The forced displacement of the Rohingya from Myanmar to refugee camps in Bangladesh has placed the community within a state–humanitarian paradigm where digital technologies serve as key channels of aid but instruments of control. Our analysis reveals Rohingya refugees—stateless and reliant on temporary protection—encounter biometric IDs, registration platforms, and aid systems that promise support but often simultaneously deepen surveillance and data extraction. This case study examines how digital infrastructures shape their vulnerabilities, raising urgent questions about privacy, agency, and the governance of crisis technologies