With fraud, identity theft and online scams dominating cyber-related offences, police data show that criminals are increasingly targeting people rather than computer systems.
A message flashes on a mobile phone. It could be a delivery update, an attractive shopping offer, news of an unexpected prize or simply someone asking for a one-time password (OTP).
Nothing about it necessarily looks dangerous.
Yet, an ordinary message can be the beginning of a carefully constructed attempt to steal money, obtain personal information or take control of an online account. And as Bhutan becomes more digitally connected, such interactions are increasingly finding their way into the country’s crime statistics.
The Royal Bhutan Police’s Statistical Yearbook 2025 recorded 159 cyber-related criminal incidents during the year, revealing a form of crime that is increasingly being carried out through devices and platforms people use in their everyday lives.
What stands out is that Bhutan’s cybercrime problem is largely not one of sophisticated attacks against computer networks. Of the 159 cases, 158 involved offences committed using computers, mobile phones or digital platforms. Just one case involved an offence directly targeting the confidentiality, integrity or availability of a computer system.
In other words, technology is more often being used as a means to commit familiar crimes — fraud, forgery, harassment, blackmail and defamation — than being attacked itself.
Fraud dominates the numbers
Computer-related fraud and forgery accounted for 116 cases, representing about 73 percent of all cyber-related incidents recorded during the year. Another 42 were content-related offences, including harassment, defamation and blackmail.
Financial deception emerged as the most prominent threat.
Police recorded 30 cases involving OTP and banking fraud. Identity theft and account takeover accounted for 26 cases, while another 26 involved online financial fraud.
Online marketplaces, which have made buying and selling easier through digital platforms, have also created opportunities for deception. Twenty-four marketplace scam cases were recorded.
The remaining offences were spread across a range of activities, including cyberstalking and harassment, online defamation, impersonation, gambling, blackmail and sextortion, and fraudulent investment schemes.
The variety of offences suggests there is no single profile of cybercrime in Bhutan. The method changes according to what an offender wants — money, personal information, access to an account or leverage over another person.
Deception rather than hacking
At the heart of many cases is a comparatively simple technique: convincing the victim to cooperate.
Social engineering relies on manipulating people into revealing confidential information, clicking something they should not, transferring money or otherwise taking an action that benefits the offender.
OTP theft through social engineering alone accounted for 28 cases, making it the most frequently recorded method.
Harassment and defamation campaigns followed with 22 cases, while fake online marketplaces accounted for 19.
Police also recorded 14 cases involving the misuse of CID or voter card information in the CPMS/BMS system.
Other methods ranged from criminals posing as officials or employees of telecommunications companies to lucky-draw and prize scams. Sextortion, threatening digital content, and investment or Ponzi schemes also appeared in the police records.
The pattern is significant because it shifts the focus of cybercrime away from the stereotypical image of a technically skilled hacker sitting behind multiple computer screens. In many cases, the weakest point being exploited is not a computer system but the trust of the person holding the phone.
The smartphone at the centre
That phone has emerged as the primary device in Bhutan’s cyber-related crime picture.
Mobile phones were associated with 126 records, accounting for 86.3 percent of cases in which the technology involved was recorded.
Their prominence is hardly surprising. Smartphones have become gateways to bank accounts, social media profiles, shopping platforms, digital payments and personal communication. A single device can contain financial details, photographs, identity information, passwords and access to multiple accounts.
That convenience also concentrates risk.
A fraudster no longer necessarily needs physical access to a victim’s wallet or documents. A convincing message and a few pieces of information can sometimes be enough to persuade someone to reveal an OTP, transfer money or surrender access to an account.
And for many victims, the consequences are financial.
Of the 159 cyber-related incidents recorded by police, 104 — or 65.4 percent — involved monetary loss. The remaining 55 cases did not record a financial loss.
The yearbook does not state the combined amount of money lost, but the proportion of cases involving financial damage underlines how quickly an online interaction can translate into a real-world economic consequence.
Beyond the capital
Thimphu remained the country’s largest centre for reported cyber-related crime, recording 61 cases, or 38.4 percent of the national total.
Chhukha recorded 27 cases and Sarpang 11.
But cybercrime is not constrained by the geography that traditionally shapes policing. An offender and victim do not have to be in the same town — or even meet — for an offence to take place.
That makes growing digital access across Bhutan both an opportunity and a challenge.
Online banking and payments reduce the need to travel to conduct financial transactions. Social media connects people instantly, while online marketplaces allow goods and services to be advertised far beyond local communities.
The same networks can also carry fraudulent advertisements, impersonation attempts and deceptive messages just as easily.
The police statistics therefore point to a broader change in Bhutan’s crime landscape. As more parts of daily life move onto phones and digital platforms, some forms of crime are moving with them.
The tools may be new, but many of the tactics are old: gaining trust, creating urgency, promising rewards, exploiting fear or pretending to be someone with authority.
The difference is that these approaches can now arrive instantly on a screen — disguised as a routine message, an attractive deal or a request that appears harmless.
For Bhutan’s increasingly connected population, the mobile phone has become indispensable. The 2025 figures also show why it must increasingly be treated as something else: a place where everyday caution matters just as much as it does in the physical world.
