Bangladesh Railway has asked the joint venture that runs its online ticketing system to explain allegations that automated bots were grabbing train tickets the moment sales opened, so they could be resold at higher prices. The contractor, a joint venture of Shohoz, Synesis and Vincen, has submitted its response, and the railway says it is now reviewing it with IT specialists.
The case turns a long-running passenger complaint into a formal question about who controls the country’s busiest digital ticket counter. For years, travellers have reported that tickets for popular routes vanish within seconds of going on sale, especially before Eid, only to reappear through middlemen at a premium.
What the audits found
An internal railway document dated 11 October recommended that the joint venture’s managing director be asked to respond within three working days. It linked the bot activity to an unauthorised website, bookmyrailbd.com, which allegedly held large blocks of tickets for resale.
The audit work also pointed to weaknesses inside the system itself. According to the findings, the administrator dashboard could allow seats to be held several days before public sales began. Auditors counted around 169 administrator accounts, flagged security gaps, and noted that Shohoz staff retained admin privileges at some stations, including the ability to add or remove coaches and change seat information. Some of those accounts were registered in the names of stationmasters.
The Transport Audit Directorate sent 22 audit memos to the railway’s director general in August. A separate audit covering fiscal years 2021-22 to 2025-26 alleged a shortfall in the money deposited to the government treasury against online ticket revenue, and said fines of about Tk 1.4 crore had not been recovered from the contractor.
Director General Afzal Hossain said the railway could not rule out the contractor’s involvement in black marketing and had found evidence on several points, but no conclusion has been reached. He said action would follow once the explanations had been reviewed. Shohoz said it had sent documents and responses on contract terms, technology, data management and operations, and would keep cooperating with the audit, but declined to comment in detail.
What it means here
The railway has already moved on a few fronts. It has blocked close to 10,000 suspicious mobile numbers and national ID numbers, asked the BTRC to shut down bookmyrailbd.com, and begun bringing some administrative functions at stations under its own operational and commercial departments.
The timing matters. The five-year ticketing contract awarded in February 2022 ends in January 2027, and officials say tender documents for the next operator are ready. Whoever wins should expect tougher questions on bot detection, rate limits, purchase caps tied to verified identities, and, above all, who holds the admin keys.
For passengers, the lesson is simpler. A public service that sells millions of seats online is only as fair as its access controls. Faster servers alone will not stop scalpers if privileged accounts are spread across contractors and stations with little oversight. Clear audit trails and a railway that owns its own system controls are likely to do more for ordinary travellers than any new app feature.
