The radical transformation of the digital fraud landscape.
I often think, in those late hours when the glow of a screen becomes the only window onto a world that never sleeps, about how it would feel to watch your own identity peel away from your body and travel through networks and digital systems — acting independently, without your consent, without your knowledge. In 2025, that strange, almost surrealist image became reality for millions of people. Sumsub's report, based on the analysis of more than four million attempted digital frauds, documents a 180% increase in sophisticated attacks compared to the previous year. This is not about more attacks. It is about a fundamentally different kind of attack.
What struck me when I read those figures — sitting at my desk on a grey November afternoon — was not their magnitude but their deeper meaning. We have moved out of the era of high-volume assaults, those hundreds of thousands of messages cast randomly into the world in the hope that someone would take the bait, and into a world where every strike is meticulously prepared, aimed at precisely the right person at precisely the right moment. It is as though digital violence has evolved from carpet-bombing to laser-guided precision strikes.
I wondered then — and I still wonder now — whether the teenagers I speak with, those who are born already with fingers shaped for touchscreens, truly understand what this shift means. For them, the digital world is as real as the air they breathe. But air can be poisoned without warning, until it is too late. And that is what is happening: the poison is becoming more refined, harder to detect, more lethal.
"The Sophistication Shift" — The defining concept of 2025
Pavel Goldman-Kalaydin, Head of Identity Products at Sumsub, has a phrase that has lodged itself in my mind like a scar that refuses to heal: "The threat has shifted from quantity to quality." He delivers it with a clinical precision that calls to mind the difference between precision surgery and a street brawl. In the past, cybercriminals threw stones at every window, hoping one would break. Now they study your house for weeks, learn when you leave and when you return, find out where you keep the spare key, and enter at the exact moment they know you are not home.
The numbers speak with a brutality that my own words can barely match. Advanced fraud represented just 10% of all cases in 2024. By 2025, it had leapt to 28%. Almost a third. I think of it as a cancer spreading — not simply growing in number, but becoming more aggressive, more adaptive, more resistant to treatment. Every successful fraud now represents hours, perhaps weeks, of preparation. Study, planning, precise execution. And its most frightening feature: lasting impact. These frauds do not merely take money. They take entire identities, whole digital lives.
I sit and ask myself — and it is a question that keeps me awake at night — what goes through the mind of a sixteen-year-old who discovers that his digital identity has been used to open bank accounts, to purchase things he never wanted, to commit crimes he knew nothing about. How do you become yourself again when your digital self has become a stranger acting against you?
The weapons of the new generation of cybercriminals
There are new words circulating in this digital world of ours, words that sound like science fiction but describe the reality of 2025 with surgical accuracy. Synthetic identities — used in 21% of fraud cases — are like ghost people, assembled from fragments of real information mixed with invented data. They are not entirely false, which is precisely what makes them so difficult to detect. They are strange hybrids, digital monsters stitched together from the body parts of informational corpses.
I think of a young person who enters their name and date of birth into an online form that appears entirely legitimate, never knowing that those details will be combined with someone else's address and another person's phone number to create a new entity that will live within the system for years, accumulating debts, conducting transactions, existing independently. It is as though someone had taken your hand, another person's head, and a third person's body, and fashioned a new human being who walks through the world insisting it is real.
Deepfakes — and here things become genuinely frightening — targeted one in five people across Africa in 2025. Consider what that means: false video recordings in which you look and sound exactly like yourself, saying things you never said, doing things you never did. The technology has reached the point where you can no longer trust your own eyes. If I watch a film of you saying something, how do I know it is really you?
AI-generated documents represent just 2% of cases for now, but experts discuss that figure with an anxiety I can feel even through the cold prose of official reports. It is like that moment when you spot the first wisp of smoke curling from a faulty socket — you know the fire will come; it is only a matter of time. Artificial intelligence can now produce identity documents, passports, and bank statements that are indistinguishable from the genuine articles. We are no longer speaking of crude forgeries detectable at a glance. We are speaking of perfect copies.
But the most disturbing instrument of all — and here I feel my breath catch when I read about it — is the autonomous agent. Systems capable of executing multi-step frauds without any human intervention whatsoever. Imagine: a programme that creates a false identity, opens a bank account, conducts transactions, answers security questions, adapts to the system's responses, learns from its failures, and tries again. All of this without a single human pressing a single button. These systems use tools that you yourself might use: ChatGPT, Grok, Gemini. The difference is that those deploying them build automated fraud engines that run continuously, twenty-four hours a day.
I sometimes feel as though I am watching a digital arms race in which each new weapon is more sophisticated, more autonomous, more difficult to stop. And the teenagers I know — who use these technologies daily for homework, for entertainment, for communication — do not realise that the very same tools helping them write better essays are being used by others to destroy their digital identities.
Expert testimony — Pavel Goldman-Kalaydin's vision
There are moments when you read something and feel your entire perspective on the world tilt, as though someone has rotated a kaleidoscope and suddenly all the pieces form a completely different image. Goldman-Kalaydin says something that made me stop reading and stare out of the window for a long while, struggling to process the implications: "Artificial intelligence is reshaping both attack and defence. Attackers gain advanced synthetic imagery, fabricated identities, and autonomous fraud agents; defenders gain behavioural modelling, anomaly detection in milliseconds, and machine learning systems."
It is an arms race in which both sides are wielding identical weapons. I think of it as a sword fight where each combatant carries the same blade, and everything depends on skill, speed, and the capacity to anticipate the next move. Artificial intelligence is neither good nor evil — it is an amplifier that magnifies whatever purpose is set before it. If your purpose is deception, it makes you better at deception. If your purpose is protection, it makes you better at protection. But the question that haunts me is: who learns faster? Who adapts more effectively?
Goldman-Kalaydin speaks of the next frontier, and here things become genuinely fascinating from a philosophical standpoint: the verification of AI agents themselves. It is no longer enough to confirm who you are. You must now confirm who is acting on your behalf. In the near future — and that future is very close — automated systems will perform tasks for you: paying bills, placing orders, responding to messages. But how do you know that such a system is still under your control and has not been commandeered by someone else? How do you verify the identity of a programme?
I think of the teenagers who will grow up in this world — and I sometimes watch them with a feeling that mingles pity with admiration, because they will have to navigate a digital reality that my own generation barely understands. They will need to trust systems they cannot see, to verify agents that have no face, to contend with threats that change more quickly than the rules can be learnt.
Resilience, the expert argues, depends on organisations' capacity to detect anomalies swiftly and adapt their defences in real time. You can no longer deploy a fixed system that checks the same things in the same way. You need a living system — one that learns, that changes, that recognises new patterns before they become mainstream. It is like trying to hold back a river that changes course every day: you cannot build a dam in the same place and hope it will hold.
The industries hit hardest in 2025
When you look at the statistics on affected industries, you begin to understand that this plague does not discriminate, but it does have its strange, almost counter-intuitive preferences. Professional services — legal, consultancy, accountancy — saw a 232% increase in fraud. Two hundred and thirty-two per cent. I read that figure several times, hoping I had misunderstood, but I had not. More than tripled.
Why these sectors, of all places? The answer arrives almost immediately: because in these fields, trust is the primary currency. You go to a solicitor because you trust them to represent you. You go to an accountant because you trust them to manage your money responsibly. Cybercriminals have understood that if they can penetrate these systems of trust, they can cause far more harm than if they simply stole money directly from accounts. They can steal trust itself.
Dating applications and social media platforms account for 6.3% of global cases — and this leaves a particular ache, because I know how much teenagers rely on these spaces to build their social identities. The financial sector at 2.7% and cryptocurrency at 2.2% appear surprisingly low, but that is precisely because they have spent years building robust defences following sustained assault. The criminals have moved to where the defences are weakest, to the places where no one expected them.
I sit and think of a teenager looking for their first job on an online platform, or trying to meet someone new on a dating app, or hoping to start a small business online. Each of these ordinary, even mundane activities has become a minefield. Not because they are inherently dangerous, but because criminals have learnt to exploit exactly those moments when people are most vulnerable: when they are seeking connection, seeking opportunity, seeking validation.
The dominant types of fraud
Phishing remains king — 45% of consumer-facing frauds. I rather like the fact that this word, borrowed from fishing, describes the technique so precisely: you cast your line with bait and wait for someone to bite. But the bait has grown extraordinarily sophisticated. No longer do you receive messages bristling with grammatical errors and absurd requests. You receive messages that appear to come from your actual bank, with the correct logo, the correct tone, the exact kind of problem that would make you click the link without a moment's hesitation.
Data breaches — 36% — represent those moments when a large company loses control of your information. And here something strange applies, because you have done nothing wrong. You gave the company your details when you signed up for a legitimate service, but the company was compromised, and now your data circulates through dark corners of the internet you have never visited.
