Logo of Phnom Penh Post newspaper Phnom Penh Post - Fake billing, invoice hack attacks targeting Kingdom

Fake billing, invoice hack attacks targeting Kingdom

Content image - Phnom Penh Post
Motorists ride past the telecoms ministry headquarters in the capital. Hong Menea

Fake billing, invoice hack attacks targeting Kingdom

The Ministry of Post and Telecommunications on May 23 issued a statement expressing concerns about cyberattacks in the Kingdom, calling for greater vigilance to thwart the rise of hacking attacks aimed at the private sector.

The statement said there had been a number of business email compromise (BEC) scams aimed at stealing cash by sending e-mails for payment invoices for transactions to overseas companies.

“The scam is particularly prevalent in the private sector, with cybercriminals hacking a company to study their business practices and records and then attacking the targeted entities by sending e-mails that appear to be invoices from known and legitimate sources,” it said.

This crime is often named in US laws as “theft by swindle”, meaning it is a theft that takes place by “swindling” – that is, tricking – the victims somehow rather than using violence or breaking an entry.

The Kingdom’s Criminal Code refers to all such thefts that rely on subterfuge or gaining the victim’s confidence first as forms “fraud” with different severities as defined in Chapter Two, Article 377.

The ministry said that hackers or sometimes organised groups of hackers will hack a company and gain access to their computer network and then research it and its employees carefully.

They then wait for the right moment to execute their plans, which usually involves submitting fake invoices with large payments due, or they may impersonate the company’s CEO or another executive or contact those corporate officers pretending to be a trusted vendor or business partner and then request a transfer of cash to an overseas account or request that payments for goods and services in the future be routed to a new bank account.

The groups often complete the deception by first hacking the network of the businesses on both ends of the transaction so that they are able to send a 100 per cent legitimate-looking request from one company to the other using the correct paperwork, employee names and even their real email addresses. This makes it a very difficult scam to defend against for companies that regularly make significant expenditures with dozens or sometimes even hundreds of vendors or service providers.

The ministry advised users to be extremely careful with measures such as carefully checking and verifying the names and email addresses, or to inquire by phone in case of suspicion even if the email from known people.

The ministry advised that all companies be very wary of all e-mails requesting a change be made to account information for cash transfers and to be sure to institute procedures and protocols that require employees to confirm or verify requests to change account information directly with individuals or business partners through means other than e-mail, such as phone calls, for example.

And after that they should consider going a step further and – without making mention of their intentions to do so while speaking to their business contact – try phoning their company’s security or IT department following that conversation and request that they independently verify the legitimacy of the transaction before allowing it.

And, the ministry noted, any company tricked in one of these scams should contact the bank immediately if they find out that they have been cheated and try to have the transaction reversed or frozen while also filing complaints with the police and other authorities if they ever want to find the hackers responsible and have them punished.

Independent digital security consultant Nget Mose said the reason for the increase in cyberattacks in Cambodia was because the sector’s development was still limited in terms of digital laws, tools and literacy, which made Cambodia an easy country to target for attacks via emails.

“The global trend of cyberattacks to steal or launder money is increasing everywhere, not just in Cambodia, but they are succeeding here at a higher rate than we’d like to see because our digital security infrastructure is still limited,” he said.

He added that in order to protect their businesses from these attacks, the private sector should have security management plans in place and build staff capacity in digital resources while implementing tighter protocols with multi-factor or multi-step verification or approval for certain highly sensitive data such as bank account information and other payment processes.

The ministry urged the public to get more information about such cases on the website of the Cambodia Computer Emergency Response Team Office (CamCERT) under the ministry’s Department of Security, Information and Communication Technology at www.camcert.gov.kh

They can also get more technical assistance and report illegal activity by emailing incident@camcert.gov.kh or calling 023 722 391 / 016 851 678.


  • Ministry orders all schools, public and private, to close for SEA Games

    From April 20 to May 18, all public and private educational institutions will be closed to maintain order and support Cambodia's hosting of the 32nd SEA Games and 12th ASEAN Para Games, said a directive from the Ministry of Education, Youth and Sport. Cambodia will host the

  • Almost 9K tourists see equinox sunrise at Angkor Wat

    Nearly 9,000 visitors – including 2,226 international tourists – gathered at Angkor Wat on March 21 to view the spring equinox sunrise, according to a senior official of the Siem Reap provinical tourism department. Ngov Seng Kak, director of the department, said a total of 8,726 people visited Angkor Wat to

  • Angkor Beer strengthens national pride with golden new look and fresher taste

    Angkor Beer – the "Gold of Angkor" – has a new look, one that is more stylish and carries a premium appeal, as well as a fresher taste and smoother flavour, making it the perfect choice for any gathering. Angkor Beer recently launched its new design, one

  • Water supply authority assures public shortages over early ‘24

    The Phnom Penh Water Supply Authority (PPWSA) asked for understanding from Phnom Penh residents in some communes where water pressure is weak. They assured residents that all supply issues will be resolved by early 2024, but have suggested that residents use water sparingly in the meantime.

  • Newest horror film showcases unique Khmer culture, identity

    At first glance, the trailer to new horror sensation The Ritual: Black Nun looks like a western-produced feature film. As the story reveals itself to the viewers, it becomes clearer that this is a Khmer film, with a strong Cambodian identity and close links to

  • Khmer ballet documentary debuts April 1

    A new documentary, The Perfect Motion, or Tep Hattha in Khmer, will premiere to the public on April 1. The documentary film follows two intertwined storylines: the creation of a show called Metamorphosis by the late Princess Norodom Buppha Devi (her very last production) and the