A new GSMA report names AI-enabled fraud as the defining threat to Southeast Asia’s digital economy. For association leaders, the report is an entry point. The real question is who convenes the response — because no single industry can solve it alone.
ASEAN — On 4 September 2026, GSMA’s (Global System for Mobile Communication Association) Digital Nations ASEAN 2026 report declared digital trust essential to the region’s digital development — and set out why. AI-enabled phishing, deepfakes, voice cloning and impersonation are scaling faster than the defences of any single institution, and the report calls for cooperation among governments, telecom operators, financial institutions and digital platforms.
For Association Commons readers, the announcement is not the story. It is the entry point. The story is what happens after a report like this lands: whether the institutions that diagnose a cross-sector problem become the institutions that convene a cross-sector response.
The Problem Belongs to Everyone, Which Means It Belongs to No One
Follow a scam and you see the fragmentation. A cloned voice message is generated on a digital platform, travels over a telecom network, ends in a bank transfer — and the victim is left with a loss no single organisation licensed, caused or can reverse. Responsibility is divided between the operator that carried the call, the bank that released the funds, the platform that hosted the content and the regulator that licensed all of them. In ASEAN, divide it again across ten national jurisdictions.
No industry owns this problem. Telecom operators alone cannot stop deepfakes; banks alone cannot verify every call; platforms alone cannot police every message; regulators alone cannot keep pace with either the technology or the borders. That is exactly why digital trust has become an association question. Associations are among the few institutions with a mandate to talk across member lines — and the only ones positioned to bring competitors and governments into the same room on a shared problem.
“Publishing a warning is safe. Convening competitors and governments around shared action is not.”
Thought Leadership Is Not Industry Leadership
The GSMA report is a strong piece of thought leadership. But for the associations that will be asked to act on it, the distinction that matters is the one the report exposes: producing insight is not the same as producing change.
Publishing a warning is safe. Convening competitors and governments around shared action rather than simply publish warnings is not. It requires asking members to share intelligence they would rather keep, to accept standards they did not design, to take responsibility for failures they can blame on another link in the chain — and, sooner or later, to incur costs. Every association leader can point to reports that named a problem and stopped there. This story is about whether associations can convert concern into commitment: common standards, data-sharing arrangements and member obligations that make “digital trust” operational rather than aspirational.
The Question Nobody Answers in Public
Everyone can agree publicly that cooperation matters. The more interesting question is what cooperation costs — and what data and intelligence the parties are genuinely prepared to share.
Telcos hold signalling data; banks hold transaction data; platforms hold content data. A detection signal that is useful to one party is valuable to the other two and competitively sensitive to all three. Can an operator share fraud patterns with a rival without exposing commercial information? Can a bank share a scammer’s account patterns with a platform whose compliance it distrusts? Who decides what is shared, on what terms, under whose governance?
This is where an association earns its keep — or fails. Its convening power is real only to the extent that it can broker answers: what members will share, what standards they will accept, what they will fund together, and what they will be held to.
Cooperation Must Be Measurable
Associations that want to move from statement to commitment need outcomes they can count: scams blocked at network level, the share of verified communications reaching consumers, confirmed-caller and branded-messaging adoption, consumer confidence tracked over time. None of these are easy metrics. But without them, cooperation remains a communiqué; with them, it becomes a contract members can be held to.
Who Is Accountable When Cooperation Fails?
The final question is the one the report does not answer: when a consumer loses money to a deepfake scam, who is accountable — the operator that carried the call, the bank that released the funds, the platform that hosted the content, or the regulator that set the rules? In most markets today the honest answer is “unclear” — and unclear accountability is the strongest incentive to do nothing.
Associations cannot be the referee. They can, however, build the mechanisms that make shared responsibility explicit before failure rather than after it: clear allocation of duties across the chain, agreed incident-response protocols, and a public account of who did what when a scam got through.
What We’ll Report Next
To test whether this is a story about convening rather than warnings, we will take the same four questions to GSMA, an ASEAN telecom operator, a bank and a consumer-protection representative: how much intelligence each party is genuinely prepared to share with competitors, and on what terms; which common standards can realistically be agreed and enforced across sectors; what measurable results would prove that cooperation is working; and where responsibility falls when cooperation fails. Their answers will determine whether digital trust becomes an association issue in practice — or remains a technology issue with better branding.