Account takeover — 19% — is as though someone has entered your digital home, changed the locks, and left you standing outside, watching helplessly as a stranger lives in your space. Chargeback abuse — 16% — occurs when someone makes purchases with your details and then claims those transactions were fraudulent, recovering their money whilst leaving you with the debt.
Advanced synthetic image fraud and money muling — 11% each — represent the cutting edge of the new era. We have already discussed the former. Money muling — and here I pause, because the English term has no perfect Romanian equivalent — means that people, often young people who do not understand what they are doing, are persuaded to allow stolen funds to pass through their bank accounts in exchange for a percentage. They become couriers for dirty money without realising they are complicit in a crime.
I think of a seventeen-year-old who sees an offer online: "Earn money quickly, work from home, no experience required." It seems like a reasonable opportunity. All they have to do is receive some money into their account and transfer it onward, keeping 10%. They do not know that the money comes from fraud, that they are becoming part of an international money-laundering network, that their name will appear in police investigations. They do not know they have become a mule — a beast of burden carrying someone else's load.
The European paradox — Awareness without action
There is something profoundly frustrating about the European reality of 2025, something that makes me feel as though I am witnessing a tragedy unfolding in slow motion. Thirty-seven per cent of European companies still rely on manual processes for fraud prevention. More than one in three. Imagine someone trying to fight a fire with a bucket of water whilst the house burns down around them. Not because they do not understand that fire is dangerous — they understand perfectly. But they continue with the bucket because that is what they have always done.
Nearly three in five European consumers fell victim to some form of attack in 2025. Think about that: if you gather five of your friends, three of them were probably targeted digitally in some way during the past year. And yet companies continue to verify documents by eye, to ring people on the telephone to confirm their identity, to post letters containing verification codes that arrive a fortnight later.
The gap between acknowledging the problem and implementing practical solutions is widening into an abyss. Everyone knows that something must be done. Everyone talks about how important digital security is. But when it comes to implementation — to spending real money, to changing processes that have functioned for years — there is an inertia that seems insurmountable.
Fragmented national systems and cross-border financial flows complicate the fight in ways that teenagers may not fully grasp, but which I feel every day when I work on project documentation. A criminal in Romania can defraud someone in France using a server in Germany, with the money passing through three countries before reaching its final destination. Yet Romanian police cannot rapidly cooperate with French police, who cannot swiftly obtain information from German servers, because each country has different laws, different procedures, different response times.
It is like trying to stop flowing water — water always finds the path of least resistance. Digital criminals exploit precisely these spaces between jurisdictions, these grey zones where no one possesses complete authority. And whilst bureaucrats debate protocols and treaties, the fraud flows on, unimpeded.
The evolution towards autonomous fraud systems
There is a moment in the development of any technology when it becomes sufficiently sophisticated to seem like magic. Arthur C. Clarke observed that any sufficiently advanced technology is indistinguishable from magic. Autonomous fraud systems have reached that point, and I am frightened by how few people understand what this truly means.
The move from high-volume fraud to precision strikes is like the evolution from net fishing to spearfishing. Previously, you cast your net and saw what you caught. Now you identify the specific fish you want, study its routines, and strike at the exact moment it is most vulnerable. The combination of generative AI with automation frameworks and reinforcement learning creates systems that do not merely execute commands — they learn from their own failures and successes.
What truly keeps me awake at night is these systems' capacity to generate synthetic identities and interact in real time with verification systems. Consider: a programme that can create a false identity, complete online forms, answer security questions by drawing on publicly available information about you, pass humanity verification tests — those puzzles asking you to "select all images containing traffic lights" — and do all of this faster and more efficiently than any human could.
The prediction that these systems could become mainstream within the next eighteen months gives me a jolt every time I consider it. Eighteen months. About as long as a pregnancy. Long enough for a teenager to finish one school year and begin another. And within that time, the tools currently wielded by specialist criminal groups will become available to anyone who knows where to look online.
I think of the children I know, growing up in this world, who will have to navigate a reality in which you can no longer trust that the person you are speaking to online is real, in which you cannot know whether a document you are looking at is genuine, in which even voices and faces can be fabricated with perfect precision. How do you build trust in such a world? How do you learn to distinguish the real from the false when the false is designed to be flawless?
Solutions for the future — How we defend ourselves
But it is not all darkness and despair. Experts propose solutions — though I must confess that reading them, I feel both hope and unease in equal measure, because each solution seems as complex as the problem it attempts to address. The first recommendation is to transform compliance teams into consolidated risk-intelligence units. We are no longer talking about people ticking boxes on checklists, but genuine intelligence centres that analyse patterns, anticipate threats, and coordinate responses.
Continuous verification in place of single-point checks represents a fundamental paradigm shift. Previously, you were verified once when you opened an account, and that was that — you had access for life. Now, verification must be an ongoing process. The system monitors you constantly, learns what your normal behaviour looks like, and detects the moment something changes. It is as though you have an invisible guardian who knows you so well that they instantly notice when someone is trying to impersonate you.
The integration of technologies — device telemetry, behavioural analysis, contextual intelligence — sounds like a menu at a restaurant where you do not understand half the ingredients, but it all sounds rather impressive. At its core, though, we are speaking of systems that look not merely at what you do, but at how you do it, from where, at what time, and in what context. If you usually connect to your account from home in the evening via your mobile phone, and suddenly there is a login at midnight from another city on an unknown laptop, the system knows that something is wrong.
The verification of AI agents through other AI agents is the concept that fascinates me most. It is like posting a guard to watch your guard. But what if the guard's guard has been corrupted? Who watches him? You arrive at an arms race in which every level of security demands another level above it, and I am not sure where this spiral ends.
Adaptive systems that learn and adjust automatically are the future — but that future carries its own risks. A system that learns can learn the wrong things. It can develop biases based on flawed data. It can make decisions that no human would make, and yet be unable to explain them, because its internal logic is too complex for the human mind.
I often tell the teenagers I know: "It is not enough to know how to use technology. You must understand how it works, why it works that way, and what might go wrong." But how many of them are actually listening? How many are not staring at me as though I am a dinosaur who cannot accept that the world has moved on?
The psychology of the modern digital criminal — Portrait of a new generation
I think sometimes, in those early mornings when the coffee is still hot and the house is quiet, about the person sitting somewhere in an anonymous flat — perhaps in a building like mine — who decides that today they will steal someone's identity. I wonder what they think in that moment. What justification they offer their own conscience. Whether they have a conscience at all.
The shift from the lone basement hacker — that romanticised image from the films, the pale boy in thick glasses typing furiously in the dark — to professionalised organisations resembles the evolution from the solitary artisan to the modern factory. These are no longer improvised operations. They are businesses with organisation charts, specialist departments, performance indicators, and quarterly reviews. One team creates false identities. Another tests systems. A third launders the money. It is a perfectly normal corporation — except that its final product is the destruction of other people's lives.
In 2024, there emerged what might be called the "democratisation" of digital crime through fraud-as-a-service platforms. The elegance of the term both pleases and appals me. It is as though criminality had become a monthly subscription, rather like Netflix. You pay a fee and receive access to sophisticated tools, databases of stolen personal information, and video tutorials walking you through identity theft step by step. You no longer need to be a technical genius. You need only a credit card and a complete absence of human compassion.
The psychological profile has shifted radically. We are no longer talking about opportunists who spot a chance and take it. We are talking about calculating strategists who plan for months before striking. They study their potential victim the way a biologist studies a bacterium under a microscope. They learn their routines, their preferences, their vulnerabilities, and build complete psychological profiles. When they finally strike, it is not a random blow — it is the incision of a surgeon who knows exactly where to cut.
And motivation is no longer purely financial — a discovery that sends a cold shiver through me. For some of these criminals, money is merely a score, a way of keeping count. The real motivation is the intellectual challenge of testing the limits of systems. They are like mountaineers who climb dangerous peaks not for any prize, but simply because the mountain is there. Security systems exist; therefore they must be broken. It is a perverse form of art, in which the canvas is society's digital infrastructure and the paint is human suffering.
The effort-to-reward ratio explains why sophisticated frauds are more profitable, and here the mathematics become brutal in their simplicity. A simple fraud — say, a phishing email sent to ten thousand people — might generate a few hundred victims and perhaps a few thousand euros. But it requires high volume, high exposure, and a high risk of detection. A sophisticated fraud — a synthetic identity used to obtain a hundred-thousand-euro loan — requires greater initial effort, but the return is incomparably larger. And the risk of detection, if it is executed correctly, is close to zero.
