PODCAST
THEOS Cybernova: The Cybersecurity Podcast for APAC Leaders
THEOS Cybernova delivers expert cybersecurity insights for business and security leaders in APAC. Hosted by THEOS Cyber CEO Paul Jackson, each episode dives into real incidents, strategic responses, and the evolving role of cyber leadership.


Episode Summary
Why are cyber scams rapidly increasing across Asia while law enforcement, education, and industry still struggle to keep pace?
In this episode of THEOS Cybernova, Paul Jackson reconnects with Nigel Phair of Monash University to discuss the scam crisis in APAC. They explore why victims are blamed instead of supported, how underreporting skews the true scale of fraud, and what must change in policing. The conversation also delves into the future of cyber talent, the impact of AI on junior roles, and the need for more effective collaboration across government, academia, and industry.
Listen in to uncover why scams are more than just financial crime and how the fight against them must evolve.
About the Guest

Nigel Phair is a Professor within the Faculty of Information Technology at Monash University. He is an influential analyst on the intersection of technology, crime and society. Nigel has published five acclaimed books on the international impact of cybercrime, is a regular media commentator and provides executive and board advice on strategy, risk & governance of technology. In a 21 year career with the Australian Federal Police he achieved the rank of Detective Superintendent and was a Team Leader of investigations at the Australian High Tech Crime Centre for over four years. He is a non-executive director on several Australian boards.
Nigel Phair
Professor, Department of Software Systems & Cybersecurity, Monash University

