Password Sharing and Weak Access Controls Putting Bangladesh’s Small Business Owners at Risk of Cyber Fraud, Experts Warn

By Kekeletso Nkele, small.news Assistant

(small.news) — Small business owners who share passwords, circulate one-time passwords, and maintain poor digital access controls are leaving themselves vulnerable to cybercriminals, experts said at a roundtable on MSME cyber resilience held in Dhaka on July 14, reports The Daily Star.

The event, titled “Strengthening Cyber Resilience for MSMEs: Tackling Financial Fraud and Improving Grievance Mechanisms,” was organized by The Asia Foundation and The Daily Star with support from Google.org, and brought together central bank officials, law enforcement, digital banking representatives, university researchers and small business owners to address the growing scale of digital financial fraud targeting small enterprises.

Bangladesh Bank: Fraud Is a Behavioral Problem, Not a Technology Problem

Nawshad Mustafa, director at Bangladesh Bank, said most fraud could be prevented through basic digital discipline rather than better technology, noting that nearly all financial fraud he had observed occurred because people shared passwords or one-time passwords.

He described cybersecurity as primarily a behavioral challenge and called on small business owners to separate personal and business transactions, restrict employee access based on role, and revoke digital permissions immediately when staff members leave the organization.

Mustafa also noted that the central bank has introduced financial literacy content into secondary school textbooks and now permits teenagers aged 14 and above to open mobile financial service accounts under guardian supervision, to establish safer digital habits before they enter the workforce.

SME Foundation: Digital Transformation Makes Cyber Awareness Non-Negotiable

Farzana Khan, deputy managing director of the SME Foundation, told the roundtable that digital adoption is no longer optional for micro, small and medium enterprises, making cyber resilience an equally essential business requirement.

She said that while the Foundation provides training on digital literacy and website development, the most effective protection remains consistently refusing to share OTPs or passwords with any third party. Khan also called for a unified cybersecurity ecosystem to better coordinate the protection of small businesses across Bangladesh.

Fraudsters Using Fake Pages, Social Engineering and Cloned Identities

Law enforcement representatives said criminals are increasingly relying on social manipulation rather than technical intrusion to defraud small business owners.

Md Hafizul Islam Babu, additional deputy commissioner of Dhaka Metropolitan Police’s Cyber and Special Crime Division, said typical fraud methods include fabricated payment confirmations, cloned business pages and impersonation of trusted contacts. He described monitoring a suspect whose fraudulent account grew from Tk 3,000 to Tk 40,000 in a single day, illustrating how quickly stolen funds accumulate and are dispersed.

Babu called for a unified national cyber fraud reporting system with the authority to freeze assets before funds are transferred beyond reach.

Small Business Owners Describe Direct Losses

Small business owners at the roundtable described the practical impact of cyber fraud on their operations. Shahana Akter, an SME owner, said her Facebook business account was taken over by hackers who posted inappropriate content, causing significant damage to her beauty parlor’s reputation. She also reported losing money after paying in advance for an online training course that was never delivered.

Beauty Akther, whose family operates a mobile financial service agent business, said fraudulent calls are a routine occurrence but that the household has developed enough awareness to avoid being deceived.

Cybersecurity Community: Businesses Have No Backup and No Recovery Plan

Tanjim Al Fahim, founder of cybersecurity community Cyber71, said many small businesses only seek expert help after already sustaining significant losses. He identified two recurring patterns: business owners who lose their entire digital infrastructure because they maintain no secure data backup, and those who rely on a single Facebook page as their primary business presence without understanding the platform’s account suspension policies — only discovering the risk once their account is permanently disabled.

Syed Ibrahim Saajid, head of digital banking at City Bank PLC, said cybercriminals consistently adapt faster than institutions can respond. He attributed part of the problem to widespread data leaks that make impersonation straightforward, and proposed allowing banks to cross-verify customer mobile numbers with the Bangladesh Telecommunication Regulatory Commission, estimating this measure alone could reduce fraud incidence by half.

Structural Reforms Called For Alongside Awareness

Several speakers called for systemic changes beyond awareness campaigns. Fasbeer Eskander, co-founder of The Front Page, questioned existing digital registration practices and called for stronger device security policies and internationally recognized compliance frameworks for small businesses. M Abu Eusuf, executive director of RAPID, said even professionally educated individuals fall victim to sophisticated impersonation scams and proposed capping the number of SIM cards that can be registered to a single person as an administrative control.

Md Shazzad Hossain, professor and dean at North South University, said human error remains the largest single vulnerability, citing a ransomware incident triggered when an employee clicked a fraudulent online advertisement. He proposed establishing a cyber intelligence lab for digital forensics, with active student involvement in national cyber resilience efforts.

Asia Foundation: Protecting Small Business Owners Means Protecting the Economy

Kazi Faisal Bin Seraj, country representative of The Asia Foundation, said protecting small enterprises from cyber threats requires matching stronger awareness efforts with continued support for digital growth rather than limiting adoption out of caution. He stressed that restricting digital innovation in response to fraud risks would undermine the economic development that digital tools enable for small business owners across Bangladesh.

Izlal Hossain, senior program manager at The Asia Foundation, said small business owners represent a foundational layer of Bangladesh’s economy, and that raising their cyber awareness is a national economic responsibility.