Stop, check, don’t click.
Simple videos, practical guides and scam-awareness training for children, adults and seniors.
Scammers create panic — a deadline, a threat, a prize that expires. Real banks, police and family members give you time. If a message makes you feel rushed, that feeling is your cue to stop.
Don’t reply, call back or tap the link in the message. Use a number or website you already know is real — the one on your card, your bank’s app, or a family member’s saved number.
Check a channel you already trust
Never share passwords or one-time codes (OTPs — the short codes sent by text to approve a login or payment). Agree a family codeword. If money has already moved, call your bank straight away and report it.
Three short, printable guides in plain English — including help with deepfake video calls (AI-generated fake videos of real people) and cloned-voice calls. No tech knowledge needed.
✓ Thanks — your guides are ready below.
Short videos from KaiGuardian Academy on YouTube that break down real scams in plain English — what they look like, and what to do.
Phishing means fake messages — emails, texts or calls — that pretend to come from someone you trust, to trick you into clicking a link, paying, or sharing details. It is one of the most common ways scams start, and AI now makes these messages more convincing. Five messages below. You decide: real or trap?
What to look for
AI has made attacks more convincing than ever. These rules hold regardless of how polished the attack looks.
AI can clone any voice
If someone calls claiming to be a family member in trouble, hang up and call them back on their real number. In 2026, AI clones voices from 3 seconds of audio found online. The voice proves nothing.
Gift cards are always a scam
No bank, government office, tech support line, or family member will ever ask you to pay with gift cards. Anyone who does is a scammer. Every time. No exceptions.
Read the full sender address
Scammers use "apple-support-id.com" — not "apple.com". Check the full domain after the @. The display name ("Apple Support") can say anything — the address is what counts.
Urgency is a weapon
Countdown timers, "24-hour deadlines", "act now or lose your account" — these are pressure tactics. Real organisations give you time. If you feel rushed, that's the attack working on you. Stop and breathe.
"Don't tell anyone" is a red flag
Scammers isolate victims so no one can stop them. If anyone — by call, text, or email — tells you to keep it secret, that is a warning sign, not a reason to comply. Tell a trusted person immediately.
Agree a family codeword
Agree on a secret word with the people you love. If someone claims to be them in an emergency, ask for the codeword. A real family member will know it. An AI voice clone won't.
Go direct — don't click links
Instead of clicking a link in a text or email, open your browser and type the address yourself — usps.com, chase.com, apple.com. If there's a real problem, you'll see it when you sign in directly.
Video calls can be faked too
In 2026, real-time deepfake video exists. If a video call seems "off" — odd lighting, no blinking, strange background — end the call and phone back on a number you know. Do not act on what you see alone.
Knowledge is the best defence. These resources from KaiGuardian are free, practical, and built for everyone — whether you're 15 or 75.
KaiGuardian Academy — YouTube
For everyone. Free video breakdowns of real scams and AI threats, with step-by-step advice for keeping yourself and your family safe online.
KaiGuardian Academy on YouTube →KaiGuardian Check — Scam Training
For teens, adults and seniors. Interactive scam-awareness drills: practise spotting fake messages and calls in a safe, guided setting before you meet them for real.
kai-check.higgsfield.app →CyberKid: Shadow Broker Showdown — Free Safety Game
For children aged 8–14 (and curious adults). A free game: join KAI & ARIA across five cyber worlds, beat the hackers and learn real online-safety habits through play.
cyberkid.higgsfield.app →Southeast Asia, East Asia, and the Pacific are ground zero for some of the world's most sophisticated scams. These are the ones causing the most harm right now — know them, share them.
Pig Butchering (Sha Zhu Pan)
Originated in Southeast Asia — now global. A stranger builds trust over weeks through chat, then introduces a "once-in-a-lifetime" crypto investment. The platform is fake, and withdrawals are blocked once you have paid in. Never invest on a platform introduced by someone you met online.
