Multiple years of anti-scam campaigns have produced the response they asked for. Every protective behaviour we measure rose this year. More consumers strengthened their account security, more changed or limited their contact details, more installed security tools, and more warned the people around them. Victims are not in denial either: 84% accept at least partial responsibility for what happened to them, and 87% can point to the moment they clicked, shared or paid when they should not have.
What has not moved with them is the system they report into. Sixty-eight per cent of scam victims lose money, and of those who do, 82% recover none of it. Only one in ten is made whole. Nearly half of all reported cases, 45%, are never resolved.
This is the third wave of the survey, and the first that measures what happens after the consumer has acted. The answer is that awareness and self-protection have taken consumers as far as they can go alone.
Consumers have done their part
Recent victimisation is steady. Eight per cent of ASEAN consumers report being scammed within the last twelve months, unchanged from 2025, though the regional range has widened: 5% in Thailand and Indonesia, both down on last year, rising to 13% in Vietnam.
The footprint is far wider than the victim count. Forty per cent of consumers have not been scammed themselves but have watched someone close to them be scammed, and say it changed how they behave. Sixty-six per cent have changed their behaviour because of scams, through their own experience or someone else's. Two-thirds of the region now carries the behavioural cost of fraud, which no victim count captures.
Every one of the eight protective behaviours we track rose. Enhanced account security, the most common, climbed from 50% to 58% of all consumers. Changing or limiting contact details rose from 35% to 41%, installing or upgrading security tools from 27% to 31%, and reporting scams or warning others from 31% to 34%. The share taking no protective action at all fell from 8% to 7%.
Concern has nowhere left to rise. Ninety-six per cent of consumers worry about being scammed or hacked, flat on 2025, and 82% believe the risks are increasing. Artificial intelligence is now the operating environment rather than an emerging threat: 89% say they have seen AI used in scams, and the remaining 11% could not tell whether AI was involved in the scams they met. No single technique dominates. Recognition of the six we test runs between 37% and 52%, which shows how far AI has saturated the market.
Behaviour is contagious; distrust is not. Consumers who have watched someone close to them be scammed pick up about 80% of the victim's shift on warning others, on calling companies back through official numbers, and on installing security tools. But they rate institutions almost exactly as the untouched do. Protective habits travel through families and workplaces ahead of any campaign. The loss of trust does not travel, and where it does land it lands on the whole ecosystem at once rather than on any single actor within it.
The flip side of that self-reliance is overconfidence. Consumers rate their own protection higher than any institution's: 77% score themselves 8 or above out of 10, against 49% for telcos and 43% for government. That confidence is precisely what social engineering exploits.
What happens to a reported case
The bottleneck is no longer in the consumer's hands. Sixty-nine per cent of victims report their case to an organisation, and those who do take it to 1.9 organisations on average, spread across the chain rather than concentrated anywhere.
No organisation is credited with resolving even a third of what reaches it. Half of all reported cases reach a financial institution, level with the police, and fewer than one in five of those victims credit the institution with resolving it.
The burden of escalation falls on the victim. Victims whose losses still worry them today report to 2.3 organisations on average, against 1.5 for those whose losses do not, and recovery differs little between them, 25% against 24%. Reaching the organisation that can act is left to the victim's own persistence, which points to a structural gap rather than a problem of under-reporting.
One part of the system reliably works. Where a charge is genuinely unauthorised and the victim raises it with their financial institution, money comes back far more often than through any other route. It works because the money has not left the system: an institution can reverse what it still holds. What limits it is reach, not the mechanism. More than a third of card-charge victims never take the case to their financial institution at all.
And scams are moving away from that route. The fastest-growing types are the ones where the victim is persuaded to send the money, with investment and crypto, online shopping and job scams each rising three to four points, while the types where money is taken rather than given fell. Consumers have made themselves harder to steal from, so scammers have shifted to persuading them to pay. An authorised payment is the hardest of all to reverse, and a system built to reverse small unauthorised charges is aimed at where the harm used to be.
The cost of an unresolved case
An unresolved case does not end when the victim gives up. Among victims who reported, those left without a resolution trust less and are less willing to share. Fifty-two per cent of victims whose case was resolved rate SMS as trustworthy, against 32% of those whose case is still open. The gap repeats on comfort giving personal data to conversational platforms, and again on willingness to let digital platforms hold data to detect fraud.
