How Mobile Phones Became the Front Line of Bhutan’s Cybercrime Wave

Bhutan’s cybercrime problem no longer lives mainly on office computers. It lives in people’s pockets.

As smartphones became the default way Bhutanese people bank, shop, chat, apply for jobs, and receive official messages, they also became the easiest tool for fraudsters. Police data, telecom rules, and recent case files all point to the same pattern: most of the country’s growing digital crime now starts, travels, or ends on a mobile phone.

That shift is not abstract. It shows up in lottery texts, fake dollar-exchange offers, sudden phone blackouts, shared OTPs, and recycled SIM cards. It also shows up in the money that never comes back.

A problem that grew with the handset

Royal Bhutan Police figures show financial scams climbing fast. Between 2023 and early 2026, police recorded 365 scam cases involving about Nu 40.1 million. Only Nu 12.57 million was recovered. A related tally put 318 financial scam cases from 2024 to 2026 at Nu 37.08 million in losses, with nearly two-thirds still missing.

The year-by-year jump is stark. In 2023, police logged 17 cases involving Nu 1.76 million. In 2024 the number rose to 147 cases and Nu 16.58 million. In 2025 it rose again, to 167 cases and Nu 18.24 million. By early 2026, 35 cases had already been recorded, involving Nu 5.48 million.

Cybercrime more broadly has been climbing since 2022, with 469 cases on the books in one official count and Thimphu accounting for about 43 percent of the total. The capital remains the main hotspot because that is where banking, smartphones, and social media use are densest. Other districts have begun to appear in the data as well, which means the problem is no longer confined to Thimphu.

The most common traps are familiar because they arrive on the same device people use every day: lottery prize scams, Australian dollar exchange scams, fake investment offers, rental advertisements, online shopping fraud, crypto pitches, and OTP-sharing scams. Lottery cases led one multi-year count with 98 incidents. Dollar-exchange scams followed close behind. OTP-sharing cases tripled from nine in 2024 to 29 in 2025.

Those numbers matter because Bhutanese banking now runs through the phone. Once a scammer has an OTP, the transfer can be finished in minutes. After that, recovery is hard.

Why the phone sits at the centre

Almost everyone in the country now carries a smartphone. Officials have put mobile internet access at around 95 percent. In 2024 alone, Bhutan imported more than 127,000 smartphones worth Nu 2.72 billion. The handset is no longer a luxury item. It is the main computer, the main bank branch, and the main mailbox.

Criminals noticed.

Mobile phones are used to send fake SMS and calls impersonating banks, government offices, or relatives. They are used to harvest OTPs that unlock mobile banking. They are used to install spyware or gain remote access. They are used for blackmail, defamation, stalking, and explicit-content threats. They are used to recycle or misuse SIM cards after numbers change hands. And they are used to move money quickly once a victim is tricked.

A 2024 analysis tied to police reporting put it plainly: mobile phones are used both to commit crime and to hide it. Heavy, uncritical phone use also makes people easier to target. Users who treat every message as urgent, and every unknown number as possibly official, give scammers the opening they need.

The methods have names. Smishing uses SMS to look like a bank or government notice. Vishing uses voice calls from people who sound official. SMS spoofing disguises the sender. Phishing emails still matter, but they often work because the victim’s email is tied to a bank app on the same phone. Once a link is opened, the next demand is usually the OTP that arrives on that device.

Newer cases show how far the attack surface has moved onto the handset itself. In 2026 police recorded 12 email-compromise cases involving Nu 600,905 and four “mobile blackout” or bland-out cases involving just over Nu 1 million. In the blackout cases, phones suddenly went dark. Victims later found money gone from their accounts. Officers have warned that a phone does not normally shut down without a reason. The advice that followed was simple: freeze the account first, then call the police.

The phone is also the delivery system for crimes that are not only about money. Bhutan recorded its first deepfake cybercrime case when a suspect used AI tools to superimpose the faces of three girls, including two minors, onto explicit images and then threatened to circulate them. Cyberbullying has been a separate and larger count, with hundreds of incidents reported in a single year. Forest officials have even said illegal wildlife trade is moving onto phones and social media because “as long as a person has a mobile phone, it becomes both a buyer and seller platform.”

The common thread is access. The device that made daily life easier also shortened the path to a bank account, a private photo, or a frightened teenager.

What the state is trying to do

BICMA has tightened SIM rules and introduced new mobile number series to make it harder to recycle numbers used in fraud. Officials have discussed holding deactivated SIMs longer before reuse, stripping numbers from bank accounts before those numbers are recycled, and cutting connections for expired work-permit holders so those SIMs cannot be reused for scams. Foreign workers’ numbers have been a particular concern because they can be left active after a permit ends.

Police now work with Bhutan Telecom, TashiCell, the Royal Monetary Authority, banks, and GovTech. Tower tracking has helped in some investigations. Coordination meetings have looked at delinking email from financial services where that link is being abused. Public warnings repeat the same points: do not share OTPs, do not click unknown links, and report fast.

The legal side is still thin. A Public Accounts Committee report in 2026 noted that Bhutan still lacks a clear legal definition of cybercrime, a single lead agency for cybersecurity, and strong cross-border investigation tools beyond India. The Information, Communications and Media Act does not cover the full range of modern digital offences, so police and prosecutors fall back on the Penal Code and other older laws. Many incidents may go unreported for that reason. Cross-border scams are especially hard to unwind once money leaves the country.

That gap matters because the scams are not only local. Lottery texts, dollar-exchange offers, and investment pitches often use Bhutanese middlemen and foreign handlers. Speed is the fraudster’s advantage. Law is still catching up.

What actually protects people

Most losses happen in minutes. Once money moves, recovery is the exception, not the rule.

The habits that work are unglamorous:

• Never share an OTP, even with someone who sounds official.
• Treat unexpected lottery, dollar-exchange, investment, rent, and job messages as fraud until proven otherwise.
• If a phone blacks out suddenly, call the bank first, then the police.
• Keep banking apps and email on tightly controlled access.
• Do not click links in SMS or WhatsApp from unknown numbers.
• Report the number and the message immediately.

Banks and telecom firms can block numbers and freeze accounts. They cannot undo a transfer that has already been split across several accounts. That is why police keep saying individual vigilance is still the first line of defence.

Bhutan’s digital push is not the problem. High mobile access, banking on phones, and official services moving online are part of how the country wants to work. The problem is that the same device now carries the password, the OTP, the photo album, and the family chat. Criminals only need one weak moment.

Until laws, SIM controls, and public habits catch up, the most important security tool in the country is still the person holding the phone.

About The Author