Keeping your panel account safe: passwords, API keys and the balance
A panel account is a wallet with a login on it. Treat it the way you treat a bKash PIN rather than the way you treat a forum password.
What an attacker actually wants
Not your data — your balance. Someone in your account can place orders against their own links until the money is gone. There is no withdrawal to intercept and no card to charge back; the credit simply becomes somebody else's followers.
That shapes what matters. The defence is keeping people out, because there is very little to recover afterwards.
The password
- Different from every other password you use. The most common way a panel account is taken is not the panel being breached — it is a password reused from a site that was.
- Long beats complicated. Three unrelated words are stronger and easier to remember than
P@ssw0rd!. - Never the same as your email password. Whoever has your email has every password reset you own.
Which leads to the thing people skip: the email account is the real account. Put a strong password and two-factor authentication on your Gmail before worrying about anything else. Every other login you have is downstream of it.
The API key
If you have generated an API key, you are holding something more dangerous than your password: a key needs no login, no browser and no session. Anyone with it can spend the balance from anywhere.
- Never put it in front-end code. Not in JavaScript, not in a mobile app, not in anything a user can open. It belongs on your server only.
- Never commit it to git. Public repositories are scanned for keys within minutes of a push, automatically, at scale.
- Never paste it into a support chat — ours or anyone's. Nobody needs it to help you.
- Regenerate it the moment you suspect it has been anywhere it should not be. The old key stops working instantly, which is the point.
Keep the balance small
The most effective control is the least technical one: hold roughly what you plan to spend this week rather than this quarter. A compromised account with 200 taka in it is an annoyance; the same account with 40,000 is a bad month.
This also limits what a mistake costs — a wrong quantity typed into a mass order is bounded by the balance, and a balance that cannot cover it stops the batch instead of completing it.
What to check, in order, if something feels wrong
- Transactions. Every taka that moved has a row. Read the last few days: an order you did not place, or an adjustment you did not expect, is visible immediately.
- Orders. Look for links that are not yours. That is what a compromised account looks like — your money, someone else's account growing.
- Change the password. Then change your email password, in that order.
- Regenerate the API key, whether or not you think it was involved.
- Open a ticket with the order numbers. Orders already with the supplier cannot be pulled back, but they can be documented and stopped from repeating.
Things that are never us
Nobody from a panel will ask for your password, your API key, your bKash PIN or an OTP. Not in a ticket, not on WhatsApp, not in a Telegram group. Anyone who does is not from the panel, however convincing the profile picture is.
And check the address bar before you type anything. Lookalike domains — a hyphen added, a letter swapped — exist for exactly this, and they are convincing because they are copies of the real page.
Why there is nothing to claw back
It is worth understanding why this matters more here than on an ordinary website. When credit is spent, it becomes an order at a supplier, and that order becomes delivery on somebody's account within minutes. There is no pending state to freeze and no counterparty to charge back — the money has already left the system by the time anyone notices.
That asymmetry is the whole argument for the two dull controls on this page: a unique password and a small balance. Neither is clever, and between them they remove most of what can go wrong.
If you share the account
Plenty of people run a panel account with a partner or an employee. Sharing one login means nothing in the transaction list can ever be attributed to anyone, which matters on the day something is wrong.
Where the option exists, use separate logins. Where it does not, at least keep the balance low enough that a disagreement is about a small number, and change the password when someone stops working with you — the same day, not eventually.
Recovery starts with the email
If you lose access, everything runs through the address on the account. Keep it one you can still open — an old office address you cannot reach is a locked door.
Phones and browsers
The account is only as safe as the device it is signed in on. A saved password in a browser on a shared or unlocked phone is a password anybody who picks it up already has.
- Do not stay signed in on a device other people use.
- Put a lock on the phone the account is signed in on. It is the single highest-value thing on this page.
- Sign out on a public or borrowed computer — closing the tab is not signing out.
Recognising the common approach
Most attempts on a panel account are not technical. They are a message: someone claiming to be support, offering a bonus, warning of a suspension, or asking you to "verify" through a link. The link goes to a copy of the login page, and what you type there goes straight to them.
The defence is a rule rather than a judgement: never sign in from a link somebody sent you. Type the address yourself, every time, and the entire category stops working.
The habit worth building
Read your transaction list once a week, the way you would glance at a bank statement. It takes thirty seconds, and it is the difference between noticing something on the first day and noticing it after the balance is gone.
Comments
No comments yet — be the first.