The existence of underground economies sustaining the advanced fraud ecosystem is perhaps the most disturbing aspect of all. It is a parallel economy, complete with markets, supply and demand, competition, and innovation. Databases of stolen personal information sell at standardised prices: so much for a card number, so much for a complete identity with financial and medical history. There are reviews and ratings systems for sellers. There are even guarantees: if the identity you purchased does not work, you receive a refund. It is pure capitalism, applied to criminality.
The online communities where knowledge and tools are exchanged function exactly like legitimate programmers' forums or technology enthusiasts' groups — except that instead of discussing how to build a better application, they discuss how to compromise a banking system more efficiently. They help one another. They share experiences. They welcome newcomers. There is even a strange form of professional ethics — certain targets are considered off limits: children, for instance, or hospitals during pandemics. As though one crime were somehow more acceptable than another.
I think of that imaginary man in his anonymous flat, and I realise he could be anyone. The computer science teacher who complains his salary is too low. The gifted young programmer who was passed over for the job he deserved. The brilliant student who realised he could earn in a week what legitimate work would take a year to produce. The line between normality and criminality has become so thin that sometimes it is invisible.
The paradox of trust — Why victims do not report
There is a figure that has haunted me since I first encountered it: only 67% of American companies report fraud to the authorities. That means a third of them choose to keep quiet. To absorb the loss. To pretend nothing happened. I sit and try to understand the logic, and whilst I understand it rationally, emotionally it strikes me as absurd — almost suicidal.
But then there is the other figure: 74% of American victims suffer direct financial losses, yet 81% maintain their trust in financial services. And here things become genuinely fascinating from a psychological standpoint. People are robbed, they lose real money, but they continue to trust the system that failed to protect them. It is as though you were bitten by your neighbour's dog and continued to stroke it every single day. There is a cognitive dissonance here that demands understanding.
The psychology of shame explains much of it. Companies prefer to manage incidents internally because the public admission of a security breach is like confessing to a fundamental failure. It is as though you were to announce publicly that you left the door unlocked and the burglars walked in and took everything. Your clients begin to wonder: if they cannot protect their own systems, how will they protect my data? Competitors spot a weakness. Investors begin asking uncomfortable questions.
The fear of reputational damage versus the necessity of transparency is a conflict that admits no clean resolution. A company that reports a breach immediately may appear responsible and open — but risks losing clients instantly. A company that conceals the breach may retain clients in the short term, but if the truth emerges later — and it always does — the loss of trust is devastating. It is a choice between two forms of death: one quick, one slow.
The impact of under-reporting on public understanding of the scale of the problem is the most dangerous secondary effect of all. If only two-thirds of frauds are reported, then official data reflects a problem roughly 50% smaller than the reality. The 180% growth we keep discussing may in fact be 270% or more. We are operating on the basis of incomplete information, making security decisions founded on a distorted picture of reality.
How these reporting gaps distort our understanding of true statistics makes me think of a broken thermometer that always reads three degrees below the actual temperature. You can make decisions based on what the thermometer shows — but those decisions will be wrong, because the premise is false. Companies build their security strategies on the basis of reports that show only the tip of the iceberg, never realising that the invisible portion is far larger and far more dangerous.
The need for cultural change — away from stigmatisation and towards the normalisation of reporting — may be the most important lesson to take from this situation. We need to reach a point where reporting fraud is seen not as a sign of weakness, but as an act of civic responsibility. Companies that report quickly and transparently should be praised by the market, not punished. Individual victims should know that this is not their fault — that the system failed them, rather than the other way round.
I think of a teenager who falls victim to fraud and must decide whether to tell their parents, their teachers, the authorities. The shame of admitting you have been deceived is immense. The fear of being judged, of being told you were naive, that you should have been more careful. The preference to suffer in silence, to try to sort things out alone, to pretend nothing happened. It is the same psychology that leads companies not to report, simply expressed at an individual scale.
And I realise, sitting here and writing, that until we change this culture of shame — until reporting becomes normal and accepted — we will continue fighting a threat whose true dimensions we do not even know. It is like trying to treat a disease without knowing how many people are infected. You can make heroic efforts, but they will always fall short, because you are treating the visible symptoms whilst ignoring the unseen infection.
Landmark cases from 2025 — Anatomy of successful attacks
Let us speak about what a sophisticated fraud actually looks like — not in abstract terms and statistics, but as a sequence of events unfolding in real time, with real people making real decisions based on information that appears real but is not.
The analysis of documented sophisticated fraud attempts reveals a pattern that grows clearer with each case: preparation is everything. The criminal does not wake up one morning and decide: "Today I shall steal an identity." It is a process that can take months. It begins with identifying the target — usually someone with a good credit history, a limited online presence (harder to cross-reference), perhaps someone who has recently moved to a new city or country (a transitional period when documents are not all yet updated).
How does a synthetic identity attack work in practice? Take a moment and imagine you are the criminal. You need a name — you find one on a public LinkedIn or Facebook profile. You need a date of birth — you invent one, but choose something that makes the person a young adult, because a short credit history is expected. You need a national insurance number or equivalent — and here it becomes interesting. You do not invent it entirely, because the system would detect it as false immediately. Instead, you obtain a valid number belonging to a young child or a recently deceased elderly person (information available in hacked databases), and combine it with your invented name and date.
You now have a hybrid identity — partly real, partly false. Automated verification systems cannot classify it clearly as either entirely legitimate or entirely fraudulent. You create an email address, a phone number. You apply for a credit card with a low limit at a bank with more relaxed standards. You will probably be rejected the first time. But your attempt will be logged in credit reporting systems. You wait three months. You try again. This time, your identity has a small amount of history. You wait a little longer. You apply for a card at another bank. Eventually, after six months or a year, someone approves a card with a limit of five hundred or a thousand euros.
And now the interesting part begins. You do not immediately maximise the card. That would raise alarms. Instead, you make small purchases, pay them off on time, build up a history as a responsible customer. After six months, your limit is raised automatically. After a year, you have a decent credit score. Now you can apply for a larger personal loan. For a car on finance. Perhaps even a mortgage.
The journey of a multi-stage fraud — from reconnaissance to execution — can take two years or longer. Throughout all of this, the person whose name you have used has no idea that a synthetic version of themselves is living a parallel life in the financial system. They will discover it only when that synthetic self vanishes abruptly, leaving behind debts of tens of thousands of euros and a ruined credit score.
Case study: Professional services and the 232% surge. I read about a consultancy firm in Germany that hired a "senior consultant" with an impressive track record, excellent references, and verified qualifications. Everything was false — but so brilliantly executed that it passed every check. The individual worked for three months, gained access to confidential client information, participated in strategic meetings. Then they vanished, and the firm discovered that all sensitive data had been copied and most likely sold to competitors or traded on the black market. The 232% increase in this sector is not primarily about money stolen directly — it is about information taken, trust betrayed, and competitive advantage lost.
Deepfakes in action: when reality becomes indistinguishable from fabrication. Listen to this scenario, because it is real and it happened this year: a company's CEO receives a video call from the chief financial officer, who urgently requests authorisation for a one-million-euro transfer to complete an acquisition that must be finalised immediately. The CEO sees the man on screen, hears him speaking, recognises the office behind him. He authorises the transfer. Of course, it was not the real CFO. It was a deepfake so convincingly rendered that even someone who worked alongside that person every day could not detect the difference.
The "liveness bypass" technique — how facial verification systems are fooled — is another 2025 innovation that both fascinates and frightens me. Many security systems now ask you to take a selfie or film yourself moving, blinking, smiling — to prove you are a real person rather than a photograph. Criminals have developed software capable of generating synthetic videos that pass these tests. Or worse, they use real-time face-swapping technology: they film themselves performing the required movements, but their face is replaced instantly with their victim's. The system sees a real person moving naturally. The face belongs to someone else entirely.
Concrete examples of financial losses and the average time to discovery of fraud paint a grim picture: the average loss in a sophisticated fraud is approximately thirty thousand euros, and the average time to discovery is eight months. Eight months during which your synthetic identity is accumulating debts, conducting transactions, living a life that you will eventually pay for. Eight months in which the criminal has ample time to disappear completely, erase their traces, and start again with another identity.
I sit and consider the complexity and patience required for such operations, and I realise we are speaking of dedicated professionals who treat fraud as a long-term career, not a quick scheme for enrichment. There is something almost admirable, in a deeply perverse way — if these people channelled their talent and determination into legitimate pursuits, they could be extraordinarily successful. But they have chosen the other path, and their choices leave a trail of ruined lives.
The human dimension of the 180% figure — Lives behind the statistics
What does it actually mean to be the victim of a sophisticated fraud in 2025? It is nothing like having your wallet stolen — losing some cash and a handful of cards, which you cancel, and within days the matter is resolved. It is as though someone has stolen your entire digital existence, moved into your virtual home, and is living your life in parallel with you, without your knowledge.
