Albert*, a 68-year-old retiree in the Philippines, was struggling to log into the country’s Social Security System app in August last year when a man rang to offer help. The caller said he worked for the government pension fund, the website was down for maintenance and a new app had just been rolled out. To prove he was genuine, he sent Albert his full name, Social Security number, and home address over the Viber messaging app, followed by a link to the “new” app. More than an hour after Albert...