“Call detail records” and “live locations” available online through payment

An online market has emerged around the buying and selling of common citizens’ personal information. Such data are being sold through advertisements on Facebook, websites, Telegram and WhatsApp.

For a fee, buyers can obtain National Identity Card (NID) details, Call Detail Records (CDRs), mobile phone locations, lists of SMS messages, Taxpayer Identification Numbers (TINs), passport information and statements of mobile financial service accounts.

An investigation by the fact-checking organisation, Dismislab found 10 active websites selling personal information. In addition, more than 600 advertisements were found on Facebook alone in a single month.

Last June, while investigating the sale of voter lists, Dismislab found an advertisement for personal information in the comments section of a Facebook post.

Searching for the term “sign copy” used in the advertisement produced 675 posts. Of these posts, published between 15 June and 15 July, 605 offered to sell personal information.

Following a lead from one such post, Dismislab found a Telegram group called “Voter List”. After seeing an advertisement offering NID details for sale, Dismislab researchers contacted the advertisers posing as buyers.

They provided a mobile phone number and paid Tk 500, after which the advertisers sent a PDF of the subscriber’s NID card within 17 minutes.

All the information in the document, including the name, photograph and date of birth, matched the details of the relevant SIM card owner. Even the subscriber’s mother’s name, which had been corrected two months earlier, appeared in its updated form.

The same group also carried advertisements for various types of personal information from an account named “Help BD”.

In addition to NID details, the advertisements offered birth and death registration records, mobile locations, CDRs, SMS lists, IMEI numbers, TINs, police clearance certificates, passport copies and land development tax receipts for sale.

On 25 June, Dismislab contacted the administrator and requested a three-month Call Detail Record (CDR) for a Grameenphone number. The advertisers sent the file within two and a half hours after receiving Tk 1,050.

When Dismislab compared the 20 most recent contact numbers, call times and call types in the file with the subscriber’s actual call history, all the information matched.

On another website, Dismislab requested the location of a Grameenphone number. Within 16 minutes of making the payment, the website provided the number’s most recent active time, its mobile tower-based location, an address and a Google Maps link.

Following leads from Facebook posts and Telegram and WhatsApp groups, Dismislab identified 10 active websites.

The sites had price lists for various types of information, including NID details, birth registration records, TINs, CDRs and mobile locations. Dismislab said almost all of the sites had similar designs and operating methods.

At least 112 different mobile phone numbers were used to communicate with potential buyers through these posts. In addition, Dismislab repeatedly found advertisements for the sale of personal information in 36 active Facebook groups.

Dismislab’s investigation also found that many sellers on social media were not the direct sources of the information. Instead, they bought data from other websites or groups and resold them at higher prices.

Dismislab researchers spoke to the owner of such a website in Chandpur. The owner said he bought mobile subscribers’ call lists for Tk 800 and sold them for Tk 900. He also said bKash statements were available for Tk 4,500.

The seller told Dismislab that he collected information from a group and claimed that the group used an API (a controlled communication system for exchanging information between two different software applications) to breach the security of government servers and collect data. However, Dismislab said it could not independently verify the claim.

Dismislab’s investigation found that posts advertising the sale of personal information had been appearing since 2023. It also found a video published on YouTube in March 2025 containing an advertisement for similar services.

Experts said CDRs contain information about whom a person has spoken to, when and for how long, and whether the person made or received a call.

They may also contain the IMEI (mobile phone identification) number and information about the mobile tower used when making calls or sending SMS messages. Long-term records can also make it possible to infer a person’s patterns of movement.

Information technology specialist Sumon Ahmed Sabir said, “Call Detail Records and location data can reveal a person’s communication and movement patterns. As a result, there is a risk that such information could be used for surveillance, harassment or fraud.”