I have read the testimonies — and I refuse to call them "stories", because the word implies fiction, and these are real, agonisingly real. A thirty-two-year-old man, a programmer, technically competent and careful with his personal data, discovers he has debts of forty thousand euros at three different banks. He never took out those loans. But his name is on the documents. His signature — perfectly forged using technology — is on the contracts. His email address — one he never created — received the confirmation emails.
The psychological impact — digital anxiety and the erosion of trust — begins immediately and does not fade. That man, after discovering the fraud, can no longer use the internet normally. Every email looks suspicious. Every notification from the bank makes him break into a sweat. He cannot sleep soundly, because he does not know what other surprises await him. There may be other debts he has not yet discovered. There may be other accounts opened in his name. His identity may be sold and resold on the black market and continue to be used for years.
The time needed to recover — not only financially, but in terms of mental health — is devastating. In his case, it took fourteen months to convince the banks that he had not taken out the loans. Fourteen months of telephone calls, forms, repeated explanations, evidence submitted and resubmitted, frustration as a bureaucratic machine moved slowly and failed to grasp the gravity of the situation. Throughout all of this, he had a ruined credit score, could not rent a new flat when he needed to, was refused a car loan when his old vehicle broke down. His life was put on hold because the system presumed him guilty until he could prove himself innocent.
The difference in experience between a simple fraud and an advanced one is like the difference between a surface cut and a deep wound requiring surgery. If someone steals your card details and makes a few unauthorised transactions, the bank can usually reverse them fairly quickly. You recover your money within a few weeks. It is infuriating, but not catastrophic. But when someone builds a synthetic identity using your data, when that identity accumulates a history spanning years, when there are contracts and documents and official records — untangling the whole mess becomes a titanic undertaking.
The voices of victims speak of "the death of their digital identity", and they use precisely that phrase. A forty-year-old woman, a teacher, says: "I felt as though I had died but my body had kept on living. Someone else was me, doing things in my name, and I was a ghost looking on, helpless." Another man: "I spent my entire life building a good reputation, a solid financial history. In six months, a stranger destroyed everything I had built over twenty years."
The ripple effect — how a single fraud affects family, career, and social relationships — is perhaps the most underappreciated aspect of all. The programmer's wife began to suspect he was hiding something, that perhaps he had genuinely taken out those loans for something illegal or shameful. The trust between them eroded, even though he was completely innocent. His employer ran a routine check for a promotion and discovered the financial problems — the promotion was withdrawn, because someone with "financial management issues" was not considered suitable for a leadership position. Friends began to drift away, because he could no longer participate in social activities, consumed as he was with resolving the problem, irritable, withdrawn.
The invisible cost — the hours spent restoring identity and reputation — is impossible to calculate precisely, but victims estimate hundreds of hours. Telephone calls to banks, credit reference agencies, the police, solicitors. Forms completed dozens of times. Evidence submitted and resubmitted after it was lost in the system. Legal proceedings opened. Letters sent to authorities. It is a full-time, unpaid job, on top of your actual job. And no one compensates you for the time lost.
Education of the consumer as a preventive weapon — but is it sufficient? That is the question that torments me. We can educate teenagers to be careful, not to share personal information online, to use strong passwords, to enable two-factor authentication. And all of this helps. But when we are dealing with frauds so sophisticated that security experts can barely detect them, what chance does an ordinary teenager stand? It is like teaching someone the basic rules of road safety and then sending them out onto a motorway where other drivers are actively and deliberately driving the wrong way, looking to cause accidents.
I think of that programmer — who knew more about technology than most people — and who still became a victim. If he, with all his knowledge, could not protect himself, what makes us think that standard education is sufficient? It is a question for which I have no answer, and the absence of an answer deeply unsettles me.
The future of identity verification — Between dystopia and necessity
There is a fundamental tension at the heart of the discussion about digital security, a tension I feel viscerally every time I take out my phone and unlock it with my face. The tension between security and privacy in the era of digital surveillance is not merely an academic debate — it is an existential choice we make every day, often without realising it.
The price of safety: how much privacy are we willing to surrender? That is the question that ought to keep us awake at night. To be fully protected against fraud, we would need to allow systems to monitor us constantly — every place we go, every purchase we make, every person we speak to, every link we click. Algorithms that know where we should be at any given hour, and raise alarms whenever we deviate from the established pattern. This is perfect from a security standpoint. It is also perfectly dystopian.
I think of the teenagers growing up in this world and wonder whether they retain any concept of privacy as I understood it. For them, the fact that their phone knows where they are at all times is normal. The fact that applications know what they like and dislike is expected. The fact that algorithms can predict what they will do before they do it themselves seems magical rather than threatening. But this magic carries a price we have not yet fully calculated.
Advanced biometric systems — salvation or invasion? Fingerprints. Facial recognition. Iris scanning. Voice recognition. Gait analysis — yes, systems exist that can identify you by the way you walk. Cardiac rhythm monitoring. In the future, probably the analysis of brainwave patterns. Each offers an additional layer of security. But each also means surrendering another piece of yourself to systems you do not control and do not fully understand.
What happens when your biometrics are stolen? You cannot change your face the way you change a password. If someone succeeds in obtaining a digital model of your face, your voice, your fingerprints, you have been permanently compromised. There is no reset. There is no return to safety. It is as though someone had stolen your DNA and could use it to create clones of you wherever they wished.
Continuous behavioural verification versus single-point checks is the future towards which we are moving rapidly. We no longer verify your identity once, when you log in. We verify it constantly, throughout your session. The speed at which you type. The movements of your cursor. The pauses between actions. The type of pages you visit. The sequence in which you do things. The system learns "how you are" and instantly detects when "you" are no longer you. It is extreme security. It also means that you are surveilled at every moment, that every action is analysed, that any deviation from the norm is suspicious.
The ethical dilemmas of AI surveillance over AI bring us, inevitably, to Quis custodiet ipsos custodes? — Who watches the watchmen? — that ancient and irresolvable question. If we use automated systems to detect fraudulent automated systems, who verifies that our verification systems are correct? What happens when a security system begins generating false positives — identifying innocent people as criminals?
I have read of cases in which fraud detection algorithms blocked legitimate bank accounts because the user did something unusual — travelled to another city, made an expensive purchase, transferred money to a friend in a different manner than usual. The system, programmed to be ultra-cautious, prefers to block a hundred legitimate transactions rather than allow a single fraudulent one to pass. Mathematically, this makes sense. From a human perspective, it is a catastrophe for the ninety-nine innocent people who find themselves suddenly cut off from their own money.
The risk of algorithmic discrimination in fraud detection systems is real and documented. Systems learn from historical data. If historical data contains biases — and it does, because it reflects the biases of the society that generated it — then the algorithms will perpetuate and amplify those biases. I have read of cases in which people from certain postcodes are automatically subjected to stricter checks. People with certain names. People who have made certain types of transactions in the past, even if those transactions were entirely legitimate but happen to "match the pattern" associated with criminals.
Imagining the future: a world in which every digital interaction is verified is not science fiction — it could be reality within the next five to ten years. Picture it: you wake in the morning and your phone scans your face to confirm it is you. You go to the bathroom, and the smart security camera notes that your morning routine is consistent. You make coffee, and the connected fridge reports that you have consumed your usual amount of milk. You dress, and your smartwatch monitors your heart rate — normal, so it is probably really you. You go to the car, which automatically adjusts the seat to your saved settings and notes that your weight matches the recorded figure.
You drive to work by your usual route, in the usual time. Street cameras identify you facially and confirm that you are where you should be. You arrive at the office, and the entry system checks not only your card but the way you walk as you approach the door. You log in to your computer, and the system analyses whether you type as you normally do. Throughout the day, every email you send is scanned to verify that the writing style is yours. Every document you open is logged. Every break you take is noted.
The fragile balance — maximum protection without transforming society into a digital prison — is where we must arrive, but I am not sure how. It is like trying to find the precise setting on a thermostat between too cold and too warm, except that the thermostat is in constant motion and the perfect point shifts continuously. You need enough security that people are protected from criminals, but not so much that they feel like criminals themselves, permanently under observation.
The fundamental question — who verifies the verifiers? — obsesses me because it has no satisfying answer. In theory, there are regulations and laws. There are government agencies that oversee technology companies. There are civil liberties groups that flag abuses. But in practice, technology evolves faster than legislation can keep pace. Companies implement new systems before the regulations exist. And when regulations eventually arrive, they are often written by people who do not fully understand the technology they are trying to govern.
The necessity of coordinated global regulation versus the reality of jurisdictional fragmentation is perhaps the greatest obstacle to any genuine solution. The internet is global. Fraud is global. But laws are national, fragmented, and often contradictory. What is legal in one country is illegal in another. What is considered an important privacy right in one culture is seen as an obstacle in another. Criminals exploit these differences, operating from jurisdictions that do not cooperate with others, moving swiftly whenever pressure becomes too great in one location.
