Cybersecurity Awareness Month has arrived again every October. Google Taiwan’s official blog has released its latest observations on global fraud trends, revealing three new types of fraud tactics, platform-side defense deployments, and a daily “Five Don’ts” guide for general users. The article opens with a staggering scale figure: global economic losses caused by fraud are estimated at nearly US$580 billion, equivalent to about NT$18.9 trillion.
Google reveals three major new scam tactics and the “Five Don’ts” guidelines.
Google points out that the ultimate goal of modern scam groups is users’ trust in digital tools; stealing passwords is just part of opportunistic theft. They lurk in the cloud services, messaging apps, and online ads that the public uses every day, and everything from calendar invitations and cloud documents to QR codes can become an entry point. Below is a summary of the three major scam trends Google has revealed, current scam data from Taiwan, and self-protection actions you can take immediately.
Trend 1: Psychological warfare scams that abuse digital tools and forged emails
The first type of tactic abuses the public’s trust in cloud tools to evade detection: scammers insert fake notifications into calendars or hide phishing links in cloud documents. In Taiwan, impersonation is especially common. In addition to posing as financial experts or company executives to ask victims to create messaging groups on their behalf and then gradually set traps to trick them into transferring money, there have recently been frequent reports of emails sent in the name of well-known companies claiming “overdue payment reminder,” “lucky winner,” or “erroneous charge,” directing people to fake websites to enter credit card details and one-time passwords.
On defense, Gmail proactively blocks over 99.9% of spam and phishing emails; if you still see suspicious messages, click the built-in “Report phishing/spam,” and the system will immediately flag that domain as a malicious source. For calendar abuse, Google recommends changing “Automatically add invitations to my calendar” to “Only when I respond to the invitation” in Google Calendar settings—one action keeps malicious invitations out.
For phone number spoofing scams, in 2026 Google launched the industry’s first Android “spoofed call detection” technology based on the open RCS standard: when a contact in the address book calls, the caller’s phone sends a verification signal in real time via RCS to complete a “digital handshake,” confirming that the call actually comes from that device, thereby filtering out scam calls that impersonate the numbers of acquaintances. When talking with unknown contacts, the system also automatically blocks high-risk actions, such as being guided during a call to turn off Google Play Protect.
Trend 2: Man-in-the-Middle Attacks That Bypass Two-Factor Authentication and QR Code Phishing
Conventional phishing has evolved into harder-to-defend-against man-in-the-middle attacks (AiTM) and QR Code phishing. Enabling two-factor authentication is a basic line of defense for protecting account credentials, but scammers set up convincing fake login screens. While victims believe they are logging into the official website and completing two-factor authentication, the verification results have already been intercepted and copied behind the scenes. The same technique also appears on secretly swapped QR Code stickers, with roadside posters and restaurant tables being common locations.
In the face of threats that can bypass even two-factor authentication, Google is gradually adopting Device Bound Session Credentials (DBSC) technology to bind login status to a user’s physical phone or computer, so even if session credentials leak, scammers cannot log into the account on other devices. When Android detects high-risk scenarios, such as the phone not being connected to a commonly used Wi-Fi network and not having been unlocked recently, it will automatically hide one-time passcodes on the lock screen to prevent others from stealing verification codes through screen previews. Google also encourages users to switch to passwordless passkeys and continues to use legal avenues to combat malicious organizations developing phishing kits at the source.
Trend 3: Celebrity-impersonation investment and cryptocurrency scams using new technology
Investment fraud remains the largest category of crime worldwide by monetary value. Scammers exploit the public’s unfamiliarity with new technology to peddle fake cryptocurrency airdrops, mining software advertised as a way to make money without lifting a finger, or teach people to install automated securities trading bots; once victims follow the instructions and copy and paste malicious code, their digital wallets can be compromised immediately.
