The merchandiser’s vulnerable phone

For weeks, nothing happens. The app reads her screen, including notifications, and passes information on. Then the buyer’s finance team receives a revised proforma invoice from Nasrin’s email, inside the real thread, with genuine order numbers. The factory has changed banks, it says; please use the new account. The buyer pays. A month later, the factory asks where its money is. The buyer sends the remittance slip. Both are telling the truth. The money is gone.

Nobody hacked the factory’s servers. The IT team had secured the office computers. The breach came through a phone the company did not own or manage.

This is the overlooked part of Bangladesh’s export supply chain. The garment industry runs on speed, and speed runs on WhatsApp. Tech packs, prices, approvals and payment instructions travel through personal phones, often shared with family and rarely protected beyond a screen lock. After 2013, the industry learned, at terrible cost, to treat physical safety as part of what it sells. Digital safety has yet to have its moment.

The attacks are improving. Fake invoice emails once gave themselves away through stiff English or odd greetings. Now AI tools can study Nasrin’s messages and write like her, mixing English and Bangla and signing off with “Rgds.” They can also clone a voice from a short voice note. Even a buyer calling to check may hear a convincing imitation.

So where do you start?

With the phone. Most of what happened to Nasrin depended on one permission granted without thought. Accessibility and notification access are legitimate features, but a PDF editor does not need them. Security software can flag apps requesting unnecessary permissions and check those installed through links rather than the Play Store. For anyone handling a buyer account, this protection should be as routine as a factory ID card. Compared with one diverted payment, the cost is small.

Then with payments. Bank details should never change because an email or WhatsApp message says so. A call to a known number before any change takes effect would prevent many frauds. Better still, payment details could sit in a shared record visible to both factory and buyer, with every change signed and dated.

Finally, the data. Costing sheets and buyer contacts do not belong in chat groups that grow through forwarding. When a merchandiser joins a competitor, the factory may not know what she still holds. Trade platforms can give buyers, factories and auditors limited access, ending when the job does. These records can also help factories prove where their cotton came from when EU or US customers ask.

None of this requires a big IT department. Owners and managers must accept that a merchandiser’s phone is part of the factory, as much as the cutting floor or warehouse, and its security is their responsibility. Next time a buyer visits, someone will show them the fire exits and extinguishers. They should also show them how merchandisers’ phones are protected.

The writer is a software industry leader in Silicon Valley