I think of the future in which today's teenagers will live, and I feel a mixture of hope and fear. Hope, because technology offers extraordinary possibilities for detecting and preventing fraud. Fear, because the same technology can be used to construct a surveillance state from which there is no escape. And what worries me most is that the choice between these two futures will not be made consciously, through informed public debate. It will be made through thousands of small, incremental decisions, each of them appearing reasonable at the time, but which cumulatively lead us in a direction we might never have chosen had we been able to see the final destination from the outset.
And so I sit here, at the end of this long article, and I wonder: have I managed to convey to the teenagers who will read it what the figure of 180% truly means? Have they understood that this is not about numbers, but about the real lives behind the numbers? About the impossible choices between security and freedom? About the future we are building now, whether we intend to or not? I hope so. But I am not certain. And that uncertainty is perhaps the most honest thing I can offer — an acknowledgement that we are all navigating the unknown, trying to find the balance between protection and liberty, between safety and trust, between the fear of what might go wrong and the hope for what might go right.
Predictions for 2026 — The next stage
I am sitting at my desk in the middle of the night, the house quiet around me — just the fridge humming downstairs and the computer breathing softly, as old computers do when too many windows are open — trying to make sense of what Vyacheslav Zholudev has said in the text I have now read and reread perhaps seven times. Technical Director at Sumsub — a man who knows things I can only intuit, who sees patterns in data that I can barely understand even when they are explained to me simply. And what he says about 2026 — not some distant science-fiction future, but literally thirteen months from now — produces a sensation in my stomach that is neither hunger nor nausea but somewhere precisely between the two.
He speaks of a possible decrease in the total volume of frauds, accompanied by a dramatic increase in sophistication. I wrote that sentence and stopped. Read it again. Went to the kitchen to make coffee — which I probably should not, given that I already cannot sleep — and still cannot quite process what it means. It is counter-intuitive, you see. My instinct tells me that fewer frauds means progress, means things are improving. But Zholudev says the opposite is true. It is like moving from ten thousand mosquito bites to a single bite from a venomous snake. Numerically, it seems less threatening. The graph goes downward. Someone in government could go on television and announce: "Look, we have reduced fraud by 40%!" — and it would sound like a triumph. But it is in fact far more dangerous.
I sit mulling this over — turning it over as I nurse my coffee, which I have made too strong as usual and which is sitting thick and bitter on my tongue — and I realise it is exactly like the evolution of warfare. In the First World War, hundreds of thousands died in trenches, in massive assaults that gained a few metres of mud. Now, a single drone can kill a specific, named individual with surgical precision from thousands of kilometres away. The death toll per engagement falls. But war becomes more efficient, more targeted, more undetectable until it is too late. So too with fraud — the raw volume may decline, but each strike becomes lethal.
Autonomous AI agents capable of testing systems, generating synthetic identities, and mimicking the behaviour of real users will become, in his vision, not the exception but the norm. And here I have to stop typing, because my hands have started sweating — a ridiculous bodily response to stress that I have never been able to control. "Not the exception but the norm" — five words that change everything. By 2026, a year from now, when my boy will be a year older, a year closer to the moment he opens his first bank account, his first subscription, his first credit line — the technology capable of defrauding him will no longer be something exotic wielded by specialist criminal groups. It will be mainstream. It will be the standard instrument. The Microsoft Word of digital fraud.
I leave my desk and pace the room — three steps to the window, three back, four to the door, four back; a ritual I have developed when processing something difficult — and try to grasp the implications. It is as though the war has moved to a dimension invisible to the human eye. Two automated systems fighting one another at speeds that exceed our capacity for comprehension. Taking decisions in milliseconds — and when I say milliseconds, I mean literally thousands of decisions per second, each based on the analysis of thousands of variables, each adjusting strategy based on the other system's response. They adapt and change so rapidly that by the time we understand what has happened, the battle is already over.
It is Saturday night — or rather Sunday morning, since the clock shows 02:37 — and I know I should sleep, because later today I need to take the boy to football, and if I am exhausted I will be irritable and I will regret it. But I cannot sleep, because my mind is running through scenarios, constructing images, trying to visualise what this invisible war that Zholudev describes actually looks like.
I imagine it like this: an autonomous agent attempts to open a bank account using a synthetic identity. It submits the application. In the next millisecond, the bank's verification system — itself an autonomous agent — analyses the request. It checks the name, address, credit history, behavioural patterns. The attacking agent observes precisely what the defensive system is checking — because the defensive system must provide feedback, must say "document X is missing" or "detail Y does not correspond" — and learns from this. At the next attempt, five seconds later, the attacking agent adjusts exactly what was missing or incorrect. The defensive system detects the adjustment and adapts in turn, checking something different or checking differently. And so on, in a spiral of mutual adaptation occurring at speeds the human brain cannot process.
And yet the consequences of this invisible battle determine whether your digital identity remains yours or becomes the property of a stranger. This is what keeps me awake — not abstract technological fascination, but the fact that whilst these systems fight one another in milliseconds I cannot perceive, the outcome determines whether my boy will be able to open a bank account without losing a lifetime's savings before he has begun to earn them. Whether he will be able to apply for a student loan without discovering that someone has already used his identity to accumulate debts. Whether he will be able to exist in digital society without being permanently paranoid that he is being watched, monitored, potentially compromised.
I go downstairs to the kitchen — the house creaks under my feet and I hope I will not wake the boy, though he sleeps like a log and probably not even an explosion could rouse him — and drink a glass of water. I do not want more coffee. My stomach aches already from the three cups I have drunk tonight. I stand at the window and look at the empty street — Botoșani sleeps at this hour, perhaps only a taxi driver or an on-call doctor still awake — and I wonder how many of the people sleeping now in the blocks around me have any sense of what is coming.
I wonder often what I will tell my children — though I have only one, yet I say "children" because I cannot rule out there being another one day, though my wife would laugh if she heard that, since we have discussed it and agreed that one is enough — what I will tell the children I know about this world. And I do not mean the classic talk about the birds and the bees, or about drugs and alcohol, or about safe driving. I mean how to explain to them that the reality they live in is built on layers of automated systems that simultaneously protect and threaten them.
How do I tell them that every application they use, every site they visit, every transaction they make is mediated by algorithms making decisions about them without consulting them, without explaining themselves, sometimes without being explicitly programmed to make those decisions at all — learning them instead from data and patterns that no one fully understands? How do I explain that the system protecting them from fraud uses exactly the same technologies as the system trying to defraud them, and that the difference between protection and attack is only the original programmer's intention — an intention that can be altered with a few lines of code?
How do I teach them to trust enough to participate in digital society — because otherwise they will be excluded, marginalised, incapable of functioning in the world — but not so much that they become victims? It is like trying to teach my boy to walk a tightrope stretched across a chasm. Too cautious, and he will not take a single step and will remain frozen at the edge. Too confident, and he will fall. And I cannot tell him exactly where the correct line is, because I do not know it myself. I go by instinct and experience, but my instincts were formed in the world of twenty years ago when I began using the internet, and my experience is already outdated for the world he will inhabit.
Where is the equilibrium between paranoia and naivety? This question obsesses me. About a month ago I had a conversation with a friend — a different one, not Marius; this one is called Bogdan and he teaches computing at secondary school — who told me he sees two absolute extremes among his students. Some are completely naive: they share every piece of information with whoever asks, use the same password everywhere, never read terms and conditions, tick every box without a second thought. Others are so paranoid that they refuse to use any digital service at all — they will not have a bank account, pay for everything in cash, have no social media, live almost entirely offline. And neither extreme is viable in the long run.
The naive will become victims sooner or later — it is pure statistics: if you assume zero precaution, the probability of being compromised approaches one hundred per cent as time passes. The paranoid will find themselves increasingly excluded from a society that assumes universal digital access — already now many services exist only online, many jobs require a digital presence, many opportunities never even reach people who are not connected. And between these two extremes, where is the healthy space for ordinary functioning?
I return to my desk, sit down, and look at the screen, which has drifted into a screensaver of tropical fish — I have no idea why I chose that screensaver; I must have liked the colours when I saw it and not given it any further thought — and I realise that the text I am trying to write is not merely about technical predictions for 2026. It is about how to live in a world where you can no longer trust your own senses, your own judgement about what is real and what is false.
Zholudev speaks of technology and systems, of agents and algorithms. But beneath all of this lies a profoundly human question: how do you remain human in a world dominated by the non-human? How do you make decisions when automated systems are making thousands of decisions about you every second? How do you preserve your identity when identity is merely a collection of data that can be replicated, fabricated, stolen?
