I’m old enough to remember when we left the front door unlocked and nobody thought twice about it. That just doesn’t happen anymore, and nobody really decided it, we all just started locking up one day because the world outside had changed.

It’s the same with the phone in your pocket now. That’s where James Ross took us on RTHK Radio 3 on Tuesday, sitting in for Phil, after he’d seen a Hong Kong police warning that AI is turning up in crime.

His question is the one most of us are asking: is there anything we can actually do, or are we fighting a losing battle?

You can listen to our full chat below.

Key points

– AI hasn’t turned anyone into a criminal. It has made the people already doing this faster, and their messages more personal.
– Australians lost $2.18 billion to scams in 2025, and that’s only what got reported.
– The defence is still the boring stuff: multi-factor authentication, updates, backups, and a word only your family knows.
– Europe’s supermarket freezers were hacked twice in a few weeks, and the systems hit were mostly older ones that weren’t being updated.
– Binance lost $6.3 billion after one engineer took a fake job interview and downloaded the “assignment”.
– If you’re not sure, stop, and go back to the bank or the person yourself.

It’s the people, not the technology

The technology itself is wonderful, and we’ve talked on this show for years about the human problems it can solve. Used by the wrong people it does a lot of damage, and the people are the problem.

Some of these operations are set up as companies and staffed by professionals, in countries where it’s treated as part of the game. Governments have to chase them, and they should, but they won’t catch them all, so it comes back to you and me taking care of ourselves.

What’s changed is how personal it’s become. A scam used to be a generic email with the spelling wrong, and you could pick it a mile off.

Now AI can find a few true things about you in a millisecond and wrap the message around them. It arrives with your name on it, mentions something real, and reads like the person it claims to be from.

Most of us won’t fall for that when we’re sitting quietly with nothing else on. We fall for it in the moment of haste, rushing from one thing to the next before we’ve stopped to think, and that’s where nearly all of the trouble starts.

What the numbers say, and what they don’t

Australia’s cyber agency, the Australian Signals Directorate, took more than 82,000 cybercrime reports in the last financial year, about one every six minutes. Australians lost $2.18 billion to scams in 2025, up from $2.03 billion the year before.

What worries me more than either number is everything that never gets reported. People don’t know where to report it, or they feel embarrassed, almost ashamed, that it happened to them.

My own guess is that for every report made there are five or six that aren’t. So the real figure is a lot higher than $2.18 billion, even if nobody can prove it yet.

Later this month I’m spending about two hours on stage on exactly this, at the Financial Advice Association Australia congress, with people who work in this field every day. One of them calls the basics “the vegetables”, and that’s exactly what they are.

I love my vegetables and I’d eat them all day, but for most people they’re boring, they’re the side dish, and they’re what keeps you healthy.

The vegetables

None of these sings and dances, and I’ve looked hard for one that does. Dead boring doesn’t mean they’re wrong.

Turn on multi-factor authentication

That’s the extra step where the bank asks for your password and then sends you a code, or sends you to an authenticator app, so it needs both before it lets you in. We all grumble about it, and every time we switch it off because we can’t stand the extra step, we’re leaving our foot in the door for somebody else.

James shared a small thing he’d learnt with a banking app the other day: it wouldn’t work until he’d turned automatic date and time back on in his phone. He’d switched it off because he doesn’t love someone else setting his clock.

It turns out the code and the app have to agree on the time, down to the second, because the code only lasts a minute or so, and that short window is half the point of it.

Keep your updates on, and get them from the source

When software you trust says update, update it. I don’t trust the email or the text telling me to, so I open the app itself, or go to the update tab in the software, and if it says there’s one waiting, I do it there.

Back up, and then back up again

Everything I have is backed up at least three times. The PC backs itself up, a server in my home office keeps a second copy, and a third copy goes out of the house into the cloud, far, far away.

Years ago something went wrong, and getting it all back was slow, expensive and cumbersome, but I got everything back.

The photos of our kids and the contacts we’d never remember are only digital now for most of us. Whether it’s iCloud, Google Drive, OneDrive or a hard drive from the local shop, keep a second copy somewhere.

Agree a word with your family

Pick something only you’d say, as silly as pineapple or cucumber. When a text arrives saying “Mum, it’s me, new phone, can you send a few dollars, I’m stuck at the petrol station”, you ask for the word.

I wrote about the word in September, what it’s good for and where it runs out.

The freezers nobody updated

James asked whether all this means we should start disconnecting things, and he had good reason to ask. On 2 November supermarkets in Sweden, Belgium, Luxembourg, Ireland and Estonia found their fridges and freezers had been tampered with overnight.

