occur not because of a single actor’s negligence but due to misalignment among interdependent ac- tors. Despite
its relevance Bangladesh’s digital-finance sector still tends to treat cyber fraud as an issue of either individual or
organizational failure. High-profile fraud cases, including ATM heists, phishing attacks and OTP scams, are often
cited in re- ports and media, but academic literature rarely provides system- level analyses of these incidents. The
2025 Standard Chartered
Bank (SCB) OTP scam exemplifies the kind of interdependent vulnerability that distributed-responsibility
frameworks can illuminate. Such failures involve banks, telecom operators and regulatory oversight,
compounded by user susceptibility.
In sum, the existing literature provides robust evidence of the growth of digital finance, patterns of cyber fraud
and the socio-technical vulnerabilities of users. It also demonstrates that fragmented governance and insufficient
coordination among institutions significantly exacerbate these risks. However, there is a clear gap in applying a
systemic, distributed- responsibility perspective to Bangladesh’s digital financial ecosystem. This gap justifies
the present study, which integrates behavioral, technical, and institutional analyses to pro- pose a framework for
multi-actor accountability in preventing and mitigating cyber fraud.
METHODOLOGY
This study employs a qualitative and interpretive approach to investigate how cyber fraud emerges from systemic
weaknesses across interdependent actors in Bangladesh’s digital financial ecosystem. The SCB 2025 OTP scam
was chosen as a focal case because it revealed cross-sector vulnerabilities and institutional fragmentation among
banks, mobile financial service (MFS) providers, telecom operators, and regulators.
Data were drawn from secondary sources, including verified news articles, regulatory communications, and user
testimonies. The incident first surfaced on social media platforms such as LinkedIn and Facebook, where victims
shared their experiences of unauthorized withdrawals and their struggles to receive assistance from banks and
telecom operators. These early posts were later substantiated by mainstream news coverage that provided detailed
accounts and official responses.
The collected materials were analyzed thematically, identifying how technical, institutional, and user-level
vulnerabilities interacted to enable systemic failure. While the study does not rely on confidential banking data
or forensic audits, this interpretive approach captures the multi-actor dynamics that under- lie cyber fraud in
Bangladesh’s fintech ecosystem, forming the analytical basis for the subsequent case study.
CASE STUDY: THE SCB 2025 OTP SCAM
Background of the SCB OTP Scam
The 2025 Standard Chartered Bank (SCB) OTP scam, though not the most shocking indecent, emerged as one
of the most talked cyber fraud incidents in Bangladesh’s recent digital- finance history. Over a period of several
weeks, hundreds of customers reported unauthorized withdrawals from their ac- counts, facilitated through
interception of one-time passwords (OTPs) intended for transaction verification [12]. The attackers supposedly
employed coordinated social engineering campaigns, phishing calls and SIM swap techniques to gain control
over victims’ mobile numbers. This incident not onlyhighlighted technical vulnerabilities but also underscored
weaknesses in institutional coordination and regulatory oversight within the country’s rapidly digitizing financial
sector.
Technical and Institutional Vulnerabilities
From a technical perspective, the scam exploited multiple points of failure. SIM swapping allowed attackers to
reroute OTPs, undermining two-factor authentication. In several cases, SCB’s transaction-monitoring protocols
failed to flag unusual patterns, partly due to reliance on assumptions that mobile numbers were secure under user
control. At the institutional level, the case revealed fragmented responsibility among banks, MFS providers and
telecom operators. Banks depended on telecom operators for secure communication channels, while telecom
Page 932