Think before you trust – a digital safety guide from GISEC 2026

Cybercrime does not need to be sophisticated to work anymore, it just needs to catch you at an emotional moment.

This was the core message from Prof. Dr. Shankar Karuppayah's cybersecurity researcher and Deputy Director of the Cybersecurity Research Centre (CYRES) at Universiti Sains Malaysia (USM) session at GISEC 2026, where he walked attendees through the everyday habits, free tools, and verification tactics that can protect against phishing, hacking and the rapidly growing threat of AI-powered scams.

As Karupppayah put it during his session:

"Sometimes when you are very emotional, you can actually accidentally commit to some of the phishing attacks," he said, pointing how scammers tend to use personal stories as a way to create a trap

Here is what our readers need to know

More than two red flags mean attack

Karuppayah shared a simple framework for spotting an attack before it is too late, which consists of six warning signs that show up in nearly every scam.

1. Urgency: A deadline or threat that leaves no time to think. It could show up in a message like "Act now or your account will be suspended"

2. Unexpected ask: a request for payment, a password, an OTP, or a file you were not expecting.

3. Channel switch: being pulled off an official channel into a private chat. This shows up in way where they could ask of you to message them on WhatsApp instead.

4. Borrowed authority: invoking a boss, bank, courier, or officer you cannot question.

5. Too good to be true: prizes, refunds, or returns no one else is offering.

6. Secrecy: pressure to keep it to yourself from a second opinion.

His rule of thumb is if you spot one warning sign in a message or call, you have to stay alert.

"If you spot two or more of these warning signs, there is a reason for you to treat it as an attack until it is proven to be another one," Karuppayah advised, and added that scammers rely on emotional urgency to short-circuit careful thinking, so building this habit of pausing to count red flags can  interrupt an attack before it succeeds.

Fix your password habits

Reusing passwords, or just tacking a symbol on the end of an old one, is one of the most common mistakes people make, according to the professor.

"The bad thing is to reuse passwords. You keep adding symbols and numbers in front and at the end of our password. This is not the right thing to do," Karuppayah said.

He recommended using a password manager, noting that free, open-source, cross-platform options exist that generate unique passwords and track the expiry dates. He also pointed attendees to the website haveibeenpwned.com, demonstrating the tool live during the session, he said:

"I just added a test email, and there are 65 data breaches. This is an underestimate. You have to keep checking to see the new breaches being recorded,"

Beyond checking for breached accounts, he shows how to check whether a specific password has been compromised testing a common one himself.

"I just tried the password 'dubai' in all small letters, and i have seen it 22,900 times in different sets of breaches," he stated.

Everyday digital hygiene

A few habits, each taking seconds, add up to real protection. First: "Just because you see a padlock does not mean that it is secure," Karuppayah warned lookalike domains are designed to fool you at glance.

He also recommended sticking to one browser and keeping it, along with everything else, updated, and typing sensitive URLs directly instead of clicking links.

"Whenever it is very critical - like when it is banking, finance, payroll, government portal - do not click links, type it directly," he said.

For unexpected attachments, he pointed to tools like VirusTotal to scan files before opening them, and for shortened links, services like CheckShortURL or a URL reputation checker can reveal where a link leads before you click it.

Skipping these is not harmless, according to the professor, as cybercrime linked to avoidable mistakes like these costs the world an estimated $ 2 billion.

AI has changed the game

Karuppayah's session made a pointed observation.

"You are already using AI, so are the attackers," he said and added that the same technology that smooths out your writing or pictures can now be used to study your email style and generate convincing phishing messages - as he explained, the scammers are "feeding into the AI and then telling AI to prepare the phishing mail that will be suitable. so anyone receiving it will not be suspicious from the language and the writing style."

Voice cloning has also taken this further, with real cases of cloned "child's voice" calls used to convince parents their kids were in danger.

"We have cases where parents have actually paid the money, but nothing happened to the kid," Karuppayah noted.

Video is not safe either. He cited the well-known Hong Kong Case from February 2024, where about "25 million US dollars has been paid out by a finance employee who attended a Zoom call that he believed was the CFO. But that call did not happen it was fake," Similar incidents followed in Singapore in 2024 and Switzerland in January 2026, he said.

How to verify before you trust

Since most detection tools cannot be relied on yet, Karuppayah emphasized verification habits over technology.

His advice is firstly to never call back on the same number or channel.

"If you receive a voice call, do not call back,", he said. He also recommended agreeing on a family code word in advance. As he put it,"the cloning can only clone the voice, not the memory," meaning a private phrase your family knows cannot be replicated by a clone.

If something feels off during video call, Karuppayah advises asking for a live, unscripted action to confirm, you are speaking with a real person, and reconfirming through a second channel, following up any urgent video or email request with a phone call.

Above all, never send money after a single request, he stated, especially if you are working in finance.

"Stop whenever you think something feels a bit urgent. Verify on a channel that you trust, and never on the same channel that you receive the instruction on," he said.