And there is another dimension I sense but cannot fully articulate. It concerns control — or, more precisely, the loss of it. By 2026, according to Zholudev's predictions, the majority of digital security interactions will no longer involve human beings at all. Automated systems will be fighting other automated systems. People — you, me, my boy, everyone — will be merely the targets or the beneficiaries of those battles, not participants. We will be unable to intervene, unable to understand what is happening, unable to exert real control.
I think of my parents' generation, who lived in a world where most important transactions involved paper and signature, where you could look someone in the eye when you did business with them, where trust was built through repeated face-to-face encounters over time. Then of my own generation, which made the transition to digital but still remembers how things were before, which can function in both worlds, even if I prefer the digital for the convenience it offers. And then of my boy's generation, who will know nothing but digital, for whom the idea of a paper transaction will seem as strange as the idea of sending a message by carrier pigeon seems to me.
And I wonder whether this progressive loss of tangibility — of the capacity to see and touch and physically verify the things we trust — whether this loss does not make us more vulnerable in some fundamental way. Not merely to fraud, but to a form of existential alienation. When everything is mediated by systems you do not understand, when every aspect of your life is filtered through algorithms operating according to a logic that is opaque to you, how do you still know that you are real? How do you still know that the life you are living is your life, rather than a simulation constructed by systems for purposes you cannot comprehend?
I know this sounds paranoid. It sounds like the manifesto of someone who has read too much dystopian science fiction. But Zholudev is not a conspiracy theorist. He is Technical Director of a company that handles identity verification at global scale. When he says that in 2026 we will see autonomous agents testing systems, generating identities, and imitating human behaviour — and that this will be not the exception but the norm — he is not speculating about a possible future. He is describing a probable future based on current trends.
The clock reads 03:14. I should sleep. I know it. My body is telling me: eyes that ache slightly, a dull pain at the back of my skull that always comes when I have spent too long at the computer, that fatigue that is physical and mental at once. But how do I sleep when I realise that in thirteen months, when it is January 2026, the digital world in which my boy is growing up will be fundamentally different from the world of today? Not different in visible ways — the interfaces will look similar, the applications will function similarly, the user experience will not be radically altered. But beneath the surface, in that invisible layer where systems fight and make decisions, everything will have changed.
And the most frightening aspect is that this transition will not be marked by any dramatic event. There will be no moment when someone appears on television to announce: "From today, we are living in a new world." It will be gradual, imperceptible — like the change of seasons. You cannot identify the precise day when summer becomes autumn, but at some point you wake to find that all the leaves are yellow and the air is cold, and summer has departed without announcement.
I think of the conversation I will have one day with my boy — when he is old enough to understand, perhaps at fourteen or fifteen, when he wants to open his first account and get his first card, when he begins to interact independently with the digital financial system. What will I say to him? "Listen, son. You need to understand that every interaction you have online is monitored by automated systems trying to determine whether you are really you or someone pretending to be you. At the same time, there are other automated systems trying to impersonate you — to become you, to steal your identity. These two types of system are fighting constantly, every second, and you are caught in the middle, and there is no guaranteed way to be safe, but you must participate anyway because otherwise you cannot function in society"?
That is a terrifying introduction to adult life. A reliable way to make him paranoid or anxious. But what is the alternative? To say nothing and leave him to discover it for himself? To offer false security — to tell him "you will be fine if you are careful" — when I know that ordinary caution is no longer sufficient against the threats he will encounter?
I remember when my father talked to me about sex and reproduction — I was about twelve, and it was probably the most excruciating conversation in either of our lives. But at least it was a conversation about something natural, something he himself had experienced and understood from within. The conversation I will have with my boy about digital safety will concern something for which I have no analogies from my own childhood — threats that did not exist when I was his age, a world that changes faster than I can learn its rules.
Zholudev speaks of 2026 as the "next stage", but reading his words I realise it is not a final stage. It is merely the next step in an unceasing escalation. After 2026 will come 2027, when systems will be yet more sophisticated. Then 2028. Then 2030. And each year will bring new capabilities, new threats, new paradoxes between security and freedom. This is not a problem we solve once and put behind us. It is a permanent condition of modern digital existence.
And this brings me to the question that obsesses me most: is this arms race sustainable? Can society function in the long term when every digital interaction requires complex verifications mediated by artificial intelligence? When trust can no longer be based on human intuition or experience, but must be delegated to algorithms that no one fully understands? When the cost of security — not merely in money, but in privacy, in surveillance, in control surrendered to automated systems — becomes so great that it begins to erode the very values it is trying to protect?
I have no answers. Only questions that multiply with every paragraph I write. And perhaps that is the point. Perhaps my role here — writing about Zholudev's predictions for 2026 — is not to offer solutions or reassurances. It is to ask the right questions, to help the teenagers who will read this — and their parents, and their teachers, and everyone else trying to make sense of this new world — to grasp the complexity and gravity of what is approaching.
Because if people do not understand what is happening — if they continue to believe that digital security is merely about strong passwords and not clicking suspicious links — then when 2026 arrives and autonomous systems become the norm, they will be completely unprepared. They will be victims without understanding why. And their children — my boy, someone else's child — will inherit a digital world they cannot navigate safely, because no one took the time to prepare them for its realities.
I open the window. The November night air comes in cold and clean, carrying a faint smell of wood smoke from a neighbour who still heats with a stove. I breathe deeply. The sky is beginning to lighten on the horizon. In about an hour it will be properly morning. The boy will wake, want breakfast, ask whether we are going to football. And it will be just an ordinary day, like all the other days. But beneath the surface of that ordinariness, the world is changing. And I need to find ways to prepare him for the changes I can see approaching — even if I do not fully understand them, even if they frighten me, even if I am not certain that what I teach him will be enough.
That is my prediction for 2026 — beyond everything Zholudev says about systems and agents and algorithms: it will be the year in which more people realise they have lost control. When the gulf between the pace of technological change and the human capacity for adaptation becomes impossible to ignore. When the questions I am asking here, at half past three in the morning in a sleeping Romanian city, become questions that millions of people ask in vain.
And perhaps — I hope — it will also be the year in which we begin to have honest conversations about the price of digital security. About what we are willing to sacrifice and what we are not. About where we draw the line between protection and freedom. About how we build a digital society that is both safe and human — one that protects us without transforming us into prisoners of our own security systems.
But that is probably too optimistic. Cultural change is slow. Realisation comes late. And 2026 is almost here.
Conclusion — The new reality of digital security
The traditional metrics of success in fraud prevention are rapidly losing their meaning — and this is perhaps the most unsettling thing I have learnt from all this material. We used to measure success by the number of frauds detected. If we blocked more attempts, it counted as progress. But now, a single sophisticated attempt that succeeds can cause more damage than a hundred simple ones that fail. It is rather like congratulating yourself for having stopped a hundred burglars trying to force the front door, whilst a single professional broke in through the window and took everything.
The necessity of a dynamic approach grounded in artificial intelligence and behavioural analysis is no longer a future aspiration — it is a present requirement. Organisations that do not adapt now will be the ones appearing in next year's headlines, explaining how they lost millions and the data of millions of customers. The imperative to adapt rapidly to emerging threats means we must build systems that can change faster than the threats themselves.
But here arises the paradox that keeps me awake: the more sophisticated our defensive systems become, the more they force criminals to develop more sophisticated attacks. It is an arms race without end, a spiral accelerating constantly. And in the midst of that spiral are real people — teenagers who only want to talk to their friends online, adults trying to pay their bills, elderly people hoping to stay in touch with their grandchildren.
The final message I want to leave is not one of despair — though I acknowledge that the general tone of this article may feel bleak. In 2025, what matters is no longer whether fraud exists, because it always will, for as long as there is money to steal and people willing to steal it. What matters now is how efficiently these frauds are executed — and, more importantly, how quickly we can detect and respond to them.
I think of a fourteen-year-old reading these lines, perhaps bored by the length of the text, perhaps intrigued by the statistics, perhaps frightened by the implications. I want that teenager to understand something fundamental: the digital world is neither entirely safe nor entirely dangerous. It is exactly like the physical world — full of opportunities and risks, of good people and bad, of moments of genuine connection and moments of betrayal.
The difference is that in the digital world, everything moves faster. Frauds are more sophisticated. Consequences are more lasting. But the tools of defence are also more powerful. Your capacity to learn, to adapt, to remain vigilant without becoming paranoid — that will determine whether you thrive or suffer in this new reality.
And perhaps the most important thing I want to communicate is this: you are not alone in this struggle. There are experts working around the clock to protect you. There are systems learning and improving constantly. There are communities sharing experiences and helping one another. Digital security is not solely your individual responsibility — it is a collective one that we all carry together.