Nigel Phair
Professor, Department of Software Systems & Cybersecurity, Monash University
Nigel Phair is a Professor within the Faculty of Information Technology at Monash University. He is an influential analyst on the intersection of technology, crime and society. Nigel has published five acclaimed books on the international impact of cybercrime, is a regular media commentator and provides executive and board advice on strategy, risk & governance of technology. In a 21 year career with the Australian Federal Police he achieved the rank of Detective Superintendent and was a Team Leader of investigations at the Australian High Tech Crime Centre for over four years. He is a non-executive director on several Australian boards.
Related Resources
- Connect with Nigel Phair: https://www.linkedin.com/in/nigelphair/
- Connect with Paul Jackson: https://www.linkedin.com/in/jacksonhk/
- Connect with THEOS Cyber: https://www.linkedin.com/company/theos-cyber/
- Connect with THEOS Cybernova: https://www.linkedin.com/showcase/theos-cybernova/
Episode Transcript
Paul Jackson: Welcome to season two of THEOS Cybernova. And in this episode, we’re revisiting conversations with Nigel Phair. So, Nigel, how are you doing these days?
Nigel Phair: I’m great. Thanks, Paul. How are you?
Paul Jackson: Yeah. Doing all right. Thanks. Doing all right. And, great to be chatting again. I really enjoyed the podcast we had in the first season and, yeah, you’re one of the few guests who isn’t tied down with compliance in big companies. So you could shoot from the hip. You can say it as it is, right?
Nigel Phair: Well, it’s certainly my preference. So, hence why I work in big corporate or vendor land.
Paul Jackson: Well, it’s great to have you on the show again. And I’m going to start with a bit of a zinger because we’re going to talk today about cyber scams, cyber fraud, which I know is close to your heart, in your research and the work that you do with your partners, etc. But the numbers are pretty shocking. And I’ll talk about the numbers in a moment. But why is law enforcement still behind the curve in fighting cyber scams? They’ve been around for a long time, but they’re just increasing constantly. Why is it they’re just not handling this, tackling it?
Nigel Phair: I think there’s a really simple answer to that, Paul. And that’s from everyone. From the police commissioner down doesn’t understand the impact on society of the dollar losses. They don’t understand what needs to be undertaken to do these investigations. Sometimes they’re complex and sometimes they’re not. And I think we’re just still set in this terrestrial, crime world where if they can see it, they can police it.
Paul Jackson: Well, yeah. Okay. That’s pretty tough words. So I mean, I just for the audience who don’t know us, we’re both ex cops. So, we do come from a law enforcement background, and it’s a tough one because I sense that modern policing is metrics-driven. Right? And a lot of these cyber scams, of course, they’re not.
Because cyber is the internet. Right? So of course, it’s not your local scammer, it’s your scammer overseas. And therefore arrests are unlikely in your local neighbourhood. So your policing metrics of successful arrests aren’t going to look good if you just focus on cyber scams. Right?
Nigel Phair: Well, I think there’s that. I think there’s a range of different things. So when you look at technology risk, it’s both, what I call horizontal and vertical. So it’s own crime type and all mature policing agencies have all got cyber crime investigative units now, varying degrees and abilities. But, there’s still the people that are over there and they’re still not fully resourced and is still not fully brought in.
But when you think back to our policing days, what we used to call computer forensics, now you’ve probably called DFIR and broader, that’s the horizontal where every crime type has a digital component to it. Every crooks got a mobile devices or using social media or doing using crypto to receive money or a range of other things.
So I also don’t fully see technology used in the investigation of all crimes to the level it has to. But I still go back to my point, and if you can see it, I think police ministers, police commissioners down, they look at what’s on the front page. I still look at newspapers, even though sort of subsequent generations don’t. And they are focused on things like outlaw motorcycle gangs and drugs, and super important crime types. And they say to their police, get another car out and solve this problem. So they do.
Paul Jackson: Yeah. Interesting comments there. And you write about resources because it’s a challenge in our company and in any other company getting the right resources. There’s always this talk about a shortage of cyber talent. The reality is I think it’s a shortage of the right cyber talent because the cyber talent and there’s cyber talent, there’s ones who have experience and know what they’re doing and also have the mindset to be able to unravel complex, in policing context anyway, complex scenarios, right?
Nigel Phair: Well, with that one, we need to go off in our first tangent.
Paul Jackson: Actually, we already, yeah.
Nigel Phair: I have a couple of minutes in. The skills debate is an important one to have and a shocking debate going on at the moment, yeah. In Australia the numbers are bandied about between 30,000. However, many tens of thousands more people are up there. And you’re 100% right that to run those vacancies, it’s just not true. And I think what we’re telling, particularly our young, the undergraduates at university, the wrong story because they’re going off and doing a Bachelor of Cybersecurity or a Bachelor of I.T or a Bachelor of Software Engineering or something, thinking that rivers of gold are going to come from it.
And those jobs just aren’t there. If you’ve got genuine experience and a long-standing experience and you can command a reasonable salary, I think salaries will start dropping. That’s one thing. But also, I think we need to better codiy what we want in a graduate coming out of university or out of the polytechnic sector or anything.
