AI Fraud Is Sweeping Southeast Asia. Korea Is Next.

We held a Bloom meetup with Fred on financial security and fraud in the age of AI. Fred runs Level Five Group, a Singapore company that detects financial security threats in Southeast Asia (Thailand, Malaysia, Indonesia, Cambodia) as well as Japan and China. Fred has been coming to Korea at least once a month while preparing to expand here, happened to drop by a Bloom meetup, and that's how we ended up planning this event together.

It was a short session, but it hit hard. In Southeast Asia, AI can now copy the tone of someone's voice in just four seconds, and that's being abused everywhere from voice phishing to bank fraud. It made me look again, with real alarm, at how AI-powered voice phishing has already become a serious form of cybercrime.

We put it together in a hurry and expected about 30 people, but more than 45 showed up. That told me how much interest and need there is around this topic. Fred's talk was deep but easy to follow, and I learned a lot too.

What Fred most wanted to know was how fraud differs from country to country depending on culture and economy, and what patterns show up in Korea. Fred wanted to meet people actually working in the field rather than read research reports, so we kept it small and invited only people in related fields. That meant we could sit close and have real conversations.

Korea is still seen as a relatively safe country, and with privacy concerns, building a response system on user data may be a bit early here. Even so, global players are already paying close attention to the Korean market and getting ready. Here's what I heard that day, in order.

Four seconds is all it takes

Fred opened with a joke. When I'd told Fred about Bloom, Fred said they loved the story of going from AI blue to Bloom, and then added:

Unfortunately, my line of work is on the AI blue side.

Fred has spent more than ten years on financial crime for banks, has worked with the Royal Thai Armed Forces, ASEANAPOL and Malaysian regulators, and runs a bank consortium in Thailand. The fun part is that Fred dropped out of engineering school, went back in for accounting and finance, and started the company in their final year. Asked why they dropped out, Fred said they partied too much, and when they started they knew nothing about cybersecurity or fraud. There was pressure about graduating four or five years behind everyone else, so Fred started the company while still in school. This is year eleven.

The talk began with a public service ad made by the Chinese government. A mother is on a video call with her daughter. The daughter says money is tight this month and begs her to send some. Just as the mother types in the account number and is about to hit send, the doorbell rings. She opens the door and her real daughter is standing there, while on the laptop someone is still talking with the daughter's face and voice.

If a government made an ad like that to warn its own people, it means this is common. The number that came next was the most striking thing I heard that day.

All it takes to clone a voice is four seconds.

They copy the tone, not the voice

I thought voice cloning meant collecting 30 minutes to an hour of audio, feeding it to an AI and running it for a long time. Like in Mission: Impossible.

We're not recreating your entire voice profile. We're only imitating the tone and timbre.

So they pull out just the tone from four seconds of audio, and then a real person uses a voice changer to speak in their own manner on top of that tone. If you want to sound like Trump, you don't need to pronounce things like Trump. You take Trump's voice profile and just copy the way he talks. Fred demoed it on the spot, and it was pretty convincing.

That's why live-call deepfakes sound so natural. It's a person talking, not a machine.

As for where they get the voices, it's mostly social media: TikTok, Facebook, X, Threads, YouTube, TV. They also run robocalls, record people saying "Hello? Who is this?" and sell the recordings on the dark web. So Fred's advice was that unless you're a public figure, set all your profiles to private and don't post videos of yourself online.

There was a point about Korea too. Because Korea is a net exporter of K-pop and K-entertainment, it has the most mature voice cloning models in the world. Thailand doesn't have nearly as much content as Korea, so cloning is actually harder there.

Impersonation is still the most common

Starting with the flashiest technology, there's deepfake investment fraud. They make videos of someone posing as Elon Musk promoting a coin, spread them on social media and even run ads. In Singapore, there was a live Zoom call with someone impersonating the prime minister, inviting people into a "government-backed investment opportunity." It's not the most common kind, but it takes the most money in one hit.

The most common is still plain impersonation calls: people pretending to be the government, the police, immigration or a company, often with a romance scam on top. The root of it is data leaks. My information has leaked somewhere, so the caller can talk as if they know me.

Fred's own story was a good one. Right after getting Singpass (Singapore's national digital ID) approved, Fred got a robocall from someone posing as Singapore's immigration authority.

The moment they asked, "Do you speak Chinese?", I knew it was fake.

The real immigration authority would never need to ask that. Fred played dumb and kept going in Mandarin, and the caller said there was an error with Fred's employment pass and demanded 33,000 Singapore dollars. Even someone whose job is stopping fraud gets targeted. One recent case Fred handled was 4 million ringgit, roughly $1 million.

One vacation post, and a company got breached

I'd been hearing this as a story about individuals losing money, and then it shifted. A security head at a large company posted on social media that they were going on vacation, and their profile was public. The attacker cloned their voice from their videos, then, while they were on vacation, called an employee pretending to be them, said their system credentials were locked, and asked for the OTP.

