Short answer: Mobile money accounts do not use authenticator apps. Their security rests on three things: a PIN nobody else knows, a phone number nobody can take from you, and your absolute refusal to share an OTP with anyone. Set a PIN that is not your birth year, add a port-out or SIM-replacement protection with your carrier, and treat every unexpected call about your account as a scam until proven otherwise.
Why this works differently
Most of our guides walk you through scanning a QR code into an authenticator app. Mobile financial services — bKash, Nagad, Rocket, and their equivalents in other countries — are built on a different model.
They authenticate you with your SIM and a PIN, and they verify actions with one-time passwords sent by SMS. There is no TOTP option to enable, no security key to register, and no passkey. What you can control is the strength of each link in that chain.
That chain has three links, and every real-world loss comes from one of them failing.
Link 1: Your PIN
The PIN is the only secret in the system. Treat it accordingly:
- Not a date. Birth year, marriage year, or a child’s birthday are the first guesses, and they are frequently discoverable.
- Not a pattern. 1234, 1122, 0000, or repeated digits.
- Not shared with anyone. Not a shop assistant helping with a transaction, not a relative, not an agent.
- Not entered in front of people. Shield the keypad, the same as at an ATM.
- Changed if anyone has ever seen it.
A specific warning: agents at cash-in and cash-out points should never need your PIN. If someone asks you to enter it into their device or tell it to them, stop the transaction.
Link 2: Your phone number
Your number is your account identity. Whoever controls it can receive the OTPs that authorise everything.
- Ask your carrier about SIM replacement protections — a PIN or additional verification before a replacement SIM is issued. This is the equivalent of a port-out PIN, and it is the single most valuable step. Background: SIM swap attacks.
- Act immediately if your phone loses signal unexpectedly and stays dead while others have service. That is the signature of a SIM swap in progress. Contact your carrier from another phone at once.
- Report a lost SIM immediately — before worrying about the handset.
- Never register your wallet on a number you do not own, and update it before giving up an old number: changing your phone number and 2FA.
Link 3: The OTP — where the losses actually happen
Almost every mobile money fraud comes down to a person voluntarily sharing a code. Not hacking. Not interception. A conversation.
The scripts, all of which are in active circulation:
- “I’m calling from customer care about a problem with your account.” They need the code to “verify” or “fix” it.
- “You’ve won a prize / cash reward.” The code is to “release” it.
- “I sent money to your number by mistake, please send it back.” Often with a fake confirmation SMS.
- “Your account will be suspended unless you verify now.”
- A relative’s voice in distress, asking you to send money urgently — increasingly using cloned audio. See AI voice cloning scams.
- Fake agent calls about a failed transaction.
- Job or loan offers requiring a “registration fee” or account verification.
The rule, with no exceptions: no legitimate provider will ever ask for your PIN or your OTP. Not customer care, not an agent, not the police, not your bank. If someone asks, they are stealing from you. Hang up.
More on these scripts: OTP scams and smishing and vishing.
Practical habits worth adopting
- Read the SMS before acting. The message states what the code authorises. If it says “cash out” and you are not cashing out, someone else is.
- Hang up and call the official number printed on the provider’s website or app — never a number from a message or given by a caller.
- Check your transaction history weekly. Small unexplained amounts often precede larger ones.
- Turn off message previews on your lock screen so codes are not visible to anyone holding your phone.
- Lock the app with a screen lock, and use a strong device passcode rather than a simple pattern.
- Download only the official app from the official store, checking the publisher. Fake mobile money apps exist and exist only to harvest PINs.
- Do not use the app on a rooted or jailbroken phone, or one with apps from unknown sources.
- Keep balances modest. Move larger amounts to a bank account rather than leaving them in the wallet.
If something goes wrong
- Call the provider’s official helpline immediately. Speed determines whether a transaction can be stopped or traced.
- Change your PIN if you still have access.
- Contact your mobile carrier if you suspect a SIM swap, and block the SIM.
- Report to the police or the relevant cybercrime unit, and keep the reference number.
- Keep evidence — screenshots, transaction IDs, the caller’s number, times.
- Warn family members, since these scams often work through contact lists.
Frequently asked questions
Can I use Google Authenticator with a mobile wallet?
No. These services do not support TOTP. Your protections are the PIN, the SIM, and your discipline about codes. Authenticator apps remain the right tool everywhere they are offered — see what is an authenticator app.
Is the OTP by SMS safe?
It is the weakest common method, for the reasons in SMS 2FA vs authenticator apps — but in this context it is what exists. Protect the SIM and never share the code, and the practical risk drops sharply. Banks reach the same conclusion for much the same reasons — see why banks still use SMS 2FA.
Someone sent me money by mistake and wants it back. What do I do?
Do not send anything and do not share any code. Tell them to contact the provider, who can reverse a genuine error. This is one of the most common scams, usually paired with a fake confirmation message.
An agent asked for my PIN to complete a transaction. Is that normal?
No. Never share it. Complete transactions yourself on your own handset.
My phone was stolen. What first?
Call the provider to block the account, then the carrier to block the SIM, then report it. Do this in that order — the account matters more than the handset.
Should I keep my salary in a mobile wallet?
Convenient, but a bank account has stronger protections and clearer recourse. Use the wallet for spending and transfers, and keep larger balances elsewhere.
The bottom line
There is no app to install here — the security is a PIN nobody knows, a SIM nobody can replace, and a rule you never break about sharing codes. Sort out the carrier protection this week, change a weak PIN today, and tell every family member the one sentence that matters: nobody legitimate ever asks for your PIN or your OTP.
Securing accounts that do support proper 2FA? Start with your email account — it protects everything else.