And this is where we need to have a bit of skills discussion and a bit of skills debate about saying, you run a business and you need certain people to do certain things. But universities really aren’t. I don’t believe in explaining to the job market what you are buying when you have this, this person just on a three-year bachelor of etc..
Paul Jackson: Right.
Nigel Phair: And then I think, coupled with that. Yeah, cyber, I’ve been probably doing cyber for, some of the longest in and around and it’s still really nice. , if I’d done an accounting degree I’d go and get a job, whether it’s with the big four or some local accounting firm, you go, you’ve done your bachelor, you don’t really know much beyond your three-year professional year.
We’re going to teach you all these things and everything’s going to be great. Same with engineering, same with law, etc., etc.. Cyber, I don’t believe is good at getting that young person. And when I say young, I mean young in their career it doesn’t matter their age. And actually bringing them along.
Paul Jackson: Yeah. This is yeah, this is fascinating stuff. And it’s, you’re right. We’ve gone down a rabbit hole. But let’s stay in this rabbit hole because it’s an interesting, interesting segue. Right? And and you’ve we also got to bring AI into this equation as well. But but before I discuss AI in this context, you’re right about a career path, if you like, for cyber, juniors, let’s call them, they may be young or old, right? Or junior to the field. And, the challenge we’ve got, though, I think, is the accounting and law, the examples you mentioned engineering, they’re pretty rigid. They’re pretty well-defined. They don’t change that much. Right?
Cyber is just constantly evolving and changing. So how do you set a standard approach to developing new talent? And getting them to that experience level where they actually become really productive and useful.
Nigel Phair: Yeah. And that is the hard part. So we have frameworks, you have the nice framework, for example, and you have the other ones going down the back of my head, it’ll come to me, you’ve got some job ready frameworks that can be used. But explaining to people the breadth of a career in cyber, I think it’s the first thing, because it’s this technical, heavily deep dive technical careers at one end and at the other end.
You’ve got, let’s call it GRC and other things where there isn’t. It’s more project management, for example, and everything in the middle and a lot of people say to me, do I need to learn code to put up like a career in cyber because I don’t know how to code and I don’t want to know how to code. And my response normally to that is you don’t necessarily need to know how to code, but you need to understand what code does.
Paul Jackson: Yes.
Nigel Phair: And I think that’s where people we need to bring people along this journey of mentorship throughout their career is just explaining some of these principles. And through Monash University of supervised students doing their integrated workplace learning for a semester. And often they’ll start off wanting to do something and they’ll finish their semester-long placement full-time, thinking their careers, going in a completely different area that is nine times out of ten. And I think it’s great because I’ve had a taste of actually what it is.
Paul Jackson: Right.
Nigel Phair: So there’s lots of graduates being put through. Universities are great. I think as I said, I think we’ve we’ve got to as a sector better explain what industries bind. But I’m a big fan of the polytechnic side of the house of being hands on. And there’s nothing like getting your hands dirty and, whether it includes coding, whether it includes provisioning accounts to people, all those sorts of things. I think you learn that sort of stuff along the way. And then there’s all sorts of other other careers along the way, which I think we need to promote.
Paul Jackson: I think you’re right. And look, you’re in a rare position, working in the university where you’ve actually done the hard yards, you’ve been in the trenches, etc. but a lot of the academia, don’t understand the real world, if I’m not being too insulting to them, I hope not.
Nigel Phair: No you’re not, totally not, Paul. It’s the reality, and that would be a good thing if we could get our career academics into industry.
Paul Jackson: Yeah, but the problem is salaries and stuff like that. , it’s very hard for somebody who’s earning a big salary out in the corporate world to give that up, to become a mentor, to coach, to aspiring newcomers.
Nigel Phair: Yeah. I see pockets of Europe that do it better, particularly if I just put the Australia hat on about getting sort of your serious industry people with adjunct positions and getting them in the tent, in universities. And unfortunately, when I see it in Australia, the motivation is more to can we get some money and have you do a research grant.
Paul Jackson: Yeah.
Nigel Phair: Rather than we want to integrate you into this and get your learnings. It’s moving past that. Come and do a guest lecture scenario. Yeah, that’s a dime a dozen.
Paul Jackson: I get you. So hey, I gotta get back on the scams. Right. But, before I do..
Nigel Phair: let’s actually give a go on the scams to be fair.
Paul Jackson: To be fair, we didn’t really, did we? We just talked about why police weren’t really handling it well. But it does lead into this important topic because you need capacity if we’re going to defeat scammers right. We need the capabilities and we need collaboration and we need capacity. So, it is important to just cover this. And AI is the big elephant in the room, right?
So why? I mean, well, let’s start first of all, by saying that we had an interesting discussion here in the office at THEOS Cyber about AI taking over junior roles in our line of business. So where most people and I’m talking about cyber rather than investigations, where most people in cyber get experience or start their experiences in the SOC, right?
And SOC analyst but we are heading headlong into a world where our SOC analysts are going to be machines. They’re basically going to be AI. And with a few experienced one. Yeah, with a few more experienced ones to QA and etc., but those experienced ones will want to move up into the world B or C.