From the employee's side, the voice matched, the vacation was real, and even the details about the vacation spot lined up naturally, so they reset it. They noticed something was off soon after and caught it, but it was already too late.

Ten minutes is plenty of time to plant a backdoor.

Six months later, an actual breach came through that backdoor. Voice phishing doesn't stop at scamming individuals anymore. It's becoming a door into company systems.

99 percent is a lab number

Then there's detection. In a controlled environment, it catches more than 99 percent, but that's when the recording is made in a quiet room with perfect audio. In the real world, network quality strips away the signals detection needs, so it drops to 50 to 60 percent. That's why fraudsters deliberately hide behind bad networks. Southeast Asia still has 4G and 3G.

You might think 50 to 60 percent isn't bad.

But think about how many transactions a bank handles in a day. Everything that doesn't get filtered out has to be reviewed by a human. No bank can staff that.

The room went quiet at this point, and that's when I finally got it. The technology exists. The operations can't keep up.

99 percent is a great number. Is it operationally practical? No.

What banks need is a number like 99.999 percent. Since that's out of reach, the bottleneck is the bank's fraud operations team, not the technology.

So they look at the phone, not the face

Trying to catch deepfakes is a good starting point, Fred said, but you can't stop there. They look at something else.

The most important thing to watch in the digital economy isn't the person. It's the phone that person is using.

Is it an iPhone or Android? Does the screen resolution match the device? Is it jailbroken or rooted? Is developer mode on? Behavioral biometrics go on top of that. If the phone doesn't move at all at the moment of a transaction, that's strange. If the phone is lying face down on a desk charging and a payment goes through, something is wrong with that phone.

The details were fascinating. Nobody has to think about how to type their own name, so they check whether you hesitate when entering your name. You might paste your address, but nobody pastes their own name and phone number, so they watch for copy and paste too. They also check whether you're on a call during a banking transaction. Young people are always on calls, so it's a weak signal for them, but for older customers it's a strong one.

The eKYC bypass known as camera injection was simpler than I expected. You jailbreak a phone, play a deepfake video on a high-definition TV, and point the camera at it. The app decides it's the real person.

So I asked whether a bank can tell if the person calling in is really the customer.

Honestly, no.

They ask for your ID number, the last digits of your card and your phone number, but all of that has already leaked. So Malaysia tied accounts to a physical device the customer owns, and if you undo that binding, the account is frozen for 24 hours. Fred added, though, that an engineer can undo the binding and move it to another phone.

One bank can't do it alone, however good it is

The most important part of the day was about where to cut fraud off.

The way to stop fraud is to stop the money from moving. Fighting the fraudsters won't get you there.

Shut down the mule accounts and the fraud stops. Whether you steal a billion won or a trillion, if you can't pull the cash out of an ATM, nobody bothers.

The problem is that one bank can't do this alone. Even if the same phone committed fraud at Bank A, Bank B has no idea, because the two accounts have nothing to do with each other. But if Bank A passes that device fingerprint to Bank B, Bank B can freeze the account the moment that phone logs in. Even better, every other account that phone has touched gets exposed too. One device reveals the whole network of mule accounts.

Some countries already do this. The UK builds a list of confirmed fraud based on device IDs, and a device caught at one bank gets shared with every member. Australia uses behavioral biometrics to score the receiving account before a payment goes through. Singapore wrote it into law: past a certain threshold, phone numbers and account numbers have to be shared.

This is what Fred is doing in Thailand. At a meeting hosted by Bangkok Bank, 30 people from 11 banks got together, the first fraud consortium in the banking industry there. Fred sat in the room as the only person who wasn't from a bank, persuading the banks to share data. Fred said a pilot for sharing device fingerprints with two tier-one banks is starting soon.

Who eats the loss decides the investment

When we asked what breaks first at a bank, Fred brought up a case they had shared with Interpol. The victim lost hundreds of thousands of dollars. Police tracked down where the criminal was staying and broke down the door, but there was nobody there, only computers. There was a crime scene, and nothing the police could do. So the victim asks the bank for compensation, and the bank has a point: the customer made the transaction themselves.

Why do banks come together, then? The answer was clear. About nine years ago, Fred took this idea to a tier-one bank and was told, "Our fraud losses are only $30,000." A single case involving that bank in the news had been several million dollars, so Fred thought that made no sense. Much later, after many more conversations with people at banks, Fred figured out why.

We're not liable for those losses, so we don't record them as fraud.

The customer sent the money themselves, so it's the customer's fault, and on the bank's books it isn't fraud. Then Southeast Asian regulators changed the rules so that banks have to cover 50 percent of the loss whether or not the customer was scammed. That changed the math completely.

Now do you have a reason to invest in the technology?

We'd spent all that time listening to talk about technology, and in the end it was accounting that decided things.

Korea is behind on regulation, not technology

Asked whether Korean banks are ready, Fred said this.

