News

Fake Invoices and Phishing Messages: 7 Checks for Bhutanese Offices

Most scams that reach Bhutanese offices do not look like hacking. They arrive as an ordinary email, a WhatsApp or WeChat message, or a phone call: an “urgent” invoice, a supplier asking to change their bank account, a message that seems to come from the boss, or a link asking you to log in again. A few simple checks, practised by everyone who handles money or accounts, stop most of them. Here are seven.

1. Slow down when a message is urgent

Pressure is the most common sign of a scam: “pay today”, “your account will be closed”, “I am in a meeting, just transfer it”. A genuine colleague or supplier can wait ten minutes while you check. Make it normal in your office to pause before acting on any urgent request for money, passwords or documents.

2. Check the sender, not just the name

The display name can say anything. Look at the full email address or phone number. Watch for small changes to a familiar domain, free email accounts used by someone who normally writes from a company address, and replies that go to a different address from the one that sent the message.

3. Confirm bank detail changes by phone

If a supplier, landlord or partner says their account number has changed, never accept that by email or chat alone. Call them on a number you already have on file, not the number in the message, and confirm the change with someone you know. Write this rule into your payment procedure so it does not depend on one person remembering it.

4. Look before you click a link

Before clicking, hover over the link on a computer, or press and hold on a phone, to see where it really goes. If a message asks you to sign in to email, a bank or a government service, do not use the link. Open the site yourself from a bookmark or by typing the address you know.

5. Be careful with attachments

Unexpected attachments, especially compressed files, documents asking you to “enable content” or “enable macros”, and files with unusual names, deserve a second look. If you were not expecting a file, ask the sender through another channel whether they sent it.

6. Use two-step login on email and key accounts

Even careful people are sometimes fooled. Two-step verification on email, social media pages and online banking means a stolen password alone is not enough to get in. Turn it on for the accounts that matter most first, and keep the recovery phone numbers and email addresses up to date.

7. Make it easy to report a mistake

If someone clicks a bad link or shares a password, the fastest fix is for them to say so straight away, so the password can be changed and the bank contacted if needed. Staff who fear blame stay quiet, and that is when real damage happens. Tell your team who to call, and thank people who report suspicious messages.

Need help putting these checks in place?

eDruk Private Limited has supported organisations in Bhutan with software, networking and technical consultation since 2004. We can help you review how your office handles email, logins and payment requests, set up two-step verification, and plan simple procedures that fit the way your team works.

Contact us at edruk@edruk.com.bt, call +975 2 332277, or visit www.edruk.com.bt.

News

Cloud Storage or an Office Server? 7 Questions for Bhutanese Organisations

Many offices in Bhutan now keep their files somewhere other than a single computer: a shared folder in the office, a server in a cabinet, or an online service that staff open in a browser. The choice should follow how the office actually works, not only which tool is already on one computer. Here are seven questions that help you decide.

1. Where do people need to open the files?

If most work happens at desks in one building, a well-set-up office server or shared folder can be simple and fast. If staff travel between dzongkhags, work from another site, or need to share documents with people outside the office, an online service may save a lot of copying files onto pendrives.

2. How reliable is your internet during the working day?

Online storage needs a working connection. Where the link drops for hours, or several people share a modest connection, staff may not be able to open or save files when they need them. An office server keeps working when the internet is down, provided the local network is up. If you use an online service, ask whether it can keep a copy on the computer for offline work, and test that during a real outage.

3. Who will look after it when something goes wrong?

A server in a cabinet needs someone to keep it powered, updated and backed up, and to notice when a disk is failing. An online service shifts most of that work to the provider, but you still need a person in your organisation who understands the accounts, the permissions and how to recover a file. Write down who that person is, and what happens when they are on leave.

4. Who is allowed to see which files?

Whether the files sit in the office or online, you still need folders with clear permissions: finance files for the accounts team, draft letters for administration, and so on. A single open folder and a shared password quickly become messy and risky. Individual logins and folders based on each role are easier to manage when someone joins or leaves.

