THIRD_CACHE // RYD
LIVE
--:--:-- AEST
DOC.TC-2026-05-RYD-001
EDITION 01 / AU.NZ.US
ISSUE MAY 2026
CLASS PUBLIC
AUTHOR ED COGHLAN

READY YOUR defences.

A practical cybersecurity guide for everyday families.
$ sys.init --user=ed.coghlan
> loading guide [01-08]_OK
> threat model: families × AU, NZ, CA
> tone: direct. no-bullshit. kind.
! 95% of households can fix this in a weekend.
> begin
READY_YOUR_DEFENCES.HTML // 01 OF 08
SCROLL TO BEGIN ↓
THIRD_CACHE // MELBOURNE
SECTION FIG. 01 / 08 A NOTE FROM ED
A note before you read on.

The internet got dangerous while we weren't paying attention. Three seconds of your voice is enough to clone it.

You don't need to become a hacker. You need to know what to do this weekend. That's what's in here.

If anything looks confusing, ring me. I'd rather spend an hour on the phone with you than read about you in the news.

-- Ed

SECTION FIG. 02 / 08 THE LANDSCAPE
The numbers, three countries deep

Getting hacked is expensive.

Australia
0.00B AUD
New Zealand
0.00B NZD
California
0.00B USD

AI has changed everything.

Audio, video, fake websites, phone calls and emails that look and feel legit.

The old rules -- spot the typos, hang up on the Indian call centre -- are done. Today's scam sounds exactly like your daughter. // FIELD NOTE, MARCH 2026
SECTION FIG. 03 / 08 NEW THREATS (AI-NATIVE)
What 2026 added to the menu

The threats that didn't exist three years ago.

01Voice clone
ACTIVE THREAT // GLOBAL

"Mum, I'm in trouble." It isn't her.

Scammers pull three seconds of audio from a voicemail or social media clip and clone the voice for under USD 10. They ring family in distress -- crash, arrest, kidnap, hospital -- and ask for money fast.

  • 3 sec of audio = full voice clone (Trend Micro, April 2026)
  • Cost to the scammer: under USD 10
  • 1 in 3 engaged victims lose money
  • Average loss: ~USD 18,000
  • May 2025 FBI alert: cloned U.S. officials in use
5M+
USD lost to "distress" calls in 2025 alone
3s
Audio needed to build a usable clone
DEFENCE: Family password. Hang up, call back.
02Deepfake
CONFIRMED CASES // ESCALATING

The boss on the call isn't real.

A live video conference with the CFO and senior staff. All AI-generated. The Arup employee transferred HKD 200M (~USD 25.6M) across 15 wires before realising. Eddie McGuire was deepfaked in an AU investment scam in March 2025.

  • Arup case: HKD 200M (USD 25.6M), Hong Kong, Jan 2024
  • Eddie McGuire used in fake AU investment scam, Mar 2025
  • Now affordable for small-business BEC, not just movie-studio attacks
  • Real-time deepfake video runs on a single gaming GPU
25.6M
USD wired by Arup employee after fake call
15
Transfers made before discovery
DEFENCE: Any video request for money = verify off-channel.
03Sextortion
PUBLIC HEALTH CRISIS // TEENS

The hour that breaks a young life.

A stranger befriends a teenager, fast-tracks intimacy, gets one image, then demands payment with threats to send it to every contact. 90% of victims are male, mostly 18-24, but it reaches younger. AI deepfake nudes of classmates is the new variant.

  • AU reports up 1,332% 2018-19 to 2022-23 (eSafety)
  • 1 in 7 minor victims self-harmed (Thorn, June 2025)
  • 1 in 6 victims first sextorted at age 12 or younger
  • U.S. TAKE IT DOWN Act signed 19 May 2025
  • NCMEC Take It Down: free, anonymous, removes copies
1332%
Rise in AU sextortion reports 2018-23
15%
Minor victims who self-harmed (Thorn 2025)
DEFENCE: NEVER pay. Screenshot. takeitdown.ncmec.org
SECTION FIG. 04 / 08 OLD THREATS, STILL WORKING
The bread and butter

The classics still pay.

