The Internet Has an Identity Problem and AI Is About to Make It Much Worse

A message arrives offering exactly the opportunity you have been looking for. The company exists. The person contacting you appears to have a credible professional profile. The role fits your experience remarkably well and the approach contains enough personal detail to suggest that somebody has genuinely considered whether you might be suitable.

That should be reassuring. Increasingly, it may be precisely what should make us cautious.

The internet’s long-running problems with identity, impersonation and fraud are colliding with artificial intelligence. Scammers no longer need to send the same badly written message to a million people and hope somebody responds. Public information can be collected, analysed and transformed into personalised approaches at enormous scale.

The economics of deception are changing.

Personalisation used to be expensive

Traditional phishing relied heavily on volume. Send enough messages about parcel deliveries, tax refunds, bank accounts or lottery wins and eventually somebody will respond. The messages were often generic because researching every potential victim individually would have required too much human effort.

Artificial intelligence changes that calculation. A professional profile can reveal someone’s career, interests, location, industry and recent activity. Other public sources can add considerably more context. Generative AI can then produce an approach specifically designed around that individual.

For somebody seeking work, that could mean a recruitment opportunity matching precisely the sort of role they want. A voice actor might receive an apparently credible voiceover enquiry. Someone working around yachts could receive an opportunity involving the superyacht industry.

The vulnerability being exploited is no longer simply greed or carelessness. It can be ambition, curiosity or the perfectly normal human desire to find work.

Trust is being reverse engineered

This is what makes the problem more interesting than conventional spam. Digital platforms have spent years encouraging us to create detailed public representations of ourselves. We list employment histories, qualifications, interests, connections and achievements because doing so creates professional opportunity.

The same information can now be used to manufacture credibility.

A scammer does not necessarily need to steal someone’s identity completely. They may only need to create enough supporting evidence for the story to survive the first few minutes of scrutiny. A plausible profile, a real company name, an appropriate photograph and a personalised message may be sufficient to begin a conversation.

Once contact has been established, moving the conversation onto another platform can reduce the protection provided by the original service and make subsequent reporting considerably more difficult.

The burden has shifted to the individual

The standard advice remains familiar. Check the sender. Examine the domain. Do not click suspicious links. Verify the company. Report the profile. Block the number. Use multifactor authentication. Contact your bank.

All of this is sensible.

It also requires time.

Every suspicious email, unexpected WhatsApp message, questionable recruitment approach and unexplained telephone call demands a tiny investigation. Most result in nothing more serious than irritation, but the cumulative burden is considerable. The public has effectively become the final security layer in a digital system containing billions of interactions.

When somebody makes the wrong decision, the consequences can range from losing an account to losing life-changing amounts of money.

Why can’t platforms stop fake identities before they reach us ?

That may become one of the defining digital trust questions of the AI era.

Platforms face a difficult balance. Making identity verification extremely demanding could exclude legitimate users, create privacy concerns and introduce barriers in countries where official documentation is less accessible. Making it too easy, however, allows malicious identities to proliferate.

AI raises the stakes because creating and operating those identities can increasingly be automated. Photographs can be generated, biographies written, conversations personalised and potentially voices or video synthesised.

The cost of creating something that appears human is falling rapidly.

From cybersecurity to societal risk

Cybersecurity is often discussed as a corporate problem. Companies employ security teams, purchase specialist software, run training programmes and establish processes for responding to incidents.

Ordinary people largely confront the same digital environment alone.

That is why AI-enabled fraud and impersonation deserve to be considered as something broader than another category of cybercrime. If people increasingly cannot establish whether the person, company, voice, photograph or opportunity appearing on their screen is genuine, the result is an erosion of digital trust itself.

The damage cannot be measured solely in money stolen. There is also time lost investigating false approaches, genuine opportunities ignored because they look suspicious, businesses struggling to prove their authenticity and a gradual increase in the level of distrust required simply to participate online.

Artificial intelligence did not create internet fraud, but it may dramatically increase its quality, personalisation and scale.

The challenge now is whether the architecture of digital identity can evolve quickly enough to keep up.