Those are the two things shared fraud defences depend on. Every unresolved case quietly taxes the whole ecosystem.
Consumers have also defended themselves by becoming harder to reach. Forty-one per cent have changed or limited their contact details, which includes ignoring unknown calls and links, and 19% will re-engage only through a number they have dialled themselves. Counting those alongside consumers who have cut back on online transactions, 56% avoid inbound contact or transactions because of scam concerns.
That withdrawal rises with each additional AI technique a consumer recognises. Among consumers who recognised one technique in the scams they met, 28% ignore unknown calls and links. At two it is 34%, at three 44%, at four 51%, and at five or more, 58%. It is not victims driving it: among consumers who have never been scammed the numbers match the full population to within a point at every step. In a market saturated with AI, consumers increasingly trust only what they initiate themselves, and that wariness is paid for by the legitimate caller rather than by the scammer.
The cost falls hardest on the channels operators own. SMS fell from second place to last of the seven channels consumers rate, in a single year. Churn follows the same pattern: moving accounts or switching provider because of scam concerns runs at 11% among consumers untouched by scams, 20% among those who know a victim, and 25% among consumers who have been scammed. Those close to victims churn at nearly the rate victims do, and at more than double the rate of consumers scams have not touched.
Some of that cost cannot be bought back. A consumer who has pulled out of online shopping does not return when the case is finally settled.
Where the room to act is
Three constraints define what interventions are feasible: friction, credibility and permission.
On friction, consumers rate the inconvenience they currently experience in online transactions at 5.7 out of 10, and the maximum they would accept in exchange for stronger protection at 6.4. That leaves 0.7 of a point across the region, and it is narrow in every market. A security step applied to every transaction spends that room on every customer, including the overwhelming majority whose transactions are legitimate. The question is not only whether a measure stops scams, but whether it can be aimed at the transactions that carry risk.
On credibility, programme visibility is not the constraint. Eighty per cent of consumers are aware of anti-scam programmes from financial services, 73% from government and 65% from telcos. Awareness has not produced confidence: every actor is rated below the responsibility consumers assign it, by 18 points for financial services, 24 for telcos and 28 for government.
On permission, consumers are most comfortable with financial institutions holding and using their data to detect fraud at 79%, then telcos at 69%, government at 65% and digital platforms at 60%. What separates them is geographic consistency rather than the average. Comfort with financial institutions moves only 7 points across the six markets; comfort with government swings 32 points, from 82% in Vietnam to 50% in Indonesia. Any arrangement that assumes a single regional answer to who may hold consumer data will fit some markets and not others, and the actor whose licence varies most is the state.
Platforms are in the most difficult position. They hold the least permission of any actor while the two largest scam channels in the region, messaging apps at 41% of victims' scams and social media at 36%, are theirs.
Country snapshots
- Singapore is where recognition of anti-scam effort sits almost entirely with the state. Eighty-two per cent know about government programmes, while awareness of telco programmes runs at 35% against a regional 65%. Singaporeans are the least worried market and the most likely to have taken no protective action at all, at 11%.
- Malaysia pairs maximum expectation with minimum permission. Seventy-eight per cent assign telcos high responsibility for stopping scams, while only 62% are comfortable letting their operator use their data to detect fraud. That 16-point gap is the largest of the six markets.
- Thailand is one of the region's success stories. The share who absolutely worry fell from 67% to 48%, and recent victimisation is the lowest of the six markets at 5%. Two gaps remain open: voice calls are involved in 50% of Thai victims' scams, and 35% of Thai victims were hit by someone posing as police, tax or the courts.
- Indonesia is where the state registers least with consumers on every measure we track. Only 50% are aware of any government anti-scam programme, against a regional 73%, and only 17% of victims go to the police, against a regional 36%. Official statistics built on police reports will capture only a fraction of the problem.
- The Philippines is where victims take their cases to platforms rather than the police: 49% reported to a digital platform, the highest in the region, while only 16% went to police. Investment and crypto scams reach 41% of Filipino victims, well above the regional 29%.