Fake Job Offers → Trafficking
Ads on LinkedIn, Telegram, and WhatsApp promise high-paying remote jobs in Thailand, Myanmar, or Cambodia. Victims travel and are forced to run scam operations on others. Verify the employer independently: find the company’s official website and phone number yourself (not from the recruiter), confirm the job exists, and be very wary of any offer that needs you to travel overseas or pay an upfront fee.
Boss/CEO WhatsApp Scam
A message on WhatsApp from "your boss" on an unfamiliar number asks for an urgent wire transfer or gift cards. Very common in Singapore, Malaysia, Hong Kong, and Australia. Always confirm via a known phone number or in person before moving any money.
QR Code Phishing (Quishing)
Scammers place fake QR code stickers over real ones at parking meters, menus, and public kiosks. Scanning takes you to a phishing page designed to steal your login or card details. Inspect QR codes for a sticker placed on top and prefer typing addresses manually.
Love Scam → Crypto Drain
A charming stranger on Facebook, Tinder, WeChat, or LINE builds a real-feeling relationship — sometimes for months — then introduces crypto trading on a fake platform. Profits appear, then disappear when you try to withdraw. Never mix romance with investment.
Fake Police / Government Calls
A caller claims to be police, immigration, or tax authority. Your account is "linked to a crime" — but you can clear your name by moving funds to a "safe account." No real government agency will ever ask you to transfer money on a phone call. Hang up and call the official number.
OTP Theft — "Bank Staff" Scam
A caller poses as your bank's fraud team. There's "suspicious activity" — but they need the OTP sent to your phone to "stop it." Your bank will never ask for your OTP. An OTP is a one-time key only you should use. Anyone asking for it is stealing your account.
Marketplace & Online Shopping Scams
Fake sellers on Carousell, Shopee, Lazada, and Facebook Marketplace take deposits and disappear — or fake buyers send fraudulent payment screenshots. Use in-platform payment only, never bank transfer to a stranger. For high-value items, meet at a police post or public place.
Current threats reported across the Asia-Pacific region, based on published advisories from national cybercrime agencies. Refreshed for August 2026 — newest campaigns first.
Deepfake celebrity & bank-CEO “investment” ads
AI-generated video ads showing trusted public figures and real bank CEOs endorsing crypto and “AI trading” platforms are flooding Facebook, YouTube and TikTok this month. Apparent endorsements can be fabricated with AI. Before acting, check the person’s or bank’s official website or verified accounts yourself — never through the ad’s own links.
Spoofed bank hotline + AI “fraud team” call
Your phone shows your bank’s real number, and an AI voice claiming to be the fraud team says your account is compromised — then guides you to move money to a “safe account.” Hang up and call the number printed on the back of your card.
AI voice-clone “family emergency” calls
Scammers clone a child’s or grandchild’s voice from a few seconds of social-media audio and call claiming to be stranded, arrested or in hospital. Agree on a family codeword now.
“Digital arrest” — fake police / CBI video calls
Callers posing as police, CBI or customs claim a parcel or bank account is tied to a crime, then hold victims on a video call under “digital arrest” for hours while extorting transfers. ₹1,935 Cr lost in 2024. No real agency arrests anyone over a video call — hang up and dial 1930.
Deepfake video CFO fraud
Finance staff receive what looks like a live video call from their CFO authorising urgent wire transfers — real-time deepfake throughout. Verify large transfers through a separate, known channel — always.
Pig-butchering apps impersonating CommBank & NAB
Fake investment apps carrying major Australian bank branding are spreading via WhatsApp and Telegram. Never invest through a platform someone else introduced you to.
Fake parcel “customs duty” + OTP capture
SMS and LINE messages claim a held parcel needs a small customs fee; the payment page harvests your card number and the OTP. Couriers and customs never collect fees by text link — track parcels only on the official site.
Facebook romance-to-crypto pipeline
Scammers build 4–8 week relationships before introducing a crypto “trading opportunity.” Be very suspicious of anyone who mixes romance with an investment opportunity.
Fake Bank Negara enforcement calls
Callers impersonate Central Bank officers, accuse victims of money-laundering, then demand transfers to a “safe account” to avoid arrest. Bank Negara Malaysia will never ask individuals to transfer money for safekeeping.