Eight everyday scams still doing damage. No AI required. The defence is almost always the same: stop, leave the channel they contacted you on, verify a different way.

SMS-001

The toll / parcel text

Linkt. AusPost. NZ Post. USPS. The message lands in your real Linkt thread because sender ID is spoofed. Bitdefender tracked 2,200+ shortened URLs Dec 2025-Apr 2026.

Never tap SMS links. Open the official app.
PHN-002

Microsoft / Apple / Telstra "support"

Cold call about "an issue with your computer". Asks for remote access. USD 924M lost in the U.S. alone in 2023 (FBI IC3).

No real company cold-calls you. Hang up.
TAX-003

ATO / IRD / IRS impersonation

Aggressive call or SMS demanding back tax via crypto or gift cards. No tax office on earth uses gift cards. Or crypto. Or DMs.

Tax owed? Log in directly. Ring the tax office.
MKT-004

Marketplace overpay / fake buyer

FB Marketplace, Gumtree, Craigslist. "Buyer" sends fake payment confirmation, asks you to send a code or refund overpayment. PayID variant in AU.

Cash on collection. No codes shared, ever.
BNK-005

"Move money to a safe account"

Caller claims to be from your bank's fraud team. Says your account is compromised, walks you through transferring funds. No real bank does this. Ever.

Hang up. Ring the number on your card.
GOV-006

myGov / ServiceNSW / DMV

Phishing for login + 2FA. The fake site looks identical. Often paired with a fake "verify your identity" SMS that triggers an MFA prompt.

Type the URL yourself. Use the app.
ROM-007

Romance + pig-butchering

Slow-build relationship pivots to crypto investment "I'm doing well at". Single biggest dollar-loss category. AU investment scams: AUD 837.7M in 2025 alone.

Never met = never send money. Period.
QR-008

Quishing (QR phishing)

Sticker over a real parking-meter or restaurant QR. Confirmed cases in Denver, Chicago, Montreal, Ottawa. The URL preview is your only defence.

Preview every QR URL before tapping open.
SECTION FIG. 05 / 08 FOUNDATIONS // DEFENCES

Seven things that actually work.

If you do nothing else, do these. They cost almost nothing and they remove most of the risk. Skim them. Tick them off. Get on with your life.

01 // MASTER KEY

Email is the master key.

Lose your primary email, lose every account it can reset. Treat it like the front door it actually is.

  • Long, unique password. Never reused anywhere.
  • MFA via authenticator app. Not SMS -- SIM swappers defeat SMS.
  • Recovery email + phone set, locked, and reviewed.
  • Audit forwarders + filters quarterly. Attackers hide invoices there.
02 // VAULT

One vault. Long passphrase. Done.

A password manager is the single highest-leverage thing on this list. You only memorise one passphrase.

  • Bitwarden Free. Unlimited passwords, all devices, open source. Pick this.
  • 1Password Families USD 4.99/mo. Better UX for less technical relatives.
  • Apple Passwords / Google PM. Fine if everyone is on one ecosystem.
  • Skip LastPass after their 2022 breach.
03 // SECOND FACTOR

Climb the MFA ladder.

Not all second factors are equal. Move up the ladder as far as you can stand to.

0
SMS code
Better than nothing. Defeated by SIM swap.
WEAK
1
Authenticator app
Google / Microsoft / Apple. Default for most.
GOOD
2
Passkey
Stored on device. Phish-resistant.
STRONG
3
Hardware key (YubiKey)
~AUD 90. Email + vault only. Backup key.
BEST
04 // 3-2-1 BACKUP

Back up like a paranoid.

The 3-2-1 rule: three copies, on two different media, with one off-site. Cheap. Boring. Saves families.

  • iCloud+ 200GB / Google One 200GB. AUD 4.49/month.
  • External SSD rotated monthly. AUD 100 once.
  • Offline / disconnected copy. The only thing ransomware can't reach.
  • Minimum content: photos, ID scans, password vault export, business records.
05 // POCKET COMPUTER

Lock the pocket computer.

It has your bank, your email, your photos, and your two-factor codes. Treat accordingly.

