The Scam Economy and Why Ordinary People Are Becoming the Front Line of Cybersecurity

Cybersecurity was once something most people associated primarily with companies and governments. Organisations maintained computer systems, criminals attempted to break into them and specialist teams were employed to keep the attackers out.

That world still exists, but another security perimeter has become increasingly important.

It is us.

Every day ordinary people make dozens of small decisions about whether to trust an email, answer a call, open a message, click a link, respond to a recruitment approach or believe that the person contacting them is who they claim to be. Most of those decisions are made without specialist tools, training or support.

The human being has become part of the security infrastructure.

Fraud has become industrialised

Digital technology gave criminals something extraordinarily valuable. Scale.

A fraudster no longer needed to approach potential victims individually. Emails could be sent to millions of addresses, automated calls could reach thousands of numbers and fake websites could imitate legitimate businesses at relatively little cost.

Artificial intelligence potentially pushes that industrialisation further. Messages can be written more convincingly, languages translated instantly and approaches personalised using information collected about the intended recipient.

The scam does not have to look like a scam anymore.

Recruitment is an almost perfect target

Employment fraud illustrates the problem particularly well because the victim may already be hoping to receive an unexpected message.

Someone looking for work wants recruiters to contact them. Freelancers want new clients. Actors want casting opportunities. Consultants want projects. People building businesses want customers and partnerships.

A carefully constructed fraudulent opportunity therefore arrives disguised as precisely the thing the recipient has been hoping would happen.

Public professional profiles can make the approach even more convincing. A scammer can know somebody’s industry, career history and interests before beginning the conversation.

Suspicion becomes much harder when the story makes sense.

Reporting does not solve the underlying problem

The standard response to fraudulent accounts is usually to report and block them. That may remove one account, one telephone number or one email address, but it does little to alter the economics that created it.

If new identities can be produced cheaply and quickly, removing them individually becomes an endless game.

This raises a much bigger question about the responsibilities of digital platforms, telecommunications companies, financial institutions and identity providers. If the cost of creating a fraudulent identity is extremely low while the cost of investigating each suspicious interaction falls largely on the recipient, the system favours the attacker.

Fraud steals more than money

Financial losses understandably dominate discussion of scams, particularly when victims lose savings or criminals gain access to bank accounts.

There is another cost that is much harder to measure.

Time.

Every suspicious recruitment conversation that lasts half an hour before revealing itself, every fake invoice that has to be checked, every questionable call and every account that needs reporting consumes somebody’s attention.

Multiply those small interruptions across millions of people and the scam economy imposes a substantial productivity tax on society even when no money changes hands.

Who should be responsible for proving that somebody is real ?

At present, much of that responsibility sits with the recipient.

We inspect domains, search company names, examine profiles, check telephone numbers and attempt to establish whether the opportunity in front of us exists. Meanwhile, legitimate organisations face the opposite problem and increasingly need to prove that their own communications are genuine.

AI makes this tension more urgent because text, images, audio and eventually convincing interactive identities can all be generated at increasing scale.

The long-term answer cannot simply be telling everybody to become better at spotting scams.

A digital economy built around trust needs better ways of establishing who deserves it.