Ask Bora: What 5,000 cyber experts want you to know

Bora Seker cuts through the latest cyber threats and answering your most pressing scam questions.

Picture a convention centre packed with more than 5,000 people whose job is to stop criminals breaking into computers. Now picture what they kept talking about. It wasn’t computers. It was people.

That was CyberCon 2026 in Melbourne, from 14 to 16 October. It’s Australia’s yearly gathering of the people who protect our banks, hospitals and businesses, run by the not-for-profit Australian Information Security Association. Three days, more than 160 exhibitors, and a room full of people whose job is to stay one step ahead of the criminals.

I went along as Dumb Ways to Get Hacked with one question for everyone I met: what does all this mean for the family at home?

Here’s what they told me.

1. Scammers hack people, not computers.

Ahmed Khanji, one of the experts I interviewed, put it simply: “Hackers aren’t hacking systems, they’re hacking people.” Big companies spend fortunes on security and still get caught out by one convincing phone call. You might think that’s their problem. It isn’t. It’s the same trick that lands in your inbox and on your phone.

2. AI has made the fakes much better.

The old giveaway, a scam email full of spelling mistakes, is fading. Scam messages now arrive in perfect English, and a cloned voice can sound exactly like someone you love.

Caitriona Forde, who runs scam-awareness sessions for retirees in Western Australia, told me about a woman who got a call that sounded exactly like her son-in-law. He was in trouble, he said, and needed her to meet him in a shopping centre car park. It wasn’t him.

Keynote speaker Tracy Hall, who once lost $317,000 to a conman, described hearing a clone of her own mother’s voice. Her message to the room was that we all need to “become unhackable humans”.

3. The best defence is free.

The tip I heard most often was to pick a family code word. Maryam Shoraka, an award-winning security leader, has one with her own mum. If someone calls claiming to be family and asking for money, ask for the word. No word? Hang up and call them back on the number you already have.

Her other advice was blunter: “Stop believing what you see.”

Three days, thousands of experts, and the lesson fits on a fridge magnet. The criminals have new tools. You still have the oldest one there is: the pause before you act.

Your questions

Q: I’m 68 and my daughter recently warned me that scammers can use artificial intelligence to copy someone’s voice and ring their parents pretending to be in trouble. I find that absolutely terrifying. Can they really do this, and how on earth would I know if it was her?

Margaret

A: Yes, Margaret, they really can. Scamwatch says a few seconds of someone’s voice, from a video online or a voicemail greeting, is enough to make a convincing copy. The scam relies on panic, so slow it down. Hang up and call your daughter back on the number you have saved for her, and agree on a family code word only your family knows. If the caller can’t say it, it isn’t her.

Q: My husband and I are both retired and have most of our savings in online accounts. He uses the same password for practically everything and says our bank would reimburse us if someone stole our money. I’m not so sure. Who’s right, and what should we be doing differently?

Helen, VIC

A: You’re right to be unsure, Helen. Banks generally refund money taken without your permission, but if they can show you were careless with passwords you may lose some or all of it, and if a scammer talks you into sending the money yourself there’s no guaranteed refund. Reusing one password is the real danger: when one website is hacked, criminals try that password on your bank and email next. Never use the same password twice. Turn on two-step verification (a code sent to your phone or app) wherever it’s offered, and let a password manager remember them all for you.

Q: I’m 72 and recently received a friend request from a very pleasant gentleman who says he’s widowed and lives overseas. We’ve been chatting for a few weeks, and he seems to know things about my family and where I’ve travelled. My granddaughter says it’s probably a scam, but he hasn’t asked for money. How can I tell whether he’s genuine?

Janice, NSW

A: Janice, I’m with your granddaughter. Romance scammers often spend weeks or months building trust before they ask for money, and knowing about your family and travels usually means he’s read your Facebook posts. Don’t rely on a video call either, because scammers can now fake those live. Get your granddaughter to check whether his photos appear online under other names, and never send money or ID. A genuine friend won’t mind your family being involved.

Where to get help

Scamwatch: scamwatch.gov.au. Report a scam and see current warnings.

IDCARE: 1800 595 160. Free help if you think your details have been stolen or you’ve been scammed.

Your bank: if money has gone, call the number on the back of your card straight away, never a number from a message.

Got a question for Bora?

Bora Seker hosts the Dumb Ways to Get Hacked podcast and runs Cyber Safe Homes, an online community on Skool where families learn to spot scams together. Find him at @dumbwaystogethacked on YouTube, Instagram and LinkedIn

Send your question to [email protected] and Bora may answer it in an upcoming Ask Bora column. Find Bora at @dumbwaystogethacked on YouTube, Instagram and LinkedIn.