Embassy extortion and bomb threats: Same script, only the name has changed

Dhaka Metropolitan Detective Branch has described the extortion demands and threats emailed to various embassies and government offices in Dhaka as the work of a “fake group”, saying the incident may have been intended to damage the country’s image and embarrass the government.

Shiamak Ali, a contemporary researcher and writer on geopolitics who works for an international think tank, said two threatening emails sent two days apart appeared to offer fresh clues about the security scare involving several foreign missions in Dhaka. Ali said a closer reading of the messages raised “rather unusual questions” about what lay behind them.

According to Ali, the first email was sent on August 17 under the name “Yusuf Khan” to the Ministry of Foreign Affairs’ CSAT email. A second email followed on August 19 from a different name and address with the subject line “2 nd reminder, soon action”. Ali said the Russian Embassy, its consular section and the Cultural Section of the Chinese Embassy were copied into the second message.

Ali said both senders used the Latvian webmail service Inbox.lv and that both email addresses contained the word “noones”. Ali said the language in the two messages was almost identical, along with the bomb threat, mobile financial service accounts and cryptocurrency payment details. Ali added that the second email included two additional bKash and Nagad accounts beyond those listed earlier.

Ali said the webmail service’s current registration page did not show a mandatory phone number field at the initial sign-up stage. Ali added that subscribing to the premium service required a bank card, which could leave a transaction trail useful to investigators.

Ali said the payment demands contained major inconsistencies. According to Ali, the sender demanded 10 billion Pakistani rupees on August 17, but by August 19 the demand had changed to 10 billion Bangladeshi taka. Ali noted that the same Bangladesh-based bKash and Nagad accounts were attached to both emails, with no explanation for the currency shift.

Ali said the proposed payment structure also did not match the demand. The first email, Ali said, listed 12 bKash and Nagad accounts and instructed recipients to deposit Tk 150,000 into each account every day, which would total Tk 1.8 million daily. At that rate, Ali said, collecting Tk 10 billion would take more than 15 years.

Ali said the second email increased the number of accounts to 14, taking the daily total to Tk 2.1 million. Even then, Ali said, it would still take roughly 13 years to reach Tk 10 billion, despite a threat to bomb a building “by this week”.

Ali said the sender alternatively asked for the entire amount in cryptocurrency, listing the same Binance details and Bitcoin address in both emails. Ali quoted the message as saying: “We are crypto kings, prefer money in crypto.” Ali said the continuity of those payment channels, despite changing sender identities, was perhaps the clearest link between the two emails.

Ali also identified other irregularities. Ali said the threat referred to “your building” in the singular, although the second email was distributed to several institutions. Ali said neither message visibly identified an extremist organisation or set out any ideology, political demand or religious demand. Ali said the emails plainly appeared to be an attempt to extort money through threats of violence.

Ali said that distinction was important as the investigation continued. The Daily Star reported that the threat against the Chinese Embassy was purportedly issued in the name of an extremist organisation, though police were still verifying its source and had acknowledged the possibility of a hoax. Ajker Patrika separately reported that several embassies received similar “scripted” emails, with Counter Terrorism and Transnational Crime officials saying the messages appeared to be a scam.

Ali said the threat could not be dismissed solely because the arithmetic was implausible. Ali said the changing currencies, impossible payment schedule, repeated wording and rotating aliases increasingly pointed to a crude and coordinated extortion campaign. Ali said investigators now had to determine whether anything more serious lay behind it.