- Vietnam carries the region's highest exposure alongside its highest trust in institutions. Thirteen per cent were scammed in the last twelve months, and 95% recognise AI techniques in the scams they meet, both regional highs. So are the permissions: 82% are comfortable sharing data with government and 76% with their mobile operator. It is the market where the need to act and the permission to act are both greatest.
What the ecosystem can do next
Coordinate reporting. A case reported at any entry point, financial institution, telco, platform or police, should be registered once under a single reference and made visible to the organisations that need to act on it, so the victim reports once rather than repeatedly. Success is measured on outcomes rather than activity: share of victims recovering funds, time to resolution, share of cases still unresolved. Where cross-sector machinery is out of reach this cycle, each institution can publish its own reporting volumes and outcome figures and create the baseline.
Make commitments verifiable, not merely visible. The programmes are already known, so the gap is not one of visibility. A certification anchored to the same outcome measures, tied to what an institution actually resolves rather than what it claims to run, can be checked against the numbers a case-tracking system would already be producing.
Financial institutions: extend recovery to more transactions. Card reversal works because the money has not left the system. The same principle extends to funds still in it: flagging or holding transfers that carry the markers of a scam in progress, and cooperating so a payment can be stopped at the receiving institution and not only at the sending one. Financial institutions hold the region's deepest and most uniform permission to use data for fraud detection, a mandate no other actor holds in every market.
Operators: act on the vectors they control. Voice calls are involved in 35% of victims' scams and SMS in 30%, and a quarter of victims were hit by someone posing as police, tax or the courts, 72% of those arriving by voice or SMS. The work is on the network: challenging calls and messages that impersonate an authority or a brand, verifying sender identity, and filtering scam messages before delivery. Operators also hold signals no other actor can see. Sharing SIM-change status and number verification with financial services at the moment of a transaction lets the institution holding the money flag a fraudulent payment before it completes.
Platforms: the largest channels, the least visible response. Platforms sit last of all actors on both visibility and permission, which leaves less room for a data-led response. What is available is structural: seller and advertiser verification, faster takedown, and co-owned case handling with financial services whenever payment leaves the platform.
Governments and regulators: measure resolution. Mandates should measure and publish case outcomes rather than centralise data, and data-sharing arrangements should be designed around the level of consent each market actually gives rather than a single regional model. Education budgets should be split by audience, because general awareness has already reached most of the population. The clearest remaining target is the 11% who saw scams but could not tell whether AI was involved: that group takes no protective action at all at 20%, against 7% of consumers overall, and what they lack is recognition rather than motivation.
Conclusion and the path forward
Consumers have done their part. Every protective behaviour we track rose this year, the share doing nothing at all fell to 7%, and two-thirds of the region has changed how it behaves because of scams. What they meet on the other side has not moved. Forty-five per cent of reported cases are never resolved, 82% of victims who lose money get none of it back, and reaching an organisation that can act is left to the victim's own persistence. None of that is a failure of consumer effort, and none of it will be fixed by more consumer effort.
The region also has less room to act than it assumes. Consumers will accept less than one further point of friction, and they grant more permission to their banks and mobile operators than to the state. Any measure applied across every transaction spends that room on everybody, whether or not it works.
What would change the picture is narrow and specific. A case reported once that reaches everyone who needs to act on it. Recovery measured and published rather than activity. Commitments a consumer can check rather than take on trust. None of it requires another campaign. Get that right and the sequence runs the other way: cases that close sustain consent, consent enables the data sharing that shared defences depend on, and those defences stop the next case before it starts.
Consumer survey methodology
The insights in this report are based on cross-sectional online surveys of adults aged 18 and above in six ASEAN markets: Singapore, Malaysia, Thailand, Indonesia, the Philippines and Vietnam. Wave 3 fieldwork was conducted by Milieu Insight via self-administered online interviewing in local languages, with approximately 500 respondents per market (n=3,000) and non-interlocking quotas on age by gender, region and socio-economic class. ASEAN figures are equal-weighted across the six markets, and cohort comparisons use the combined six-market base. Victim impact, reporting and recovery metrics are calculated on the experiences of victims only. Comfort and trust measures on 1-to-10 scales report the share scoring 7 or above unless otherwise noted; responsibility and performance ratings report the share scoring 8 or above.