So like, so then who fills that gap? Because then you haven’t got the people coming through in the pipeline. And I see worrying times a little bit ahead, and I see the same in another, I’m just highlighting the SOC because it’s easier to kind of explain. But there’s many other areas of cyber investigations, technology investigations and response and security where AI is going to be taking over those junior level jobs and not feeding the experience and talent that we need to run at the high level. You agree?
Nigel Phair: I semi-agree, I live by the expression of I don’t think AI will take over all the roles. I think someone using AI will take over all the roles. So there will definitely be a reduction in headcount. That’s a no-brainer. But you’re still going to need someone to manage the AI. And I still prefer using the term machine learning, by the way, rather than AI.
Paul Jackson: Fair enough. Let’s not go down that rabbit hole.
Nigel Phair: But, that’s season three, isn’t it?
Paul Jackson: That season three? Yeah. So, no, but what I’m saying is that, yes, I agree, you got to have that person using AI, but they can’t just be good AI. They’ve also got to have experience because they’ve got to understand whether AI is making mistakes or whether they execute. And that, therefore, is how do you get those people with the experience of AI is taking over their very junior roles? It might. Well, that’s that’s all I’m saying.
Nigel Phair: Yeah. No, I think there’s a number of issues around that. I think higher education is still resistant about the use of AI because it’s always saying that someone’s going to cheat on their exam, they’re going to get a chatGPT and it’s like, write me 3000 words on endpoint detection or whatever the assignment is. And so there’s a bit of a fright.
I think corporates, and I was reading an article are starting to, some of them are starting to block some of the mainstream LLMs, which means, we’ve been talking about shadow I.T for a very, very, very long time. We just going to end up with shadow AI in the workplace. So that’s not going to serve us any good with people learning things.
Because they’re going to be playing with this. And , I quite enjoy talking to company directors and more importantly, to risk and audit committees. And one of the questions I asked these people in the committees when they sort of say, oh, what? Yeah, everyone wants to do something AI because it’s cool. And I sort of say to them, are you individually playing with these LLMs, or you’re just putting in basic things like I’m going away for the weekend, what should I do in country, city X and most aren’t even just fiddling, just to work out whether it is managing their calendar or doing all these other sorts of things or better scripting email responses.
And, we’re at the very we’re at the very edge of this sort of stuff. And I felt like I feel like saying to them, how do you propose to be the custodians of your organizations from a non-executive perspective, if you’re not even having a go yourself and you’re making management, making arbitrary decisions about people in the workplace using some of these tools. And so I fear things that things aren’t looking good.
Paul Jackson: Yeah. You know, bringing the whole vibe down here, Nigel, but, yeah, you’re upset.
Nigel Phair: We haven’t gone to the scams yet?
Paul Jackson: Well, let’s get on the scams now, okay? Yeah. Let’s get back on track. Finally. So the reason this was triggered, because when I reached out to you in our last little chat, you mentioned that you were heading off to Singapore and to Korea, and part of that is to attend an anti-scam conference. Right? Could you tell us a little more firstly about those conferences, the scam one?
Nigel Phair: Sure, sure. So the Global Anti-Scam Alliance is holding their Singapore, their Asia conference. So I’ll be attending that, and there’s some interesting sessions, interesting people. But to give it the gravitas, it’s actually sold out in person. It’s Suntec. Yeah. Suntec holds a lot of people’s rooms and they’ve opened it up online to people.
So kudos to them for getting a whole range of it’s predominantly an industry sort of audience. So that’s all good. So it’ll be interesting with that and then the Korea bit is the Cyber Security Korea 2025 conference, which is a government run event involving Lee, which I’m hoping will be quite interesting.
And I first went to Korea when I was in the in the police back in 2003 or 4, back when there were either streets ahead of us with connectivity and a whole range of other things. I remember. Yes, I remember going there and going to a hotel at two megabits per second. And we’re at dial-up in 2004.
Paul Jackson: Yes. You moved up from dial-up now in Australia, right?
Nigel Phair: I think so.
Paul Jackson: I’m just kidding. So obviously the conference in Singapore triggered my interest where, and I thought I’d focus this talk on scams, which I failed to do so far. But what are the sort of common or innovative scams that you’ve been seeing recently? Because I know you look at this very closely, right?
Nigel Phair: Yeah. No, absolutely. I like reading a lot of stats. And we take stats as they are, which is an important issue the first talking with because every jurisdiction is sort of now putting it out there. We’ve lost this amount of money in scams. And I think the first thing to delineate out of that is that figure is never true.
If that’s what the reported amount is. No one, in Australia included, Singapore, pretty much every other jurisdiction, is guessing how much underreported scams are. So, going back to the why police aren’t doing this, the figures are horrendous as it is and how many millions of dollars are lost, and it’s still underreported. If it was any other crime type, if it was, if we go back to, I remember, early policing days, late 80s and 90s, everything was about drugs.
Fraud wasn’t a thing, but drugs, we used to high-five ourselves when we’d sort of seized ten kilos of cocaine, and that wasn’t even a drop in the ocean. And the resourcing that went into drug interdiction, particularly at the border, it still does today, which is growing. Applaud the police for that. And it’s still a drop in the ocean. But the poor old cyber people, t’s tough to be game for them, but they’re not getting that resourcing. So until we accurately understand the losses, that’s the first thing. And then we’re going to move on from talking about the dollar losses to the whole of sort of societal losses.