  • 6+ digit passcode. Biometrics on. Auto-lock at 30 seconds.
  • Find My / Find My Device on. Stolen Device Protection enabled.
  • SIM PIN set. Port-out protection requested from your telco.
  • Auto-update OS. The boring fix kills 80% of exploits.
  • Lockdown Mode for high-risk users (journalists, activists, politicians).
06 // YOUR NETWORK

The router is the gate.

Most homes still run the router's default password. That's the equivalent of leaving the front door key under the same rock as everyone else.

  • Change router admin password. Today. Stick the new one on the device.
  • WPA3 or WPA2 with a long passphrase. Disable WPS.
  • Firmware updates on auto. Replace if 5+ years old.
  • IoT on guest network. Doorbells, cameras, TVs, baby monitors.
  • VPN is for hotel + airport Wi-Fi, not your house.
07 // WHO HEARS YOU

Pick the right channel.

Default to end-to-end encrypted messaging. Status as of May 2026 below.

Signal
YES
WhatsApp
YES
iMessage
YES
RCS (iPhone to Android)
YES
Telegram
PARTIAL
SMS
NO
SECTION FIG. 06 / 08 QUICK CARDS // BY AGE
For the conversation at the dinner table

One card per life stage.

CARD 01 / 03 KIDS + TEENS

Under 18.

DISCORD // ROBLOX // SNAPCHAT // SCHOOL
  • Never take nudes of yourself. And never share them. You're underage -- it's classified as distribution of child exploitation material and follows you forever.
  • If sextorted: don't pay. Don't delete. Screenshot. Tell an adult.
  • Then use takeitdown.ncmec.org. Free. Anonymous. Removes copies.
  • Snapchat saves everything on Snapchat's servers.
  • Discord + Roblox accounts get stolen weekly. Use unique passwords.
  • AI deepfake nudes of classmates are now illegal under the U.S. TAKE IT DOWN Act (May 2025).
  • Strangers asking for personal info = block. Always.
  • The "764" network exists. Predator groups are organised.
CARD 02 / 03 ADULTS + PARENTS

Working age.

EMAIL // BANK // BUSINESS // KIDS
  • Email = master key. MFA it. Use an authenticator app.
  • If you run a business: BEC scams cost USD 2.7B in 2024.
  • Never change a bank account on email alone. Ring to confirm.
  • Romance scams don't care if you're smart. AU loss: 139.9M in 2025.
  • Discuss scams with your kids without shame. Silence is what keeps scams working in your family.
  • Family password agreed -- everyone uses it for "emergency money" calls.
  • Annual privacy audit on social accounts. Quietly remove the old.
  • Sounds crazy, but: consider paying someone to try and hack you, your staff, your kids, your parents.
  • Everyone thinks she'll be right. Nothing motivates like actually being hacked.
CARD 03 / 03 ELDERS + GRANDPARENTS

Sixty plus.

PHONE // VOICE // TV // POST
  • Honestly -- don't answer your phone. If it's important they'll leave a message. Call back on an office number you look up online.
  • Urgency is the scam. Real institutions wait. No email is urgent. Jot it down, mention it at dinner, reply in the morning.
  • Install every spam filter known to man. Leave them on.
  • Microsoft never calls you. Neither does Apple. Or Telstra.
  • Your bank never asks for codes or to "move money to a safe account".
  • A voice on the phone in distress sounds like family because it might be cloned.
  • Agree a family safe word today. Verbal. Never stored digitally. Not a birthday, home town, pet name, school, or mascot. Nothing obvious. Must stand out and never cause confusion in a panic.
  • Never give remote access to anyone who rang you.
  • Speaking up early -- to family, to police -- is the only protection.
SECTION FIG. 07 / 08 DO THIS // STAGED PLAN
Three stages. Start today.

Do this this weekend.

STAGE01 // FREE

This weekend.

TIME~2 HOURS
COSTAUD 0
  • MFA on email, banking, socials (authenticator app)
  • Install Bitwarden Free + import passwords
  • Set a SIM PIN on your phone
  • Update every device tonight
  • Switch on Find My / Find My Device
  • Agree a family password
  • Talk to elderly relatives about voice cloning
STAGE02 // SMALL SPEND

This month.