At one store in Sjöbo, in southern Sweden, staff were emptying freezers that had been pushed up to 50 degrees. Weeks earlier, on 11 October, about 700 stores in France had been hit the same way, the figure James had heard.

I don’t think the answer is to disconnect. Danfoss, which makes many of those controllers, says most of the systems hit were older products that no longer received software or security updates, and the UK’s National Cyber Security Centre said the French ones were sitting on the internet with their default passwords.

Since we spoke, France has said who it believes was behind it. On 9 November the Paris prosecutor pointed to a cyber unit linked to Iran’s Revolutionary Guard, and France summoned Iran’s ambassador. That’s an accusation, not a verdict, and it doesn’t change the lesson.

Ask yourself how often a supermarket updates its freezer and you have the whole story, because it’s the same lesson as the phone in your pocket, just colder. The second wave found fewer stores than the first, and still found enough of them to do real damage.

The job interview that wasn’t

The newest trick is the one I find scariest, and it’s technologically quite clever.

Plenty of first job interviews happen online now. In September a Binance engineer was approached through a job site about a role at a company that didn’t exist, and after several interviews, including one with somebody playing the CEO, he was asked to download an assignment to work on.

The assignment carried malware. Binance, one of the world’s biggest crypto exchanges, says that was the start of a break-in that drained $6.3 billion by late October.

He was excited about a new job and good pay, which is exactly the moment of haste when these things get in.

If you’re not sure, stop

Most of this gets in through people, and that doesn’t make any of us silly. It’s that one moment when we’re hurrying and not quite sure, and we let something in that we shouldn’t have.

So if you’re not sure, stop and take a breath, and don’t answer the message that came to you. Go back to the source yourself: open the bank’s own app or ring the bank on the number you already have, and start again from there.

We learnt to lock the front door without anyone telling us to. The door that matters now is the one on your phone, your laptop and your accounts, so lock it, keep the key somewhere safe, and keep a spare.

Choose forward.

If you’d like a short read every Tuesday on what’s coming and what it means for your work: morrismisel.com/join

If scams and cyber risk are on your team’s mind and you’d like this thinking in the room with them: morrismisel.com/speaking

Morris Misel is a business futurist, keynote speaker, author and founder of Think-Along AI. For more than 30 years he has worked with people and organisations on what’s coming and what it means for them: 2,800+ keynotes across 160 industries and 25 countries. He has been on RTHK Radio 3 with Phil Whelan for many years, and in 2026 Thinkers360 named him one of its Top Voices, globally and for Asia-Pacific.

## Questions people ask
– How is AI changing scams? It makes them faster and more personal. Scammers can find true details about a person in seconds and build a message around them, so it mentions the reader by name and something real, without the spelling mistakes that used to give scams away.
– How much do Australians lose to scams? Australians lost $2.18 billion to scams in 2025, up from $2.03 billion in 2024, according to the National Anti-Scam Centre. The Australian Signals Directorate received more than 82,000 cybercrime reports in 2025 to 2026, about one every six minutes. Morris Misel’s view is that the true figure is much higher because so many scams go unreported.
– What are the most important things I can do to protect myself? Morris Misel’s basics: turn on multi-factor authentication, keep software updated from inside the app itself, keep at least one more copy of everything that matters, agree a family code word, and when unsure, stop and contact the bank or person directly.
– What happened to Europe’s supermarket freezers? In October and on 2 November 2026, attackers raised fridge and freezer temperatures in supermarkets in France, Sweden, Belgium, Luxembourg, Ireland, Estonia and elsewhere, some to 50 degrees. Danfoss said most affected systems were older products no longer receiving updates. On 9 November the Paris prosecutor said it believed a cyber unit linked to Iran’s Revolutionary Guard was behind the French attack on about 700 stores.
– How did a fake job interview lead to the Binance hack? Binance says an engineer was approached about a role at a fake company, interviewed several times, and asked to download an assignment carrying malware, which began a break-in that drained about $6.3 billion in late October 2026.

## Sources
– Morris Misel with James Ross, RTHK Radio 3, The Brew, 10 November 2026 (segment audio above).
– Defence Connect, More than 82k cyber crime reports fielded in 12 months, 30 October 2026.
– Cyber Daily, Scams cost Australians over $2bn in 2025, says ACCC.
– The National, European supermarkets hit by freezer hacks, 2 November 2026.
– Anchorage Daily News, European supermarket fridges got hacked again, 3 November 2026.
– CBS News, Iran behind France grocery store refrigerator and freezer hacks, prosecutor says, 10 November 2026.
– Infosecurity Magazine, Fake interview of software engineer led to Binance mega-heist, November 2026.
– Morris Misel, Reputation Was the Currency. Now It Can Be Forged., 21 September 2026.
– Morris Misel, Security by Antiquity, 26 August 2026.