So someone loses X amount of money. To some people, it’s their whole life savings. To some people, it’s the equivalent of a bad day at the races. It all depends where you sit on the curb of wealth and your own risk. Some people falling for a scam, they just go, yeah, it was a risky decision and I took it because I make risky decisions and sometimes they pay off and sometimes they don’t.
So we got to understand more the length and breadth of what it means to people financially. They know what it means to them psychologically. Because to some people, it really is the end of the world. And we don’t address that sufficiently, nor give the tools and techniques to people to deal with this huge financial loss from a psychological perspective.
Paul Jackson: Right. I could ask you another question related to this because the psychological part is really important. And I definitely feel for these victims. A lot of people say, Oh, you’re so stupid, how could you fall for that? But that’s really insensitive in many ways, because these scams are actually very clever and very they leverage the insecurities of individuals.
They learn how to press the right buttons to get them on the hook with their scams. And that’s the hard part, really. So I obviously am ex-Hong Kong police, and I assist clients and friends or whoever, to understand how to navigate reporting to police and what the outcomes might be.
And I have to say that I’m often very realistic, with them to say that, look, the chances of getting your money back up now? Zero. Yep. And, yes, go to law enforcement, give some closure. But the reality is, are the these guys ever going to get arrested or, unless it’s for insurance reasons or other reasons, then, yeah.
You’re not going to get much help from law enforcement. And I could help navigate that. But the reality is also that law enforcement, I don’t think, are very sensitive to the emotional damage because very often they want to report it because they hope that not so much about getting the money back, but getting somebody convicted for this, getting them punished, and getting that sense of justice, I would say for it. So I guess that’s the same sense in Australia. Right?
Nigel Phair: So you raise a really important point and it goes back to the very first question you asked about why isn’t law enforcement doing sufficient. With any other crime, you go to the police station and you report the crime. You walk in, go to the front desk and you say, this is what’s happened to me.
My car got stolen or got damaged, or my wallet got stolen or whatever happened, I got assaulted. Doesn’t matter what it is. And the the young constable on duty will take a report. But we don’t do that with any online crime. You’re directed to a website.
It’s very hard to find the website. It’s very hard to navigate the website. And the website asks you to do certain things. So firstly, you’ve just had a really bad online experience and then you’ve been directed to do something online to report it. And then on top of that, it’s expected that what’s happened. For a lot of people, all they know is they had some sort of interaction and now they have less money in their bank and something happened in the middle.
They may or may not be able to explain it plausibly. And so I just think about every little fact, the point is that we’re not being victim-centric. Whereas we’ve learned that with so many other things, with domestic violence and sexual assaults and all these other things, we’ve learned to be victim-centric. So it’s not like we need to learn this stuff. We know we’ve been doing that sort of stuff.
Paul Jackson: Yes, and you’re right, there’s still a prevailing attitude, in my opinion, when you talk to people, that how could they be so dumb to fall for this? And that’s hurtful and it’s, it’s certainly not helping.
Nigel Phair: The messaging is really another thing to really talk about is we victim blame and victim shame.
As you say, it’s like, how could you have done this, and what’s wrong with you? We say this set of things. And when we say this in our national education, we say things like, if it seems too good to be true, it probably is. But what does that mean? If we were falling for a scam, didn’t think it was too good to be true.
That’s why they went along with it. So saying to them afterwards, if it seems to be good to be true, and then we say things like, don’t click on the links, I click on links all the time. I can send emails with links, generally legitimate, but we just can’t make this blanket statement saying do not click on links.
I send emails with links in them all the time. I hyperlink all sorts of things through emails. And our messaging is just way out of whack, the way we treat people. It’s the same with people within an organization, you’ll often hear all of them just say, people are the weakest link. That’s why you need to buy my insert product here.
And until we start slinging that around and celebrating people saying, there’s all this technology to try and stop this, but you are still the final solution. And we celebrate you for that. We’re going to give you all the tools and techniques and the support that we can. We’re never going to solve this.
Paul Jackson: No, you’re right. And it’s a pressing issue. I just pulled up AI, funnily enough, and asked about statistics on cyber scams in the areas that we focus on anyway with this podcast such as Hong Kong, Singapore, Philippines, places like these. And I just saw that to Hong Kong’s is quadrupled in five years. The number of cases and the financial losses to over 5.5 billion Hong Kong Dollars. It’s shocking numbers and as I flick through Singapore and Philippines, it’s consistent. Right. They’re all rising exponentially.
Nigel Phair: I think Singapore is number one for scams in Southeast Asia. Twice that of its next one, which is Malaysia. And what you do if you’re a cybercriminal and you’re into scams, you go to the rich jurisdictions where the people have got the money and that’s the running businesses.