Korean banks have started investing in fraud detection technology. Where they're behind is regulation that lets them use customer data for fraud prevention.

Collecting behavioral biometrics or device data is technically legal in Korea. But banks don't want to take on the privacy risk to do it. So they keep asking, again and again, whether they need customer consent to collect the data.

Thailand has already gone through this. Under Thailand's original data privacy law, even an IP address counted as personally identifiable information. But when fraud got out of control, the central bank changed the rules so that you have to provide personal information to use a banking app. Regulation moves only after big losses.

In Europe and the US, transfers take two or three days instead of happening in real time. We find that delay frustrating, but it helps against fraud. Even if you see the alert two days later, you can contact the clearinghouse and reverse the transaction. Korea and Southeast Asia process transfers instantly, so there's no window.

The regulatory standards themselves differ by country too. Thailand originally treated IP addresses as personal information, while Europe's GDPR doesn't count devices as personal information. Some places can use the same data and some can't.

Fraud leaves countries that crack down

At the fireside chat, when someone asked who's behind all this, Fred answered:

Where there's money, there are always criminals. If you think about it, these people are entrepreneurs too. In the end, they're businesspeople.

Fred has talked with former crime bosses and said that when they weren't committing crimes, they were charismatic and nice people. Fred said corruption is a big part of fraud too, then immediately added the caveat that this isn't a legal finding, just suspicion.

It really is an industry. It's not some kid in a garage fooling people from a MacBook. It's a company with a cafeteria, restaurants and even a bowling alley for staff. Fred said "No More Bets", a Chinese film, is set in a real scam center.

When we asked if Singapore is safe, Fred said its banks have good defenses. So attacks actually fall back on the basics. Getting hold of government data and impersonating the police is one of the biggest sources of losses in Singapore.

Singapore is a country where everyone follows the law. If I can just make you believe I'm the police, you'll do what I say.

In Malaysia, people just hang up when someone claiming to be the police calls, so the same trick doesn't work well there. Culture was deciding the tactics, more than the level of defense.

The scariest part of this section was a story about someone who escaped a scam center in Cambodia. They went to a police station in some country, and the police sent them back to the scam center. Several Koreans were recently rescued from those centers too.

In the last question, we asked what Fred most wants to know about the Korean market. Fred said they want to understand what Korea's real fraud problem is, and then gave the answer I most wanted to hear.

Fraud is moving to Korea now because enforcement in the rest of Asia is getting tougher.

They ran big operations in the Philippines, moved to Thailand when the crackdown came, then moved to Cambodia when the Royal Thai Armed Forces cracked down. They keep moving to wherever controls are weakest.

So the fact that we don't feel there's much of this kind of fraud here yet may not mean we're safe. It may just mean our turn hasn't come yet.

Like the job of cleaning up horse manure

From the audience, someone who works in cybersecurity said that as LLMs improve, security tools are getting stronger too, but traditional software companies are feeling threatened. They asked how Fred sees it as the head of a company that builds security tools.

Some security companies will become meaningless. It's like how the job of cleaning horse manure off the roads disappeared when we went from horses to cars.

Fred doesn't see AI as replacing people, though. Fred sees it as compounding productivity, and pointed to penetration testing as a field with opportunity. Plenty of organizations worry about cybersecurity, but there aren't enough experts, so supply and demand are completely out of line. Once LLMs make it possible to run automated penetration tests all the time, that gap gets filled. Automating malware detection and network anomaly detection are worth watching too, Fred said.

Asked whether they've ever been threatened, Fred said they don't deal with criminals directly, but told a story about someone they know. This person hacked a bank's ATM system and pulled money out, then went to the bank and said, "There's a vulnerability here. Hire me and let me fix it." And they actually got hired.

The most down-to-earth story came from someone at a crypto exchange. The Korean government is extending its regulations from banks to crypto exchanges, with new rules taking effect in October, so they're building a new system and have to work with banks. In the end, a customer who wants to invest in crypto has to deposit money from a bank. Fred expects proof of assets and proof of source of funds to get stricter.

The next question isn't whether it's a human

I didn't set up this event because I was already into cybersecurity, but after listening, I can see this is a story about AI.

Something Fred said in passing has stuck with me: there's now AI that never sleeps and keeps searching for ways in. Ask regulators and they'll say detection rates are going up, but Fred said that's really just because there's more fraud, so more of it gets caught.

And there's one thing I keep coming back to these days. Right now, when you pay for something, the system checks whether you're a human. But once AI agents start paying on our behalf, the question changes. You have to verify that this is really an agent I own. Fred also said that the moment you hand credentials and permissions to an agent, a new attack surface opens up.

People stuck around for a long time after the event to keep talking. The founder of a deepfake detection startup talked about their detection rates, and someone who has done business in Malaysia said they're going back next month and agreed to connect with Fred.

Whenever I put together a room like this, I'm always the one who learns the most.

Originally written in Korean on Brunch, September 8, 2026.