging to Brishti Ghosh at a Pubali Bank agent banking outlet under the Gopalganj branch.

An official of the Pubali Bank branch, Kazi Mrinal Mahmud, said the account frequently receives deposits. "The customer usually does not visit the bank and withdraws money through the ATM," he said.

When Mahmud contacted her, Brishti reportedly said money often enters her account and is withdrawn shortly afterwards. She claimed she does not know anything about it.

No inquiry into Brishti's account and its transactions has been launched as of 5 March.

A senior official of Rupali Bank's IT division, speaking on condition of anonymity, said such complaints are common.

"In many cases, customers unknowingly click suspicious links on social media and lose control of their mobile phones. Fraudsters then gain access to information stored on the device," he said.

He added that while the mobile banking apps of private banks have strong security systems, Rupali Bank's system still has some technical limitations.

"Monitoring every complaint is difficult. Customers also need to be more cautious," the official said.

Rejected by the Rupali Bank, Golam Mawla said he went to the Daulatkhan Police Station to file a general diary (GD) over the alleged theft, but the police refused to record it, saying the matter fell under the bank's jurisdiction and the bank would have to resolve the matter.

Update

In a statement issued the day after this TBS report was published, the customer said, "I did not install or use any Rupali Bank app on my mobile phone. However, I received a link from an unfamiliar WhatsApp number. It mentioned that I could win a reward if I answered a few questions. 

"When I clicked on the link, my account was taken under the control of another party. As a result, the other party opened the app account using my NID and withdrew Tk26,500 from my account. I became clearly aware of the matter on 7 March after discussing it with officials of Rupali Bank."