Paul Jackson: Yeah, that’s reality.
Nigel Phair: But where the extension to this goes to Paul, which why national governments do some stuff but don’t do anywhere near enough policing at all, all the arms of government. So we celebrate these. We say in the news, we see these statistics come out forwardly or annually. When we see them in the news, we do press releases, we celebrate with this X amount loss.
I can’t believe we celebrate that in any way, shape or form is, oh, it’s a headline figure like, oh, it was one crime reported every seven minutes. Now, it’s one crime reported every five minutes. It’s like we’re telling people this is oh, it’s a thing. Going back to the AI discussion where you want people online, we want people getting the goodness our technology, it’s where productivity is going to come in society.
And to me, the best way to get people to become non-technology adopters is for them to suffer one or more scams. They just go, what, I’m not going to participate is we’re going back to the bank and I’m going to queue up in front of the teller. I’m not going to get them, I’m not going to enjoy social media and contact bank, contact my friends or family. I’m not going to do all sorts of things. And that’s where I don’t think strategically as a nation, that we are fully understanding what this means.
Paul Jackson: I agree, I think what everybody needs is a little AI bot in the background, isn’t it? On your laptop or your phone, right? That is monitoring all your websites, your emails, your WhatsApp or text messages and saying, nah, that one’s a scam.
Nigel Phair: I’m sure they’ve been just creating that sort of stuff. And there is some cool stuff done. The telcos in Australia are blocking hundreds and hundreds of thousands of text messages and calls a month. Sometimes I get the call, so I wouldn’t answer my phone unless the caller is in my in my contacts list. And sometimes you’ll get one that’ll have a little of that little triangular alert saying, we think this is a scam call. So that there’s intent and there’s things happening. We seem to particularly have lots of good coordination, which is great. But coordination ain’t stopping the scams.
Paul Jackson: And, no, you’re right. And I think the lack of law enforcement or the lack of effectiveness, I should say, of law enforcement is, creating a somewhat vigilante approach]to cyber scams. I find it quite intriguing. You see on YouTube videos of very smart people who basically mess with scammers or hack them back and embarrass them, etc., or just waste their time or expose them publicly, whatever it might be. Or these AI bots designed to just represent grannies or older people.
Nigel Phair: So the Banks of Australia are using that.
Paul Jackson: Okay. I saw it originated in the UK. I think one of the banks there started that one off.
Nigel Phair: Yeah. One of the big four, I think it’s Commonwealth Bank. But in the media, a bot’s actively doing this to soak up the time of the cyber criminals
Paul Jackson: Yeah. The theory being, the more time that they spend with the bots, the less time they can spend with a real human. And well, I mean, we have to support initiatives like this because clearly the traditional law enforcement solution isn’t working. So, but I find this quite fascinating, and I do enjoy seeing folks who will give up their time to develop these solutions to hopefully save a few more people from being hit by the scammers. Right?
Nigel Phair: Yeah. Well, there’s been discussion in Australia for at least 15 years about what they call a cyber reserve. And then it particularly deal with defense, like, say you have your army reserve or something happens. I get called up for things and they’re doing the same thing to cyber. And some people take an extension to this and if you’re retired and you’ve got a couple of hours spare on a tuesday morning, why not occupy a scam or so that they’re not. Those couple of hours is being put to productive use.
Paul Jackson: Do you ever see the Australian government doing that?
Nigel Phair: Probably a bridge too far, but having said that, where I live in Canberra, if you’ve got a dash cam and you see your dash cam, you drive along and so on, cuts in front of you and runs a red light. You can send that to the police and they’ll send a ticket, an enforcement ticket to that person. So we have vigilante-ism already in other crime types.
Paul Jackson: Oh, I bet some people really enjoy that. They don’t. They look out for it.
Nigel Phair: Well, and this is the issue, isn’t it? I think that’s the real issue is some people might just enjoy it too much. And wavering along, biting people and stepping over the line.
Paul Jackson: Yeah. I could really picture some Aussies driving around endlessly just looking for those moments. Maybe, maybe not. But, yeah, this is interesting in but again, we touched on education earlier, but is there any other things you think we could do better in education?
Nigel Phair: Well, there’s no technical silver bullet. Firstly. So really it comes back to education. I’m not saying it’s all we’ve got, but it’s predominantly what we’ve got. But as we’ve know from the statistics it’s not working. Yeah. So we either need to change our education or do more of it, or both.
Paul Jackson: But as we were talking earlier, and as you mentioned, it’s nothing, the scams themselves. You don’t need education to be constantly changing because the scams don’t really change, do they? At the core.
Nigel Phair: The vector is still telephones and text, and WhatsApp. And I’ve always been a believer that they’re the most trustworthy things, particularly for older citizens that have grown up using a telephone. So that when someone rings and they say they’re from the bank, you believe them because that’s what used to happen.
Or if you get a WhatsApp message from someone with this great investment opportunity, or someone that’s just dramatically fallen in love with you or whatever it might be from a dating site, and so I think that they’ll continue to be the vectors because they’re the most trustworthy going around, way more trustworthy than email, for example. And people are used to them.