TIME~1 EVENING
COSTAUD 100-200
  • Buy one YubiKey 5C NFC (~AUD 90) for primary email
  • Subscribe iCloud+ or Google One 200GB
  • Run a Have I Been Pwned check on every email
  • Privacy audit each social account
  • Remove apps you haven't opened in 90 days
  • Request port-out protection from your telco
// YUBIKEY LINKS
yubico.com/au/product/yubikey-c-bio
pcmag.com/reviews/yubico-yubikey-5c-nfc
amazon.com.au/dp/B08DHL1YDL
STAGE03 // HARDEN

This quarter.

TIME~1 AFTERNOON
COSTAUD 200-500
  • External SSD for offline 3-2-1 backups
  • Replace the router if 5+ years old
  • Bitdefender or Norton 360 for mixed Windows homes
  • Move kids' IoT toys to the guest network
  • Annual ID document scan + secure-vault upload
  • Plan the family "if I'm scammed" call tree
SECTION FIG. 08 / 08 RESOURCES // BY COUNTRY
Phone numbers and websites that work

When it happens.

Bookmark these. Print this page if you have to. The faster you act, the better the outcome. Banks have very short reimbursement windows -- minutes, not days.

// EMERGENCY
Triple Zero
000
Immediate danger. Police, fire, ambulance.
// SCAM REPORT
Scamwatch / NASC
scamwatch.gov.au
National Anti-Scam Centre. Report any scam.
// CYBER INCIDENT
ReportCyber
cyber.gov.au
ASD. Hacks, account takeover, ransomware.
// IDENTITY THEFT
IDCARE
1800 595 160
idcare.org
Free identity recovery support.
// KIDS + ABUSE
eSafety Commissioner
esafety.gov.au
Cyberbullying, image-based abuse, sextortion.
// SMS SPAM
ACMA Spam Service
Forward to 0429 999 888
Send the dodgy SMS, then delete it.
// BANK DISPUTE
AFCA
afca.org.au
1800 931 678
Financial complaints authority.
// ATO IMPERSONATION
ATO Scam Report
1800 008 540
Tax office scam line.
// EMERGENCY
NZ Police
111 emergency / 105 non-urgent
Crime reports, immediate danger.
// SCAM HELP
Netsafe
netsafe.org.nz
Text 4282 / 0508 638 723
7 days a week. Free advice + reporting.
// CYBER INCIDENT
NCSC (was CERT NZ)
ncsc.govt.nz
National Cyber Security Centre.
// IDENTITY THEFT
IDCARE NZ
0800 121 068
idcare.org
Free identity recovery, NZ branch.
// SMS SPAM
DIA
Forward to 7726
Department of Internal Affairs.
// BANK DISPUTE
Banking Ombudsman
bankomb.org.nz
0800 805 950
Disputes after your bank's first response.
// KIDS + ABUSE
Netsafe (image abuse)
netsafe.org.nz/harmful-digital
Harmful Digital Communications Act takedowns.
// TAX
IRD scam team
ird.govt.nz
Report IRD impersonation directly.
// EMERGENCY
911
911
Immediate danger only.
// CYBER CRIME
FBI IC3
ic3.gov
Internet Crime Complaint Centre.
// FRAUD / ID
FTC
reportfraud.ftc.gov
identitytheft.gov
Federal Trade Commission.
// INFRASTRUCTURE
CISA
cisa.gov
Cybersecurity + Infrastructure Security Agency.
// CA STATE
California Attorney General
oag.ca.gov/report
Consumer complaints, privacy, fraud.
// CA FINANCE
DFPI
866 275 2677
dfpi.ca.gov
Department of Financial Protection.
// KIDS + ABUSE
NCMEC
cybertipline.org
takeitdown.ncmec.org
Sextortion, CSAM, image takedowns.
// ELDERS
AARP Fraud Watch
877 908 3360
aarp.org/fraudwatch
Free helpline for elder scam victims.