FSB Webinar: Spotting and Stopping Scams Paul Coady Founder & CEO 28 October 2026
Who are the fraudsters? In February 2026, international journalists toured the O’Smach Scam Compound on the Thai-Cambodia border which included: o
o
o
o
o o
o
197 acres and 157 buildings including offices, call centres, housing, hospitals and entertainment facilities. 10,000 – 20,000 workers from Asia, Africa and beyond trafficked or lured by a global recruitment network. Signs of strict performance targets and monitoring. Detention cells and punishment rooms for workers who missed targets or tried to escape. A bell to be rung when victims sent their money. Industrial scam training centres with documented scripts, playbooks and victim-targeting guides based on various scam tactics and techniques. Fake banks and police stations used to support impersonation scams. 2
Dark Web & Artificial Intelligence (AI) The Dark Web offers: o Data trading using data leaks and/or stolen personal and professional data, valued by its quality and usability e.g., email addresses, passwords, payment details, suckers’ list. o Technology such as: • phishing and smishing kits and templates. • counterfeit websites mimicking legitimate organisations e.g., banks. • malware such as ransomware-as-a-service (RaaS), fraud-as-a-service (FaaS). o Fraudulent documentation including virtual and physical IDs such as passports, driving licences, tax documentation, company identification. o Money laundering services allowing fraudsters to clean the proceeds of their crimes e.g., fake online stores, offshore accounts, crypto-mixers. AI is further industrialising fraud and cyber-attack operations by reducing the costs, people, skills and time required in the business of fraud. AI can be used for: o Identifying targets across social media, company websites, data leaks and dark web activity. o Industrialising phishing, vishing and smishing with tailored attacks generated in seconds. o Developing malware and ransomware that is faster and adaptive to the defences it encounters. o Building fake and synthetic IDs for client on-boarding, social engineering and insider credentials. o Deepfakes/voice cloning to impersonate clients, colleagues, and third-party providers. o AI-powered impersonation with real-time AI avatar conversations adaptive to targets. o Credential attacks for automated password guessing and account takeover attempts. 3
Everyday Threats
SMISHING AND PHISHING
VISHING
QUISHING
Unsolicited message with an issue requiring urgent action to pay money, provide personal information or click on a link.
Phone call pretending to be someone else e.g., utility company, your bank’s fraud department.
It may pretend to be police, tax authorities, bailiffs or a family member in trouble.
They look for your account details or may claim the need for a ”safe account”.
“Fraudulent QR codes, including codes placed over legitimate ones or sent in messages, lead to deceptive websites.”
Smishing Red Flags
Vishing Red Flags
The destination is not readable from the QR code itself.
Any unsolicited message or email seeking money, information or to click on a link.
They put you under pressure to act now and won’t let you hang up to call back e.g., “…you will be kept on hold”, “…it will be too late”.
Physical QR code e.g., parking meter, is a sticker.
General salutations e.g., “Dear Customer…”, poorly written messages, no personal details. Unreasonable pressure and timeframe. Smishing Actions Never click on links or call the number.
Contact the real organisation on known channels. Have a code word for family emergencies.
They put the responsibility on you.
They point to the number they are calling from as proof of who they are. Vishing Actions Hang up. Contact your bank immediately through its official app or a trusted number, not a number supplied by the caller.
Quishing Red Flags
QR codes being shared by unrelated groups.
Quishing Actions: Go to the website instead of using the QR code.
AUTHORISED PUSH PAYMENT (APP) FRAUD
Fraudsters trick people into sending them money e.g., romance fraud, investment fraud. Believing the payment is genuine, victims may approve it despite warnings and checks APP Red Flags Unsolicited contact e.g., social media and efforts to move to WhatsApp. Unrealistic relationships or return on investments.
Limited explanations or details and efforts to control who you talk to. APP Actions: Perform due diligence using OSINT. 4
What can we do?
Data Visibility How many personal email accounts do you have? It is necessary to consider what information, if any, may be available to a fraudster. The following service can help but is also often provided by email providers, devices or antivirus services. Results show known breaches containing the address; they do not establish whether the email account itself has been accessed. No result does not guarantee that your data is safe.
www.haveibeenpwned.com Actions Required: o Immediately check every personal, professional and business email address and schedule further regular checks. o If it finds Data Breaches, check which service was breached and what types of data was exposed. o If the lost details could be used on any other systems, change them immediately. 6
Passwords What action was taken when the National Lottery was being won too frequently? Password Combinations o 8 characters with just letters – around 209 billion possible combinations. o Adding the uppercase - around 53.5 trillion combinations. o Adding numbers – around 218 trillion combinations. o Adding symbols on your keyboard – around 430 trillion combinations.
