9 November 2026 | About an 8-minute read
Four very different publications landed on our desk this week, and they kept pointing at the same uncomfortable truth: we still talk about scams and social engineering as if the damage were measured in pounds and dollars, when the deeper costs are measured in shame, silence and misplaced confidence. The UK's national cyber agency says people remain the attackers' favourite way in. Fresh telemetry shows scams have now overtaken phishing outright. New victim research also puts hard numbers on what happens after the money goes, which is where most of our programmes stop looking. Plenty to work with, so let's get into it.
The NCSC's year in review: people are still the way in
The National Cyber Security Centre published its Annual Review 2026 on 3 November, covering September 2025 to August 2026, under the pointed subtitle "The State of the Cyber Nation". The headline figures: 1,831 reports of cyber attacks affecting organisations, 337 incidents serious enough to need NCSC support after triage, 80 of those classed as nationally significant, and around 8,500 organisations tipped off about suspected compromises through the Early Warning service.
The part that belongs on your wall is the review's list of seven things the NCSC learned this year. Number one: attackers exploit the basics. Number two, in the agency's own words, is that "people remain the target", with social engineering, credential theft and security culture named as the recurring threads. The review's blunt summary is that most successful attacks still exploit familiar weaknesses, and it counts informed, vigilant staff among the most effective ways to reduce both the likelihood and the impact of incidents.
What does this mean for me? This is the most citable document a UK-facing human risk leader will get all year, and it carries weight well beyond the UK. When the national technical authority, sitting inside GCHQ, lists people and security culture in its top findings, that is budget-conversation material. Use the "familiar weaknesses" framing with your board: not novel AI wizardry but known doors left open, which is an argument for sustained behavioural work rather than one-off novelty. And note the pairing the NCSC makes: social engineering sits next to credential theft, so awareness work lands best when it travels with credential protections such as passkeys and phishing-resistant MFA, not instead of them.
Source: NCSC Annual Review 2026, published 3 November 2026. Read it here.
Scams overtake phishing, and they outrun our takedowns
Akamai's 2026 fraud and abuse report, published 29 October under the title "AI-Driven Digital Deception", contains a genuine inflexion point: in the first quarter of 2026, online scams overtook traditional phishing in Akamai's detections for the first time, roughly doubling from about 3.2 million to about 6.4 million. At the same time, the average lifespan of a phishing attack dropped by more than half, from 48 days in late 2025 to 22 days by mid 2026, as attackers rotate infrastructure fast enough to stay ahead of static blocklists. Nearly 70 per cent of the phishing Akamai observed impersonated trusted brands, with high-tech names alone accounting for 41.6 per cent.
The usual caveat applies with vendor telemetry: these are detections across one company's (admittedly enormous) slice of global web traffic, not a census. The direction of travel is still hard to argue with, and it matches what other observers reported this autumn.
What does this mean for me? The quiet assumption behind much awareness advice is that bad infrastructure is durable: spot it, report it, and a takedown protects the next person. When a scam site lives for three weeks, and its replacement is registered in bulk before the takedown lands, reporting remains valuable but can no longer carry the load. The behaviours worth drilling are the ones that survive infrastructure churn: going direct to the brand's own app or typed address rather than following links or search ads, and verifying unexpected requests through a channel the person already trusts. The brand impersonation figure also offers a teachable line: the more a page leans on a logo you love, the more that logo does the attacker's work.
Source: Akamai press release for its State of the Internet fraud and abuse report, 29 October 2026. Read it here.
The scam does not end when the money goes
The Identity Theft Resource Center, the US non-profit that supports victims of identity crime, released its 2026 Consumer Impact Report in late October, built on two surveys run in August and September: 197 people who had contacted the ITRC for help, and 1,111 US adults, 798 of whom had experienced an identity crime or scam at some point. The findings on scam victims specifically are bruising. Some 87 per cent agreed the crime was partly their own fault. Among the scam victims surveyed, 80.5 per cent reported experiencing suicidal thoughts afterwards, against 24.5 per cent of traditional identity theft victims, a gap the ITRC attributes to the manipulation and betrayal involved in scams. The practical fallout ran deep too: 20.4 per cent of scam victims reported bankruptcy (against 8.8 per cent for identity theft) and 12.3 per cent lost a job. And when victims sought help, 87.9 per cent said at least one organisation they approached simply never responded.
The samples are small and self-selected, as victim research tends to be, so treat the precise percentages gently. The pattern, though, is consistent with years of fraud psychology work: scams wound differently because the victim participated, and shame does the attacker's clean-up.
What does this mean for me? Read that self-blame figure as an operational risk, not just a sad one. The colleague who clicked, paid or shared is sitting on the same psychology, and every hour of silence is an hour of attacker dwell time. The moment someone reports their own mistake is the single most culture-defining interaction your programme owns: if you meet it with warmth and speed, you buy faster reporting from everyone they tell. It is also worth checking what your organisation actually does when an employee is scammed in their private life, since signposting to real support (and warning about follow-on "recovery" scammers who prey on desperate victims) is cheap, humane and quietly builds the trust your reporting culture runs on.
Source: ITRC 2026 Consumer Impact Report, as covered by Digital Transactions, 28 October 2026. Read it here.
Confidence is not a control: the view from Asia
The Global Anti-Scam Alliance published its State of Scams in Asia 2026 study on 22 October, ahead of its summit in Bangkok this week. Opinium surveyed 17,460 adults across 13 Asian markets between mid-March and mid-April, from India and Indonesia to Japan and South Korea. Seventy-one per cent had encountered a scam in the past year, with estimated losses across the markets of US$136.5 billion. The detail worth pinning up: 66 per cent of respondents said they were confident they could recognise scams, yet 62 per cent of those who encountered one interacted with it. Phone calls were the most common channel (56 per cent), ahead of text messages (50 per cent) and messaging apps (40 per cent). Strikingly, 71 per cent supported allowing banks to block suspected high-value scam transactions without the customer's prior permission, and 69 per cent said the same for telcos and messaging apps blocking suspicious calls and messages.
Worth knowing when you quote it: the research was produced with Gogolook, which sells a call-screening app, and the loss figures are survey-based extrapolations. The behavioural findings are the sturdier cargo.
What does this mean for me? That confidence gap is the same one European and American studies keep finding, now replicated at serious scale in Asia, and it is a standing argument against using self-assessed confidence as a programme metric. Measure what people do, not what they predict about themselves. For anyone running programmes across APAC, the channel mix matters: this is a phone-first scam environment, so awareness built around email will miss where your people are actually being hunted. And the public appetite for banks and telcos applying protective friction by default is a useful signal that well-designed friction is not the customer-experience villain it is often assumed to be.
Source: GASA and Gogolook, State of Scams in Asia 2026, 22 October 2026. Read the release here.
Until next week
A heavy week in places, but a useful one. If you take one thing into Monday, make it this: somewhere in your organisation is a person who clicked something last week and has not told anyone yet. Everything in this edition, from the NCSC's seven lessons to the ITRC's self-blame numbers, says the cheapest control you own is making that conversation easy. See you next week.
The CyBehave Weekly Briefing is researched and written for human risk, security awareness and behaviour change professionals. Forward it to a colleague who would find it useful.