To cut off false advertising at the source, Google enforces advertiser identity verification; in Taiwan, advertisers of financial-related services must also pass mandatory “financial services verification” and obtain verification from regulators such as the Financial Supervisory Commission or the Ministry of Finance before they can run ads. Google also uses Gemini to deeply analyze the intent of ad copy to combat impersonation of celebrities and fake official websites. Whenever the system finds that different accounts are behind the same scam network, it suspends the entire group outright. In 2025 alone, Google removed more than 8.3 billion violating ads worldwide.
Current state of scams in Taiwan: 75% of people have encountered a scam situation in the past year.
How widespread is the impact of scams in Taiwan? The 2026 Asia Scam Survey Report: Taiwan Edition, jointly released by Whoscall under Gogolook and the Global Anti-Scam Alliance (GASA), shows that 75% of people encountered scam scenarios in the past year; 52% chose to interact with scammers, 23% lost money because of that interaction, and 12% provided personal information. The top two digital platforms where people most often encountered scams were LINE (45%) and Facebook (44%), followed by Gmail (35%).
The report also highlights the “secondary victimization” gap: among Taiwanese adult victims who had lost money to scams, as many as 45% were scammed more than once, with each victim suffering financial loss an average of 2 times; another 18% of parents said their children had been scammed. The psychological aftereffects on victims also warrant attention: 44% of victims said they were trapped in anxiety about “regularly worrying about becoming a scam victim again.” Gogolook co-founder and CEO Jeff Kuo said bluntly that scam tactics are highly AI-driven and scripts are increasingly sophisticated, and that a single institution or government enforcement alone can no longer fully address them.
Global Joint Defense: GSE and the Agreement on Combating the Online Fraud Industry
On platform collaboration with the public sector, since 2025 Google has worked with Taiwan’s Ministry of Digital Affairs, regulators under the Anti-Fraud Act, the Criminal Investigation Bureau, and other agencies to establish intelligence-sharing channels, and has jointly developed public anti-fraud solutions with the Ministry of Digital Affairs. Internationally, in 2024 Google co-initiated the Global Signal Exchange (GSE) with GASA and the DNS Research Federation, centralizing scam URLs, accounts, and attack signals so that businesses and organizations can share data and use AI to analyze fraud patterns.
In March 2026, Google and Microsoft, Amazon, Meta, OpenAI, Adobe, LinkedIn, and other companies signed the Industry Accord Against Online Scams & Fraud at the United Nations’ Global Anti-Scam Summit in Vienna. The accord covers four main pillars: implementing scam prevention through AI-driven detection systems, sharing threat intelligence with one another and with law enforcement agencies, supporting the deployment of defensive tools, and educating the public to recognize scams. The GASA global survey cited at the meeting showed that consumers in 42 countries lost $442 billion to scams in 2025, equivalent to about NT$14.4 trillion, and 13% of consumers encounter a scam at least once a day.
Daily “Five No’s” Code
- Do not create groups on behalf of others without permission.Public figures or senior executives will not suddenly write to ask strangers to set up messaging app groups for them; if you encounter such requests, be sure to stay vigilant.
- Do not blindly scan QR codes.If a barcode on a poster or bill looks like it was pasted on as an extra, never scan it.
- Do not click login or payment links directly.When you receive payment, prize, or login notifications, make it a habit to use bookmarks or manually enter the official website URL.
- Don’t automatically accept calendar invitationsChange the Google Calendar setting to “Only add invitations when I respond.”
- Do not readily believe persuasive pitches that guarantee profits.：Be alert when you hear about investments offering high returns with zero risk. If you have any doubts, call the 165 anti-fraud hotline immediately to verify.
Conclusion
From the three major trends Google has revealed, the common thread in scam tactics is “borrowing a shell”: borrowing the trust of cloud tools, the sense of security of two-factor authentication, and the halo of celebrities and new technology. Platform-side protections are largely in place—Gmail’s interception rate, advertiser verification, DBSC, and spoofed-call detection are all solid technical lines of defense—but the final checkpoint still comes down to users’ own mouse and fingers. Doing any one of the Five Don’ts properly can block an entire category of attacks; when you suspect you’ve encountered a scam, the 165 anti-fraud hotline is always one step faster than the transfer button.
Source:Google Taiwan Official Blog
Source: KOCPC Chinese