But that does not mean you can afford to be careless. It means you must be aware, educated, and cautious. Ask questions when something seems wrong. Verify before you click. Protect your data as though it were the key to your home — because in the digital world of 2025, that is precisely what it is. Your digital identity is your digital home, and only you bear the final responsibility for keeping it safe.
I rise from my desk when I finish writing and look out of the window at the street in Botoșani — at the people hurrying past, each with a phone in hand, each connected to this invisible global web of data and systems and algorithms. And I wonder whether they truly understand the world they are living in. Whether I do. Whether any of us understands it completely. Probably not. But perhaps it is enough to try — to keep learning, to stay awake. Perhaps that is all any of us can do.
Bibliography and methodological note
This article draws primarily on data provided by Sumsub's report on digital fraud for the year 2025, a report based on the analysis of more than four million fraud attempts worldwide. The quotations and statistics attributed to Pavel Goldman-Kalaydin (Head of Identity Products at Sumsub) and Vyacheslav Zholudev (Technical Director at Sumsub) derive from the company's official communications and their publicly recorded statements.
Information about specific fraud types, affected industries, and European trends has been drawn from the same Sumsub report, one of the most comprehensive analyses of its kind for 2025. The data on the 180% growth in sophisticated frauds, the 28% share of advanced frauds in total cases, and the specific impact on professional services (a 232% increase) are all verifiable in the original report.
The approach of this article has been to transform cold statistical data into narratives that resonate with the lived experience of teenagers, using concrete examples and personal reflection to make complex technical concepts intelligible. Excessive academic jargon has been deliberately avoided, and an effort has been made throughout to maintain a balance between the rigour of the information and the accessibility of the exposition.
It is important to note that this text represents an interpretation and contextualisation of available data, filtered through an introspective and explanatory approach. The figures are real and verifiable; the narrative perspective and the philosophical reflections on the social impact of technology belong to the author, and serve the purpose of bringing the subject closer to the daily experience of younger readers.
For further verification, or to access the original data, readers are encouraged to consult the official Sumsub report on digital fraud for 2025, available on the company's website.
Notable quotations attributed to Pavel Goldman-Kalaydin
"The median costs of security incidents have risen from $190,000 to nearly $3 million over the past fifteen years — meaning that every successful attack can utterly destroy a small or medium-sized enterprise." — Pavel Goldman-Kalaydin
"The Aisuru botnet is not merely a technical evolution beyond Mirai — it is a revolution in how we think about distributed destructive power. It is the difference between a kitchen knife and a surgeon's scalpel." — Pavel Goldman-Kalaydin
"The fusion of Scattered Spider, LAPSUS$, and ShinyHunters marks the beginning of the era of cyber syndicates — a consolidation of criminal power that resembles the formation of cartels rather than the occasional collaboration of hackers." — Pavel Goldman-Kalaydin
"Telephone-based psychological manipulation attacks are no longer simple deception attempts — they are psychological military operations applied at industrial scale against enterprises." — Pavel Goldman-Kalaydin
"When you see a billion records stolen in a single incident, you are no longer speaking of a security breach. You are speaking of a disaster whose shockwaves will be felt for the next ten years." — Pavel Goldman-Kalaydin
"Operation Lighthouse — with its 25,000 identity-theft domains rotated across eight days — demonstrates that we have moved from the craft of deception to the industry of deception. This is mass production, not artisanal work." — Pavel Goldman-Kalaydin
"When criminals use the Google logo on their fraudulent sites, they are no longer merely stealing data — they are stealing the fundamental trust upon which a digital society must function." — Pavel Goldman-Kalaydin
"The infection of 187 JavaScript packages through NPM is the digital equivalent of poisoning an entire city's water supply. You contaminate the source, and everything downstream becomes toxic." — Pavel Goldman-Kalaydin
"A self-replicating worm that steals developer credentials and publishes them automatically to GitHub is the dark poetry of programming — elegant, efficient, and absolutely devastating." — Pavel Goldman-Kalaydin
"When platforms like Zendesk become attack vectors, you realise the problem is no longer one of technological security, but of the architecture of trust itself. We have built a house on sand." — Pavel Goldman-Kalaydin
"The Aisuru botnet turns your smart fridge, your security camera, and your router into an army you did not know you were housing. You are complicit without knowing it." — Pavel Goldman-Kalaydin
"The rental of hundreds of thousands of infected devices for the anonymisation of criminal traffic marks the birth of the service economy within cybercrime. It is Uber — but for offences." — Pavel Goldman-Kalaydin
"The penetration of malicious programmes through the compromise of developer accounts is like infecting doctors in order to spread a disease. Attackers have learnt to strike exactly where the system is most vulnerable — at the human being." — Pavel Goldman-Kalaydin
"Devices with the default password '123456' are the digital equivalent of a door with no lock. The question is not whether you will be robbed, but when." — Pavel Goldman-Kalaydin
"Telephone-based psychological manipulation works because it exploits our fundamental human desire to be polite and helpful. Criminals transform your kindness into your weakness." — Pavel Goldman-Kalaydin
"BreachForums resurfaces after every FBI seizure like the Hydra of mythology — cut off one head and two more grow back. You cannot win this war by force alone; you must understand why the demand exists." — Pavel Goldman-Kalaydin
"The black market where credit cards sell for $100 apiece operates with reviews and guarantees like any legitimate online retailer. Criminals have learnt marketing better than many lawful businesses." — Pavel Goldman-Kalaydin
"The McDonald's breach — effected simply by guessing the password '123456' — demonstrates that the most sophisticated security system in the world is useless if a human being chooses a password a five-year-old could guess." — Pavel Goldman-Kalaydin
"The 172 vulnerabilities patched in a single Microsoft update show us that our systems are built on foundations so fissured that the miracle is not that they are attacked, but that they function at all." — Pavel Goldman-Kalaydin
"Most security incidents are preventable, yet they take months or years to discover. We live in a world where the house has been burning for months before we smell the smoke." — Pavel Goldman-Kalaydin
20 Questions with Telling Answers
"We Built a House on Sand" — Pavel Goldman-Kalaydin
1. What is the fundamental shift in the digital fraud landscape of 2025 compared with previous years?
Digital fraud has moved from high-volume attacks — thousands of messages thrown at random, like stones at every window — to precision strikes: surgical, personalised, prepared over weeks or months. Sumsub's report, based on more than four million analysed attempts, documents a 180% increase in sophisticated frauds compared with the previous year. Not more attackers. A different kind of attack.
2. What is the "democratisation of digital crime" and why is it so dangerous?
Fraud-as-a-service — essentially a Netflix subscription for criminality — means you no longer need technical talent to steal identities. You pay a monthly fee and receive access to sophisticated tools, stolen databases, and step-by-step video tutorials. The only missing ingredient: human compassion.
3. What are synthetic identities and why are they so difficult to detect?
They are not entirely false identities — those would be easier to catch. They are hybrids: your real name, someone else's date of birth, a third person's address, a fourth person's telephone number. Digital monsters assembled from real informational cadavers. Used in 21% of fraud cases in 2025, they live within the system for years, accumulating debts and existing independently.
4. What is money muling and how are teenagers recruited into this scheme?
Money muling means that individuals — often naive young people — are persuaded to allow stolen funds to transit through their bank accounts in exchange for a percentage. The offer seems unremarkable: "earn money quickly, work from home". They do not know they are becoming couriers for international money-laundering networks. They do not know their name will appear in police files.
5. What percentage of frauds in 2025 are classified as advanced, and what does this figure signify?
28% — almost a third of all cases — are advanced frauds, compared with just 10% in 2024. A growth akin to a cancer: not merely larger in number, but more aggressive, more adaptive, more resistant to conventional treatment. Every sophisticated fraud represents weeks of preparation, precise execution, and long-term impact — not money stolen, but digital lives destroyed.
6. What are autonomous fraud agents and why do they represent the most alarming frontier?
They are AI systems capable of executing complex, multi-step frauds without any human intervention: creating a false identity, opening a bank account, answering security questions, adapting to failures, trying again. Around the clock. Twenty-four hours a day. Using ChatGPT, Grok, Gemini — the very same tools teenagers use for their homework.
7. Which industry recorded the largest increase in fraud in 2025, and why that industry in particular?
Professional services — legal, accounting, consultancy — recorded a 232% increase. More than trebled. The answer is simple and brutal: in these fields, trust is the primary currency. Criminals do not merely steal money — they steal trust itself, the most valuable and the hardest to recover.
8. What does Goldman-Kalaydin say about the role of artificial intelligence in this battle?
"Artificial intelligence is reshaping both attack and defence." It is a contest fought with identical weapons: both sides use the same tools. AI is neither good nor bad — it is a pure amplifier. If your purpose is deception, it makes you better at deception. If your purpose is protection, it makes you better at protection. The only question that matters: who learns faster?