And it’s a low-cost entry for criminals, SIM boxing and the like. So, I just think it’s probably that the main trend that’s really starting to come on is that some of these criminals are executing faster. So once they get on the hook. For some of the big pig boot tricks scams, they’ve got people on the hook for weeks and months and stuff. The other ones, they’re executing really quick and getting money out of people really quick.
Paul Jackson: And I guess the other trend, it’s continuing to rise is crypto scams, of course, because as crypto gets more of a broad acceptance and more and more punters are investing, then of course the criminals go after the money where the money is. Right?
Nigel Phair: So yeah, it’s a no-brainer. It’s been interesting. The stats are still holding strong, that people are still paying scam people through traditional wire transfers. Crypto is still like number four but it hasn’t risen. There’s been a lot of assumption with crypto equals money laundering. It probably does. But the criminals are still making plenty of money from a traditional wire fraud.
And I also believe that this goes back to the wire, the telephone. It’s a trusted method; it’s what people understand. They’re used to sending money to other people through an app. So, I think that’s where that comes into. But who knows where crypto is going to head legitimately when you’ve got things like central bank, digital currencies, and all the reserve and central banks around the world have written policy positions.
At some end of that, we’re going to have a look at it to we’re not going to touch it because monetary policies, okay, blah, blah, blah. Then you’ve got stablecoins which are pegged to say a US dollar or another. Yeah. Strong fear. And there’s a good reason why we should be looking at those things, particularly sending of money.
If you’ve got a guest worker from the Pacific Islands picking fruit in Australia and they want they send money back. Taking it somewhere between a 5% to 8% commission really affects the family back home. So if you can create some sort of stable coin scenario where there’s virtually no commission, then yes, we should be investigating that.
Paul Jackson: Yeah. Well for sure. Yeah. And I’m sure it’ll be a hot topic at the conference. You’re going to be attending in Singapore. No, certainly from my point of view, I do get a lot of inquiries around crypto fraud, crypto scams, crypto thefts, etc., and they tend to be larger amounts as well, than perhaps some of the other frauds, which are more, number game, so it’s more victims, more money. Right? With smaller amounts.
Nigel Phair: So again, low barrier to entry. I’ve thought about creating my own coin. Yeah, Nigel Coins got a ring to it? That’s right. I’ll get online and get the URL for that afterwards.
Paul Jackson: Yeah, well, we’ve seen it. We’ve done with others whose names we won’t mention, but no, it’s certainly a very prevalent topic. And I’m also next week at a major conference, talking about organised crime groups, etc., and certainly crypto. There remains a very fast-moving and topical subject in this area.
So, yeah. I think we’ve covered quite a lot there, and I think these conversations I have with you are really fascinating because we kind of, with our similar backgrounds, etc., would love to see more done against criminals, that are basically hurting people and ruining livelihoods and are basically cruel. It’s a cruel crime. And not enough is being done about it. So hopefully over time, though, we can continue going to these conferences and trying to work with law enforcement, former colleagues, etc. and helping to continue the fight. But it’s not easy, is it?
Nigel Phair: No, it’s not. And we kind of have to wrestle our way out of the problem. That’s the first thing to tell law enforcement. Organised crime’s very good. That’s why this here is novel as it generally don’t get caught whether they’re on ethnic baselines or crime type baselines or whatever it might be. But putting sand in their gears whether it’s an AI or a bot, that keeps these people on the hook. But when you’re dealing with this, that’s the low level, that’s where you’ve got.
Yeah. Your place is in, for example, Southeast Asia where there’s just people forced to do these things. So we got lots of pain points we can hit all the way up to serious and organized crime. And that’s one thing I’ll give kudos to Australian particularly moral chop the Australian Federal Police. We’re getting much better proceeds of crime.
You’ll see the news when they do something. There’ll be a line with three Ferraris on the back that they’ve seized the house, the crypto, the ten Rolexes, that type of thing. Chucking them in jail is important. And investigating these things and restitution is important. But getting the assets is also an area that needs a lot more effort put into it.
Paul Jackson: Well, good stuff. So you’ve kind of helped me finish off there on a reasonably positive note, which is not a bad thing. And I hope our audience, if you’ve enjoyed listening to this, that you’ll hit the like or subscribe button on whatever platform you’re listening to us on, because I think it helps to get this kind of important information out to a broader audience.
And every little bit helps, but Nigel, as I always conclude these talks by asking about music, and I’ve told you the reasons why before, but has there been any improvement in your musical taste since the last time we spoke? And, what was on your turntable at the moment?
Nigel Phair: Well, probably not. So it’s a little bit, it’s all about the algorithm. And, I quite like going through phases of 70s disco.
Paul Jackson: Oh, you’re a podium, man.
Nigel Phair: Well. Oh, yes. That comes up, the algorithm seems to serve me a lot of hot chocolate. It has a nice beat to it. It’s easy to have an in the background. You can you can shimmer around to that type of music.
Paul Jackson: Brilliant. Nigel, thank you so much for giving up your time to join and stay. Enjoy the conferences you’re going to be attending. And, I look forward to welcoming you back on season three in there sometime in the future, because these talks are fascinating.
Nigel Phair: Thank you very much for the call and safe travels to you, too.
Recent Podcast