AI can be used to source and analyse significant volumes of data to predict potential passwords and automate account takeover attacks. It is essential to have strong passwords e.g.,: o at least 8 characters, upper/ lower case, numbers, special characters. o change passwords immediately if you know or suspect they have been compromised. o avoid using names, date of births etc. and using consecutive passwords. o never share passwords or write them down. Actions Required: o Make passwords more complicated e.g., D@ni3lOD0nnell, Ilik3t03@tburg3rs. o Check if your devices are using password managers which require additional security. o Keep passwords for important and less important systems entirely separate. 7
Email How many personal email accounts do you have? Email addresses also act as the username for many systems, websites, apps etc. The more an email address is shared and used, the more visible it may be to fraudsters who could use it in their attacks e.g., phishing. Email addresses require the strongest protection as if compromised they often offer a gateway to everything else for the fraudster. This should include a strong and truly unique password and the use of multi-factor authentication. When using email: o never open links or attachments in unsolicited or suspicious emails. o never trust the contact details within a suspicious email. o never unsubscribe from annoying emails not originally requested. o use further passwords for more sensitive and secure attachments e.g., client data. Actions Required: o Create multiple email addresses to reduce email concentration risk e.g., one only for banking, one only for subscriptions and mailing lists, or one only for app registrations. 8
Websites What’s the difference between https://www.apple.com and https://www.appIe.com? Criminals can easily replicate legitimate websites and use altered domain names as part of their deception. Never click on a link to a website contained in an email or text message even if it looks legitimate. Always go independently to website address.
Some individuals mistakenly believe that “https:” confirms that a website is trustworthy. Whilst it should be looked for to ensure the security of payments, it could be a fraudster at the other end. Actions Required: o Everyone concerned about a company, website, a vendor or anyone contacting them should check their website at https://check.getsafeonline.org. This provides a free risk assessment of the website. Note: A favourable result does not guarantee that the website, business or person contacting you is genuine. o Checking the domain used in an email address e.g., joe.bloggs@abclimited.com may reveal warning signs but does not verify the sender.
9
Wi-Fi & Apps How many apps do you have on your phone? Installing an app can give it access to information and device functions, depending on its permissions. Many app providers will be based in jurisdictions where, even if they are legitimate, they may not respect or protect your personal data. Actions Required: o o
Limit the apps and only use only reputable app stores to download them, where possible. Never reuse passwords from important personal or work accounts for other apps.
Why is Wi-Fi a fraud risk? o The public use of Wi-Fi presents a significant risk of fraud as personal and confidential information may be viewable by fraudsters sharing the same signal or when they create the source.
Actions Required: o Use mobile data and a personal hotspot when on the move. o For any use of public Wi-Fi (not recommended): • Always check the correct Wi-Fi address with the provider. • Never enter log-in credentials using public Wi-Fi or share work/personal information. • Use a Virtual Private Network (VPN).
10
Due Diligence Whether personal or business, perform some form of due diligence on new people, suppliers, clients when you receive unsolicited contact or are using online marketplaces and channels. Important Note: A genuine company or professional registration does not prove that the person contacting you represents them. Independently verify their contact details.
11
Further Resources
Further Resources Report Fraud is the place to tell the police about cyber crime and fraud. They also provide the Report Fraud Victim Service which offers dedicated and specialist help to victims of cyber crime and fraud. Their Report Fraud Analysis Services team are responsible for the assessment of reports made and to ensure that your fraud reports reach the right place. The City of London Police is the national policing lead for economic crime and works in partnership with policing and other law enforcement agencies. Resources include: o Making a report o A-Z of cyber crime and fraud o Victim resources
National Cyber Security Centre (NCSC) safeguards the UK’s critical systems and online services, delivering guidance, tools and frameworks for business and citizens alike. They provide incident-response guidance and support the response to significant cyber incidents to minimise harm, restore operations, and help organisations get back on their feet.
Resources include: o
Check your Cyber-Security
o
Advice & Guidance
o
Incident Response
o
Education
Cifas is a not-for-profit membership organisation that brings different sectors together to eliminate fraud and financial crime. They provide a secure, legal and effective framework for the real time sharing of high-grade fraud risk data and intelligence. Hundreds of organisations work with Cifas e.g., high street banks, telcos, insurers and public sector and government bodies, to benefit from each other’s data, intelligence, and learning. Resources include: o Check a Website o Protective Registration o National Fraud Database
In Scotland, report of Police Scotland on 101. 13
Further Resources (cont’d) Get Safe Online is the UK’s leading internet safety website providing unbiased, factual and easy-to-understand information on online safety. Its website is a unique resource providing practical advice on how to protect yourself, your computers and mobile devices, and your business against fraud, identity theft, viruses and many other problems encountered online. It contains guidance on many other related subjects too – including performing backups and how to avoid theft or loss of your computer, smartphone or tablet. They cover every conceivable topic including safe online shopping, gaming, and dating.
WebWise is the Irish Internet Safety Awareness Centre, providing information, advice and resources for schools, families and young people on online safety and digital citizenship.
14
Questions?
www.compliancelnd.com www.linkedin.com/company/compliancelnd/