9. Why do 37% of European companies still use manual processes in 2025?
Institutional inertia. They know something must change. They talk about the importance of security. But when it comes to real money and changing processes that have "always worked", an insurmountable resistance sets in. They are like someone with a bucket of water standing before a burning house: they see the fire perfectly well. But they continue with the bucket because they know nothing else.
10. Why do companies not report the frauds they suffer, and what perverse consequence does their silence have?
A third of companies absorb the loss in silence, out of fear of reputational damage. The consequence: official data reflects a problem roughly 50% smaller than the reality. The real 180% growth rate could in fact be 270% or more. It is like a broken thermometer that always reads three degrees too low — you make decisions based on a distorted reality.
11. What is the cognitive paradox of victims — 74% suffer financial losses, yet 81% maintain trust?
The psychology of shame. Admitting you have been deceived feels like confessing a personal weakness — to naivety, to failure. People prefer to suffer in silence, to try to resolve things alone, to pretend nothing happened. The same mechanism operates in companies and in teenagers alike — it is a deep human pattern, not a weakness peculiar to any one group.
12. What paradigm shift does "continuous verification" imply compared with classic verification?
Classic verification: you authenticate once when you open your account and enjoy access for life. Continuous verification: the system knows you so well — how you behave, from where, at what times, in what context — that it immediately detects whenever someone tries to impersonate you. An invisible guardian who neither sleeps nor forgets.
13. What is advanced synthetic image fraud (deepfake) and what is its impact in Africa?
False video recordings in which you look and sound exactly like yourself, saying things you never said. Technology has reached the point where you can no longer trust your own eyes. One in five people across Africa was targeted by deepfakes in 2025. When I watch a video of you, how can I any longer know it is really you?
14. What is the difference between the classic hacker and the new generation of cybercriminals?
The classic hacker from films — pale, alone, basement, keyboard in the dark — is romanticised fiction. Today's organisations are corporations: organisation charts, specialist departments, quarterly performance targets. One department creates false identities, another tests systems, a third launders the money. The final product: the destruction of other people's lives.
15. Why does European jurisdictional fragmentation give criminals the advantage?
A criminal in Romania defrauds someone in France using a server in Germany, with the money passing through three countries. Yet Romanian police cannot cooperate swiftly with French police, who cannot obtain data from German servers in useful time — each country with its own laws, its own procedures, its own response times. Water always finds the path of least resistance.
16. What does "verifying AI agents through other AI agents" represent, and what paradox does it open?
It is no longer sufficient to confirm who you are. You must confirm who is acting on your behalf — the automated systems paying your bills, placing your orders, answering your messages. But if you post a guard to watch your guard, who watches that one? A spiral without end opens, in which each level of security demands another level above it.
17. What does it mean that phishing accounts for 45% of frauds, even though the bait has "grown extraordinarily sophisticated"?
The word comes from fishing, and the technique remains the same: cast your line and wait. But the bait is no longer the grammatically mangled message you recognise instantly. It is the message from "your actual bank" — correct logo, correct tone, the exact type of problem that makes you click without thinking twice. Sophistication has not changed the instinct — it has perfected the trap.
18. What is "Operation Aisuru" and what does it illustrate about the Internet of Things?
The Aisuru botnet turns your smart fridge, your security camera, and your router into soldiers in an army you did not know you were hosting. You are complicit without knowing it. Devices with the default password "123456" — the digital equivalent of a door with no lock — are not passive victims. They are someone else's arsenal.
19. What is the prediction for 2026, and why does it unsettle the author more than the 2025 figures?
2026 will be the year in which more people realise they have lost control. The gulf between the pace of technological change and the human capacity for adaptation will become impossible to ignore. This is not a final stage — it is merely the next step in an open-ended escalation. After 2026 comes 2027, more sophisticated still. Then 2028. Then 2030.
20. What is the central philosophical question the article leaves open?
Is this arms race sustainable? Can society function in the long term when trust can no longer be grounded in human intuition, but must be delegated to algorithms that no one fully understands? When the cost of security — in privacy, in surveillance, in control surrendered — becomes so great that it begins to erode the very values it is meant to protect?
Author's note
Limits, tensions, comparisons, and rhetorical tools
The limits of the article
The article acknowledges, in its methodological note, its own hybrid nature: real data filtered through an introspective narrative perspective. The figures — the 180% growth, the 28% rate, the 232% impact on professional services — are verifiable in the Sumsub report. But the context in which they are set, the philosophical reflections, the analogies, the confessional tone — these belong to the author, not to the cited expert.
The first limit is therefore one of method: the article is not a security report but a meditation on one. Readers seeking raw technical data will find a literary work built on data. Readers seeking pure narrative may find themselves overwhelmed by the density of the statistics.
The second limit concerns systemic under-reporting: if only 67% of frauds are reported, then the very data underpinning the article reflects a distorted reality. The author acknowledges this explicitly — but the acknowledgement does not dissolve the problem.
The third limit is one of perspective: the article is written from a consciously paternalistic angle — a father viewing the world through concern for his teenage son. This lends the narrative warmth, but may narrow the horizon: not all digital vulnerabilities look the same for a fifteen-year-old girl, for an elderly person, for an undocumented immigrant, or for a small rural entrepreneur.
Internal tensions
The article lives in permanent tension between warning and paralysis. The author wants to prepare, not to frighten. He wants vigilance, not paranoia. But the general tone, however much it is nuanced at the close, remains pervaded by anguish: the breath that catches, the hours that keep him awake, the window open to the cold November air. It is difficult to build pragmatic equanimity on a narrative foundation so saturated with foreboding.
The second tension lies between solutions and inevitability. The chapter on solutions exists and is substantive — continuous verification, behavioural analysis, adaptive systems. But each solution is immediately shadowed by its reverse: the system that learns may learn the wrong things; the guard's guard may be corrupted; the adaptation of defences forces the perfection of attacks. The author offers no false hope, which is honest, but may leave the reader with the sense that the battle is lost before it is begun.
The third tension — perhaps the most productive — is between the collective and the individual. Digital security is presented as a collective responsibility, yet the conclusion returns the burden to the individual: "you alone bear the final responsibility for safeguarding your digital identity." These two assertions coexist in the text without being reconciled — and this is not a weakness but a faithful reflection of the contradictory reality in which we live.
Comparisons — the nervous system of the text
The article functions almost entirely through analogy and comparison. They are not decoration — they are the load-bearing structure of the argument. Several deserve particular mention:
Military comparisons: from carpet-bombing to laser-guided precision strikes; from net fishing to spearfishing; from the solitary craftsman to the modern factory. All of these pursue a single trajectory: the escalation from the massive-and-imprecise to the precise-and-devastating.
Medical comparisons: advanced fraud as an increasingly aggressive cancer; precision surgery versus a street brawl; treating a disease without knowing how many people are infected. Medicine appears as a metaphor for possible control — and for the failure of that control.
Domestic, everyday comparisons: the house with the unlocked door; the spare key found by the thief; the neighbour's dog that bites you yet you keep stroking; the broken thermometer. These democratise technical concepts, bringing them into the reader's kitchen.
Economic comparisons: fraud-as-a-service as a Netflix subscription; black markets with reviews and guarantees; pure capitalism applied to criminality; Uber for crimes. Through these analogies, the author demonstrates that criminals are not extraterrestrials — they are human beings who have applied market logic to domains where it has no right to exist.
Rhetorical tools
Rhetorical interrogation is the dominant instrument. The author does not assert — he asks. "How do you become yourself again when your digital self has become a stranger?" "Who learns faster?" "Who watches the watchmen?" "Is this arms race sustainable?" The questions do not await answers — they open spaces for reflection and transfer the responsibility for thinking to the reader.
The personalisation of data transforms statistics into people: the seventeen-year-old who believes he is earning easy money; the sixteen-year-old who discovers that his identity has been used to commit crimes; the author's own boy who will ask about football in the morning that follows this night of writing. Cold data acquires a face, an age, a voice.
The explicit paradox is another frequent device: companies know they must change, yet do not; people are robbed but continue to trust; solutions increase the complexity of attacks; transparency may kill faster than silence. The article does not resolve the paradoxes — it illuminates them.
Geographical confession — the street in Botoșani, the air that smells of wood smoke, the November morning, the open window — anchors a global subject in a precise and vulnerable place. Botoșani is not a decorative detail; it is an argument in itself: the threats described in this article do not stop at the borders of great cities or great corporations. They come this far — to this window, to this child who will ask about football.
The title as verdict — "We Built a House on Sand" — functions as a condemnation of the entire digital infrastructure we have raised. It accuses no one in particular; it is a diagnosis of civilisation. And the fact that these words belong to Goldman-Kalaydin, not to the author, adds weight: this is not a literary opinion but the testimony of the man who, from the inside, sees the foundations.