Episode 5 | Season 2
Cyber Scams in Asia: Victim Blaming, Underreporting, and the Need for Change
Why are cyber scams soaring in Asia while victims are blamed and fraud goes unseen?”
Episode 5 | Season 2

Episode 4 | Season 2
APAC Cybersecurity Challenges, Brain Drain, Data Privacy, and AI
Cybersecurity, privacy, and regulation—how are APAC companies keeping pace?
Episode 4 | Season 2

Episode 3 | Season 2
From ROOTCON Pioneer to Leading Offensive Security in APAC
Jayson “JV” Vallente’s journey reflects the rise of ethical hacking and offensive security across APAC.
Episode 3 | Season 2

Episode 2 | Season 2
From Scotland Yard to Manila—Building a Cross-Border Cyber Investigations Practice
From vice squads to digital forensics, one journey shows how cybercrime and response evolved.
Episode 2 | Season 2

Episode 1 | Season 2
Inside the High-Stakes World of Digital Forensics and Incident Response
How do the best in DFIR respond when there’s zero room for error—and no time to waste?
Episode 1 | Season 2

Episode 12 | Season 1
Navigating Privacy, AI, and Cyber Law in APAC
How can organizations stay resilient as privacy regulations lag behind rapid digital threats?
Episode 12 | Season 1

Episode 11 | Season 1
Cybersecurity, Leadership & Breaking Barriers
How do you secure a multinational company while navigating complex cyber regulations and evolving threats?
Episode 11 | Season 1

Episode 10 | Season 1
Cyber Journalism, Crisis Comms & the Power of Storytelling
How do journalists uncover the truth behind cybercrime?
Episode 10 | Season 1

Episode 9 | Season 1
Turning the Tables – 100 Days as CEO
What happens when the host becomes the guest?
Episode 9 | Season 1

Episode 8 | Season 1
What Every Business Needs to Know About Cyber Insurance
When a cyber incident occurs, can your cyber insurance policy come to the rescue?
Episode 8 | Season 1

Episode 7 | Season 1
The Leadership Playbook for Aspiring CIOs and CISOs
What does it take to transition from a cybersecurity practitioner to a strategic leader?
Episode 7 | Season 1

Episode 6 | Season 1
The Modern CISO 's Balancing Act - Security, Business, and Innovation
Is the traditional CISO role obsolete?
Episode 6 | Season 1

Episode 5 | Season 1
Crisis Leadership When Cyber Attacks Strike
What happens when a ransomware attack hits, and every decision counts?
Episode 5 | Season 1

Episode 4 | Season 1
The View from Down Under
What makes Australia’s cybersecurity landscape unique.
Episode 4 | Season 1

Episode 3 | Season 1
Cracking the Code to Cyber Talent and Recruitment
Explore strategies for finding and nurturing top talent in the cybersecurity industry.
Episode 3 | Season 1

Episode 2 | Season 1
From Cybercrime Investigator to Private Sector Leader
Follow the transition from cybercrime investigator to a leader in the private sector.
Episode 2 | Season 1
