In Bangladesh’s garment industry, the use of personal smartphones for critical business communications is creating significant cybersecurity risks that threaten both factories and their international buyers. This vulnerability was highlighted through a recent case involving a senior merchandiser at a knitwear factory in Gazipur, who manages communications with European buyers primarily through WhatsApp and email on her personal phone.
The merchandiser encountered a seemingly routine technical issue when attempting to sign a PDF late one night. Unable to open the file with her usual app, she installed a free “pro” editor linked by a friend, which requested accessibility permissions. While this permission is normally used to assist users, in this context, it allowed the app to capture sensitive information such as screen contents and notifications. The app covertly passed the data to cybercriminals who later sent a fraudulent invoice from the merchandiser’s genuine email thread, instructing a buyer’s finance team to divert payment to a new bank account controlled by the attackers.
Neither the factory’s internal IT systems nor office computers were compromised, as these were well secured. Instead, the breach exploited an unmanaged, personal device outside the company’s control. This case illustrates a broader and largely overlooked threat within Bangladesh’s export supply chain, where speed and convenience drive supply chain communications—primarily conducted through personal phones using apps like WhatsApp.
Industry insiders note that cybercriminal tactics have evolved rapidly. Early scams often contained linguistic errors or suspicious email formats that raised red flags. Now, artificial intelligence tools can replicate the writing style of merchandisers, blending English and Bangla naturally and using typical sign-offs, making phishing attempts far more convincing. Voice cloning technology further enables fraudsters to impersonate employees during verification calls, complicating traditional buyer diligence.
Experts say addressing this growing cyber risk starts with controlling app permissions on phones used for work. Security software can identify apps requesting unwarranted accessibility or notification access and flag those installed from unofficial sources rather than trusted app stores. For merchandisers handling buyer accounts, instituting such protections should be regarded as fundamental as issuing factory ID cards.
Payment processes also require stricter controls. Changes to bank account details should never be accepted solely on the basis of an email or WhatsApp message; verification through a direct call to a known factory contact is essential. Ideally, payment information should be maintained in a shared, secure record accessible to both buyer and factory, with every change documented and authorized to prevent fraud.
Furthermore, sensitive business information—including costing sheets and buyer contacts—should not circulate freely in informal chat groups, especially as individuals move between competitors. Trade platforms offering controlled access for buyers, factories, and auditors can help manage data security and assist factories in meeting demands from international clients regarding supply chain transparency, such as origin verification for cotton.
Addressing these vulnerabilities does not necessarily require large IT departments but demands recognition at the management level that a merchandiser’s phone is an integral part of factory operations. Just as physical safety measures like fire exits and extinguishers are standard protocol during buyer visits, so too should digital security practices be demonstrated and enforced to protect against cybercrime risks that increasingly threaten Bangladesh’s crucial garment export sector.