A webpage opens on a smartphone in Jakarta. It says money is waiting. 1 million rupiah, roughly 60 U.S. dollars, sent by someone named WILDAN, held at the gate until the recipient completes a quick security step. The page wears the blue and white of a card network. It uses the right words. Verifikasi Visa Secure. It asks, politely, for permission to turn on the camera. Face and location, it explains, are used for identity verification to keep the transaction safe.

The person taps allow. They are watching for the money. They never see the camera turn on, because the page hides its own video feed. Behind the frozen loading screen, the front camera is already running. Every 2 seconds it grabs a still and ships it to a Telegram bot. Then it asks for the microphone. Then it takes 20 more photographs and records 10 short videos, 5 seconds each, and uploads every one to the Telegram bot.

There was never any money. There was never a WILDAN. The security step was the robbery, and what it took cannot be canceled, reissued, or reset. Let me introduce you to camera-first phishing. Some may show you how the machine works. They will not tell you how to survive it. That part is ours.

The Playbook Has Changed Its Target

For 30 years, phishing wanted one thing: a string you typed. A password, a card number, a one-time code. The whole defensive industry grew up around that assumption. We built password managers, we forced resets, we bolted on multi-factor authentication, we taught people to hover over hyperlinks. All of it rests on a single quiet premise. Whatever the criminal steals, you can change. A leaked password gets rotated. A cloned card gets a new number in three business days. The stolen credential has a shelf life, and the reset button is the escape hatch.

Camera-first phishing throws that premise out. It does not ask you to type anything. It asks for a browser permission, and it uses the same legitimate features that power your video calls and your map apps: getUserMedia for the camera and microphone, the Geolocation API for your position. There is no exploit here, no vulnerability to patch. The attacker is not breaking the browser. The attacker is asking, and you are consenting, because the request is dressed as the last step between you and your money.

What it harvests is a different class of thing. A live capture of your face, from several angles, under a background that flips between white and grey to sharpen the image, a trick the code itself labels a strobe flash. Short videos with sound. Your GPS location. Your IP address. Your device and browser fingerprint. Why does a criminal wants that bundle instead of a card number? A stolen password can be reset, a stolen card can be canceled, but a collection of facial images, short videos, location data, and device information is far harder for a victim to recover from. You cannot rotate your face.

And there is a buyer for it. FinCEN has already warned banks that criminals are using deepfake photos and videos to defeat identity checks. We routinely watch underground markets trade in exactly this material, faces and clips sold to bypass the selfie and liveness gates that banks, exchanges, and payment apps now treat as "proof" of a human being. Your face is not being stolen to log in as you today. It is being stockpiled to become you later, at the account-recovery screen, at the new-account gate, in a video call to your own daughter.

Why This Reaches Your Build, and Your Family

If you build products, read this next part as a threat model, because your own defenses are the reason the face is worth stealing. The last five or six years of fraud engineering pushed the industry toward biometric proof. Selfie onboarding. Liveness detection. Match the photo to the ID. We told users this was the strong gate, the one a password thief could not walk through. Camera-first phishing is the market's answer to that gate. It is a supply line. Every face it farms is raw material aimed at defeating exactly the liveness check you just shipped. When your verification rests on something the user cannot change, a breach of that something is permanent, and you have quietly converted your customers' bodies into single-factor credentials with no reset path. Build accordingly. Assume the selfie is spoofable, layer device and behavioral signals underneath it, and never let a face be the only thing standing between an attacker and an account recovery.

If you do not build anything, read it as a family problem, because that is where it lands. The bundle harvested from one tap, your face, your voice, your location, is the exact starter kit for a synthetic video call. The FBI logged more than 3,100 complaints referencing AI-powered scams from older Americans alone last year, with losses above $352 million dollars. The grandparent scam used to need a panicked voice on a phone. Now it can wear your face. The person most likely to be fooled by a deepfake of you is not you. It is someone who loves you and will not pause to doubt the image. Their safety depends on a credential the criminal cannot fake, and you have to set it up before you need it. We will get to that in the Field Manual.

Meanwhile, the System Reached for the Same Answer

While the camera-first kits spread, Washington moved on the other end of the same problem, and it is worth watching because the legislators landed on the exact primitive this letter has preached for 109 issues. On June 25 the House passed the Financial Exploitation Prevention Act by a vote of 414 to 2. It amends the Investment Company Act of 1940 to let mutual funds and ETFs pause a suspicious redemption when they reasonably believe an older or impaired investor is being exploited. The hold runs up to 15 business days, and up to 25 if investigators confirm it. The whole mechanism is one idea: introduce a delay, and let the delay break the urgency the scammer manufactured.

The numbers behind the bill explain the 414 votes. The FTC put losses among Americans 60 and older at 2.4 billion dollars in 2024, a 300 percent jump from 600 million in 2020. The FBI's 2025 tally is worse: 201,266 complaints from that age group, 7.7 billion dollars gone, a 59 percent surge in a single year, an average loss of 38,500 dollars, and more than 12,400 seniors who each lost over 100,000. Jeff Carpenter, who runs a credit union in Oklahoma City, gave the defense in one line. Whenever there is a sense of urgency, you have to pause. Pausing is the most important thing.

Hold that next to the Jakarta page. Money is waiting. Verify now to release it. That is engineered urgency, the same accelerant the bill is built to counter, aimed at a single person with no compliance department to slam the brake. The lawmakers can legislate a pause for a mutual fund. Nobody can legislate one for the tap in your hand. That one you install yourself, and it is the whole game.

Field Manual

Six controls for the camera-first age. The answers the teardown left out.