5. How will you back the files up?

Keeping files only in one place is not a backup. If you use an office server, plan a second copy that is not in the same cabinet, and test that you can restore it. If you use an online service, do not assume the provider’s copy is enough on its own. Ask how version history works, and whether you also keep an independent copy of your most important records.

6. What happens to the files if you change provider or equipment?

Ask how you would take a full copy of your data with you. For an office server, that means knowing which disks or backups hold the files and that they can be read on new equipment. For an online service, ask whether you can export everything in ordinary formats. Avoid arrangements where your documents are locked into a tool you cannot leave.

7. What will it cost to run, not only to start?

An office server needs power, a reasonably safe cabinet, replacement disks over time, and someone’s hours to look after it. An online service is usually a recurring fee that grows with the number of users and the amount of data. Write down both the start-up needs and the yearly running costs, including staff time, so the comparison is honest.

Choose what fits the way you work

There is no single right answer for every office in Bhutan. A small team in one building may be well served by a tidy, backed-up office server. A team that works across towns may need an online service, with a clear person in charge and a backup plan. The useful decision is the one that matches how you work, how reliable your connection is, and who will look after the system next year.

Need help deciding?

eDruk Private Limited, a Bhutanese software company established in 2004, can help you review how your office stores and shares files, and plan a setup that is practical to run. Talk to our team:

• Email: edruk@edruk.com.bt
• Phone: +975 2 332277
• Website: https://www.edruk.com.bt

News

Staff Joining or Leaving? 7 Steps to Manage Accounts and Access Safely

Every organisation has people joining, changing roles and moving on. Each change touches your systems: email accounts, shared folders, Wi-Fi, accounting software, door access and sometimes physical keys. When these changes are handled in a hurry, former staff can keep access long after they leave, and new staff can wait days before they are able to work. A simple, repeatable process avoids both problems. Here are seven practical steps for Bhutanese offices, schools and businesses.

1. Keep a list of every system that needs an account

Start by writing down everything a staff member may be given: business email, file sharing, internal software, the office network and Wi-Fi, printers, CCTV or gate controllers, social media pages, and any online portals your organisation uses. You cannot remove access you do not know about, so this list is the foundation of everything else.

2. Give access based on the role, not the person

Decide in advance what each role needs. An accounts assistant may need the finance system but not the server room; a front-desk officer may need the booking system but not payroll files. Giving only what the role requires keeps sensitive information safer and makes later changes much easier.

3. Use individual accounts instead of shared logins

Shared passwords such as one “admin” login for everyone are convenient, but when someone leaves, the password must be changed for all users, and it is impossible to know who did what. Individual accounts let you disable one person without disturbing the rest of the team.

4. Prepare a joining checklist

When a new staff member starts, work through the same checklist each time: create accounts from the role template, issue any ID or access card, set up the computer, and explain basic security habits such as strong passwords and how to recognise suspicious emails. A checklist means nothing important depends on someone’s memory.

5. Review access when roles change

Promotions and transfers are easy to overlook. Someone who moves from finance to administration may still have finance access months later. Whenever a role changes, add what is needed for the new role and remove what belonged to the old one.

6. Follow a leaving checklist on the last working day

When someone leaves, disable their accounts promptly rather than waiting weeks. Change any shared passwords they knew, collect laptops, access cards and keys, and update door or gate access lists. Before closing an email account, arrange for important messages and files to be handed over to a colleague so that nothing is lost.

7. Check the full list regularly

Every few months, compare your list of active accounts against your current staff list. Remove accounts that nobody uses and confirm that administrator rights are held only by those who genuinely need them. A short regular review often catches forgotten accounts before they become a risk.

Make it part of your routine

Managing staff access is less about expensive tools and more about having a clear process and following it every time. Once your list, role templates and checklists are in place, joining and leaving become quick, predictable tasks rather than last-minute worries.

Need help setting this up?

eDruk Private Limited, a Bhutanese software company established in 2004, can help you review your systems, organise user accounts and access, and plan secure networks and software that are easier to manage. Talk to our team:

• Email: edruk@edruk.com.bt
• Phone: +975 2 332277
• Website: https://www.edruk.com.bt