LINE fake customer-service OTP theft
Scammers impersonate LINE support inside LINE itself, claim the account is at risk, and request OTP codes to “verify identity.” LINE support will never ask for your OTP.
“Wrong number” WhatsApp investment scam
A friendly “wrong number” message leads to weeks of warm conversation, then an introduction to a crypto platform. The platform is fake — funds vanish at withdrawal. A stranger who becomes a friend who mentions investment is a scammer.
LinkedIn fake overseas job posting — trafficking risk
Ads for high-paying remote roles in Cambodia and Thailand. Applicants who travel are forced to operate scam centres. Verify every overseas offer independently — find the employer’s official contact details yourself, not from the recruiter — before travelling.
NZTA road-toll smishing campaign
Texts claiming an unpaid toll link to credential-harvesting pages. Real Waka Kotahi / NZTA never sends unsolicited SMS payment links — go directly to nzta.govt.nz.
Sources: ScamShield (SG) · I4C India (1930) · ACCC Scamwatch · PDRM CCID · HK Scameter · NCSC NZ · Published threat advisories. Alerts based on confirmed campaigns; updated as new reports are issued.
Every figure below comes from a government-published source — police forces, national CERTs and anti-scam centres across Asia-Pacific. Scam Atlas monitors these official portals and turns their scattered reports into one living map. Figures come from the latest full-year official releases (mostly 2025); each card shows its reporting period and links to its source.
First annual decline on record — yet scams remain the most prevalent crime type. Self-effected transfers made up 81.8% of cases.
Source: Singapore Police Force — Annual Scam & Cybercrime Brief 2025 (calendar 2025, SGD)
ScamShield · police.gov.sg →I4C runs the National Cyber Crime Reporting Portal and the Citizen Financial Cyber Fraud system — one of the largest public scam-reporting infrastructures on earth.
Source: Ministry of Home Affairs / I4C — Lok Sabha reply, Jul 2026 (2021–2025; funds saved to 30 Jun 2026, INR)
cybercrime.gov.in · Chakshu →Fake-police calls drove the surge — ¥100.5B lost in 2025, about 70% of “special fraud” losses, which nearly doubled in a single year, per NPA statistics.
Source: National Police Agency — 2025 fraud statistics (final) (calendar 2025, JPY)
npa.go.jp →The National Anti-Scam Centre combines Scamwatch, ReportCyber, AFCX, IDCARE and ASIC data into one public picture — the model Scam Atlas extends.
Source: ACCC / National Anti-Scam Centre — Targeting Scams 2025 (calendar 2025, AUD)
scamwatch.gov.au · cyber.gov.au →A pan-government task force now runs a 24/7 telecom & financial fraud response centre — voice phishing is treated as a national emergency.
Source: Financial Services Commission (Jan–Jun 2025 losses, KRW) and Korean National Police Agency
police.go.kr · 112 →PDRM’s Commercial Crime Investigation Department publishes running totals; fake investment schemes are the single biggest loss driver.
Source: Royal Malaysia Police figures, via RTM / Bernama (calendar 2025, MYR)
rmp.gov.my · NSRC 997 →Thai Police Online and the AOC 1441 centre freeze scam-linked mule accounts within the hour — Thailand is now the most scammed market in Asia by contact volume.
Source: Royal Thai Police 2025 figures, via MGR Online (calendar 2025, THB)
AOC 1441 · thaipoliceonline.go.th →The NCSC publishes quarterly insights and runs a Phishing Disruption Service — a verified indicator feed organisations can act on directly.
Source: NCSC — Quarterly Cyber Security Insights (2024 = sum of four quarterly reports, NZD)
ncsc.govt.nz →Explore the interactive scam radar (a demonstration running on a simulated feed), the 8-second journey inside a scam, and the country data above.
Open the scam radar demo →Built and hosted by KaiGuardian. Figures indexed from official government portals as each release drops.
