Cyber fraud risks rise as focus shifts to obsolete technology

International Fraud Awareness Week has prompted renewed emphasis on the dangers of overlooked and retired technology, as well as the growing sophistication of fraud in the digital era. Security and technology leaders are highlighting persistent gaps in organisational defences, and urging a more holistic approach to fraud prevention that extends beyond live systems and basic cyber hygiene.

IT asset risks

Stuart Dahlenburg, General Manager of Asset Lifecycle Management for Iron Mountain Asia Pacific, points to legislative developments and operational practices that put organisations at risk. Dahlenburg notes that Australia's Scams Prevention Framework Act signals a shift: scam mitigation now carries explicit compliance and governance duties for businesses, technology companies, and telecommunications providers.

"International Fraud Awareness Week is a timely opportunity to widen the lens beyond live systems, and scrutinise the risks created by the technology we retire. Australia's passing of the Scams Prevention Framework Act earlier this year is a timely reminder of the shared responsibility of businesses, tech giants and even telcos to prevent, detect, disrupt, respond to, and report scams. Backed by penalties of up to AUD $50 million and ACCC enforcement, the Act marks a significant shift: scam prevention is now an explicit compliance and governance duty for these organisations."

Dahlenburg warns that end-of-life IT assets often receive inadequate attention, creating latent vulnerabilities. According to recent research from Iron Mountain and Foundry, 56% of IT decision-makers rank end-of-life data exposure as a significant concern; yet, organisations allocate just 5% of their security budgets to IT asset disposition (ITAD). Business leaders estimate the average cost of a breach tied to poor ITAD practices at USD $27.1 million.

"The sad reality is that many business and IT leaders treat end-of-life IT assets as an inconvenience, tucking them away in a storeroom or throwing them away like rubbish. Those forgotten devices can become latent vulnerabilities, ripe for exploitation by insiders or external actors," said Dahlenburg.

He describes how underinvestment in ITAD leaves organisations exposed to fraud and data misuse. Dahlenburg advocates an ongoing, strategic approach to ITAD that aligns with security and regulatory requirements, rather than a periodic compliance exercise.

"Fraud isn't static. Today's bad actors have evolved, and they know how to exploit what's abandoned, not just what's live. So, what's the solution? Smart businesses will see ITAD as an "always on" responsibility, rather than a compliance box that's checked once a year. It's time to make secure, transparent, and sustainable disposition part of technology and business strategy for all Australian businesses," said Dahlenburg.

Digital vigilance

Erich Kron, CISO Advisor at KnowBe4, emphasises the human factor in fraud prevention. He cites fresh data demonstrating that user awareness and ongoing training sharply reduce susceptibility to phishing scams.

"This Fraud Prevention Awareness Week is a timely reminder that personal vigilance and organisational defence go hand in hand. Strong digital hygiene doesn't happen by accident. It requires ongoing awareness and consistent training. Our 2025 Phishing Benchmark Report shows that while 33.1% of users initially fall for simulated phishing emails, that figure drops to just 4.1% after a year of cybersecurity education and training," said Kron.

Kron underscores the value of integrating security into organisational culture, encouraging employees to take an active role in detecting and reporting suspicious activity. "By embedding security into the culture of an organisation, employees become part of the solution. Encouraging people to report suspicious messages, use strong and unique passwords, and question what doesn't look right helps create a workplace where security becomes part of everyday practice," said Kron.

He summarises: "Fraud prevention starts with each one of us. By staying alert, speaking up, and supporting one another, we can detect fraud early and stop it before it causes harm."

Identity security

Nigel Tan, APAC SE Director at Delinea, highlights the prevalence of identity-related fraud in Australia. Nearly 30% of self-reported cybercrime cases are now tied to identity issues. Tan stresses the importance of basic controls such as unique passwords and multi-factor authentication.

"Identity fraud is now the top self-reported cybercrime affecting individuals in Australia, accounting for almost 30% of cases. That tells us something important: scammers don't need highly sophisticated methods when the basics of identity security are still being overlooked," said Tan.

He notes that enhancing digital identity management is central to reducing risks for both individuals and businesses, as many attacks begin with simple credential misuse. "A few simple changes make it significantly harder for criminals to impersonate you - and far easier for all of us to stay safe online," said Tan.

Cloud challenges

Adhil Badat, MD at Rackspace Technology, addresses the impact of cloud adoption and AI on fraud risk. Cloud migration and the integration of AI are changing the way fraud is detected and defended, yet skills shortages and gaps in governance persist.

"As cloud adoption accelerates, fraud is becoming more sophisticated and harder to detect. International Fraud Awareness Week is a timely reminder that digital transformation must be matched by fraud resilience," said Badat.

He refers to Rackspace's State of Cloud Report, indicating that although AI is now central to cloud strategies for 84% of organisations, half still identify security as the main barrier to effective cloud management.

"Fraud is no longer just a security issue, it's a strategic risk. Organisations need to move beyond reactive controls and embed fraud awareness into cloud governance, employee training, and operational culture. As AI continues to reshape how businesses operate, fraud prevention must evolve in parallel, not as a compliance checklist, but as a core part of digital maturity," said Badat.