Fake Invoices and Phishing Messages: 7 Checks for Bhutanese Offices
Most scams that reach Bhutanese offices do not look like hacking. They arrive as an ordinary email, a WhatsApp or WeChat message, or a phone call: an “urgent” invoice, a supplier asking to change their bank account, a message that seems to come from the boss, or a link asking you to log in again. A few simple checks, practised by everyone who handles money or accounts, stop most of them. Here are seven.
1. Slow down when a message is urgent
Pressure is the most common sign of a scam: “pay today”, “your account will be closed”, “I am in a meeting, just transfer it”. A genuine colleague or supplier can wait ten minutes while you check. Make it normal in your office to pause before acting on any urgent request for money, passwords or documents.
2. Check the sender, not just the name
The display name can say anything. Look at the full email address or phone number. Watch for small changes to a familiar domain, free email accounts used by someone who normally writes from a company address, and replies that go to a different address from the one that sent the message.
3. Confirm bank detail changes by phone
If a supplier, landlord or partner says their account number has changed, never accept that by email or chat alone. Call them on a number you already have on file, not the number in the message, and confirm the change with someone you know. Write this rule into your payment procedure so it does not depend on one person remembering it.
4. Look before you click a link
Before clicking, hover over the link on a computer, or press and hold on a phone, to see where it really goes. If a message asks you to sign in to email, a bank or a government service, do not use the link. Open the site yourself from a bookmark or by typing the address you know.
5. Be careful with attachments
Unexpected attachments, especially compressed files, documents asking you to “enable content” or “enable macros”, and files with unusual names, deserve a second look. If you were not expecting a file, ask the sender through another channel whether they sent it.
6. Use two-step login on email and key accounts
Even careful people are sometimes fooled. Two-step verification on email, social media pages and online banking means a stolen password alone is not enough to get in. Turn it on for the accounts that matter most first, and keep the recovery phone numbers and email addresses up to date.
7. Make it easy to report a mistake
If someone clicks a bad link or shares a password, the fastest fix is for them to say so straight away, so the password can be changed and the bank contacted if needed. Staff who fear blame stay quiet, and that is when real damage happens. Tell your team who to call, and thank people who report suspicious messages.
Need help putting these checks in place?
eDruk Private Limited has supported organisations in Bhutan with software, networking and technical consultation since 2004. We can help you review how your office handles email, logins and payment requests, set up two-step verification, and plan simple procedures that fit the way your team works.
Contact us at edruk@edruk.com.bt, call +975 2 332277, or visit www.edruk.com.bt.