KaiGuardian
KaiGuardian Academy · YouTube
KaiGuardian breaks down scams, cyber threats and everyday digital-safety habits for people who do not live and breathe cybersecurity. From children to grandparents, the goal is simple: help families recognise manipulation, verify suspicious requests and make safer decisions online.
Based in APAC and built for a global audience, KaiGuardian covers real-world scam patterns, AI-enabled fraud, family safety, phishing awareness, small-business basics and practical ways to respond when something feels wrong.
Brands, schools, companies, media and fellow creators — if you want to help families stay safe from scams, get in touch.
✓ Thanks — your message has been sent.
You’ll hear back at the email address you gave.
Prefer email? kaichencyber@gmail.com
For readers who want the bigger picture: the six security problems behind almost every breach, an interactive demonstration, and famous real-world case files.
Every system is a chain of decisions to believe someone. The processor believes the firmware. The login believes the password. You believe the screen. Verification has to stop somewhere — and wherever it stops is where the attack begins. Case file 01 →
A network has never met you. It has met your credentials, and whoever presents them is — as far as any machine can tell — you. Most intrusions are not break-ins. They are logins. Case file 02 →
People are called the weakest link by systems that were designed without them. A person who clicks the wrong thing at the wrong hour is not failing the system. The system planned for a user who doesn’t exist. Case file 03 →
The defender must be right everywhere, forever. The attacker must be right once, anywhere, eventually. This is not pessimism. It is arithmetic — and it does not improve with budget. Case file 04 →
Security fails on purpose more often than by accident. Wherever breaking a system costs less than what it protects, someone will pay that cost — attackers run on margins, like every business. Raise their price or lower your value. Nothing else moves the line. Case file 05 →
Every feature is surface. Every connection is a path. Every convenience is a promise someone must keep forever. The most secure component is the one you removed — and it is the only one that stays secure. Case file 06 →
Twenty-four systems, each trusting the next. One administrator reused a password. Watch what that costs — then run the same attack against a network that was built expecting it.
None of this is theoretical. One exhibit per problem — each breach famous, each avoidable, each caused by a problem older than the company it ruined.
A build server signed the attacker’s code, and the signature did what signatures do — it ended the questioning. Eighteen thousand organizations installed the backdoor themselves, on schedule, as routine maintenance.
You did not install software. You extended trust to everyone who built it. Problem 01 ↑
One remote-access password, leaked and never revoked, shut down the largest fuel pipeline in the country. To the network, the attacker was an employee having a normal morning. The lines at the gas stations came later.
A credential is not a person. Treat every login as a claim, not a fact. Problem 02 ↑
A teenager phoned the help desk and asked, politely, for access. The internal tools trusted the staff; the staff trusted the caller. Within hours, the most famous accounts in the world were asking strangers for money.
The help desk was working as designed. That is the problem with the design. Problem 03 ↑
A weapon aimed at one country’s accounting software crossed the world in hours, stopping ports, factories, and hospitals that were never targets. Built once. Felt everywhere. Paid for, almost entirely, by bystanders.
You don’t have to be the target to be the casualty. Distance is not a control. Problem 04 ↑
The fix had existed for two months. Applying it was one team’s cost; not applying it became 147 million people’s problem. They were not the customers. They were the inventory.
The fix was free. Skipping it cost three executives their jobs and 147 million people their privacy. Problem 05 ↑
The high-roller database left the building through the internet-connected thermometer in the lobby aquarium. No one had decided the fish tank was part of the security perimeter. No one had decided anything about it at all.
Your network is everything that can reach it — including the aquarium. Problem 06 ↑
Recent publicly disclosed breaches.
You cannot buy your way out of the six problems. You can only decide how you stand in relation to them. Assume the credential leaks. Assume the person is tired. Assume the attacker has read your documentation — they have.
What survives contact is not the tool but the discipline: trust deliberately, verify cheaply, and keep the system small enough that one person can hold it in their head. Complexity you do not understand is someone else’s asset.
The threats of the next decade have not been invented yet. The problems they will use have been here all along.
