An online market for citizens’ personal data has emerged, with sensitive information being sold through Facebook advertisements, websites, Telegram and WhatsApp, according to an investigation report by fact-checking and digital media research initiative Dismislab.
National identity cards (NIDs), call detail records (CDRs), mobile phone location data, SMS lists, tax identification numbers (TINs), passport information and mobile financial service statements are available for purchase, it found.
Published today, the report, titled “Almost everything about You, for sale”, identified 10 active websites selling personal data. It also found more than 600 advertisements on Facebook in a single month.
While investigating the sale of voter lists in June, Dismislab found an advertisement offering personal data in the comments section of a Facebook post. A search using the term “sign copy” mentioned in the advertisement returned 675 posts. Of those published between June 15 and July 15, 605 offered personal data for sale.
Following one such post, Dismislab found a Telegram group called “Voter List”. Researchers contacted an advertiser posing as buyers after seeing an advertisement for NIDs.
After providing a mobile phone number and paying Tk 500, they received a PDF of the subscriber’s NID card within 17 minutes. The name, photograph, date of birth and other information matched the details of the SIM card owner. Even the owner’s mother’s name, which had been corrected two months earlier, appeared in its updated form.
The same Telegram group also carried advertisements from an account named “Help BD” offering various types of personal information.
Alongside NIDs, the advertiser offered birth and death registration records, mobile location data, CDRs, SMS lists, IMEI numbers, TINs, police clearance certificates, passport copies and land development tax receipts.
On June 25, Dismislab contacted the administrator and requested three months of CDRs for a Grameenphone number. The file was sent within two and a half hours after a payment of Tk 1,050. Researchers compared the 20 most recent contact numbers, call times and call types in the file with the subscriber’s actual call history and found that they matched.
At another website, Dismislab requested the location of a Grameenphone number. Within 16 minutes of payment, the seller provided the number’s latest active time, its mobile tower-based location, an address and a Google Maps link.
A large market with multiple layers
Following Facebook posts,Telegram and WhatsApp groups, Dismislab identified 10 active websites.
The sites featured price lists for NIDs, birth registration records, TINs, CDRs, mobile location data and other information.
According to Dismislab, almost all the sites had similar designs and operating methods.
At least 112 different mobile phone numbers were used to make contact through the posts. The investigation also found repeated advertisements for personal data in 36 active Facebook groups.
Dismislab found that many sellers on social media were not the direct sources of the information. Instead, they bought data from other websites or groups and resold it at higher prices.
Researchers spoke to the owner of a website in Chandpur, who said he bought a mobile subscriber’s call records for Tk 800 and resold them for Tk 900. He also said a bKash statement could be obtained for Tk 4,500.
The seller told Dismislab that he collected data from a group, which allegedly used an API, a controlled communication system for exchanging information between two different software programmes, to breach the security of government servers and collect the data. Dismislab said it could not independently verify the claim.
The investigation found that posts offering personal data for sale had been appearing since 2023. It also found a YouTube video published in March 2025 advertising similar services.
Experts said CDRs contain information on whom a person has spoken to, when and for how long, and whether a call was made or received.
They may also contain an IMEI number, which identifies a mobile phone, as well as information on the mobile towers used during calls or SMSs. Long-term records can be used to infer a person’s patterns of movement.
