A device can be free of malware while its owner is being persuaded to send money to a scammer.
That reality deserves more attention whenever we discuss online security. A fraudulent investment platform, a convincing impersonation call or a fake customer support conversation may succeed without installing anything on the victim’s device. The damage can happen through an ordinary browser, a messaging app or a phone call.
This is why security researchers and developers must continue strengthening anti-scam technologies and finding smarter ways to prevent fraud. Protecting devices remains essential, of course, but protecting the people using them requires a broader approach. Because the deception is becoming more convincing. We can argue that scams existed long before generative AI. So why are we paying them that much attention now? What AI changes is the ease with which criminals can produce convincing material and repeat their attempts at scale. I repeat: convincing at scale.
Online scams have become very lucrative and the financial incentive is enormous. In recent years it has been documented that criminals are using generative AI to create persuasive messages, fictitious profiles, fraudulent websites, cloned voices and misleading videos. These tools reduce the effort needed to build a believable story and can remove familiar warning signs, including poor grammar and awkward language. Basically, some of the elements that used to give away a phishing email are disappearing. And together with the proliferation of deepfakes, scams will become increasingly difficult to distinguish.
Part of the explanation lies in the economics of reaching people online. A fraudulent message can be distributed widely, while a fake website or fabricated identity can be used repeatedly. Scammers do not need everyone to believe them. When the potential audience is large enough, even a small proportion of successful attempts can make a campaign financially rewarding. AI further strengthens that incentive by reducing the work needed to produce convincing content, by generating messages faster, reaching wider audiences and overcoming language barriers. This makes it easier to repeat and adapt their attempts across different audiences, and they can easily expand their scam tactics globally. The potential payout also helps explain why some fraudsters invest considerable time in an individual target. While one scheme may seek a small payment from many people, another may build trust around a fictitious relationship or investment opportunity, aiming for much larger transfers.
Europol’s 2026 threat assessment also highlights the growing use of generative AI to tailor social engineering tactics and accelerate online fraud. This is an ongoing development in how criminals operate, rather than a distant possibility. It's a reality that makes itself felt in various parts of the world.
For netizens, the implication is uncomfortable. Professional wording, a familiar voice or a convincing image cannot establish authenticity on their own. Imagine receiving a voice message that sounds like a relative asking for urgent financial help. Or seeing a video of a well-known person apparently endorsing an investment. The crucial question becomes whether the request can be independently verified.
We also need to ask ourselves the following three questions: who is contacting us, what are they asking us to do, and what evidence supports their claims? Think of it as a safety triangle.
In my view, this should remain a central priority for security research: identifying deception early enough to interrupt it before someone shares credentials, reveals sensitive information or sends money. That means continuing to develop capabilities such as earlier detection of fraudulent websites and impersonation attempts, including newly created campaigns, analysis of suspicious messages and conversations, looking for combinations of urgency, secrecy, payment pressure and identity manipulation, offering accessible ways to check questionable content, so people can seek guidance before acting, and last but not least, providing clear, actionable warnings, explaining the concern and offering a practical verification step.
These should be development priorities, but they're not a promise that any security product can recognize every scam. Fraud detection must also account for false alarms, privacy and the limits of what a security tool can observe. AI-generated content detection alone will not solve the problem either. Legitimate content can be AI-generated, and a scam can be written entirely by a person. The broader objective must be to recognize fraudulent intent and behavior, using multiple signals.
People should not have to become fraud investigators. Education matters, but be more careful places too much responsibility on the person being targeted. Someone facing an apparent family emergency or a frightening account warning may be making decisions under considerable pressure. Better protection should make verification easier. A useful warning should help someone understand why a request is suspicious and what to do next. Better protection should help relieve the pressure by providing clarity and confidence to the end user.
So here we are, searching for a broader definition of protection. A good antivirus, secure operating systems and timely updates remain foundations of cybersecurity. Alongside them, I think we need continued investment in technologies that protect identities, accounts, privacy and financial decisions. The genuine holistic approach of protection must include what happens to the person, as well as what happens to the device. That is why anti-scam research deserves sustained attention. As deception becomes easier to produce and harder to assess, cybersecurity must help people navigate the situations in which trust itself is being exploited. We need to make fraudulent approaches easier to recognize, harder to distribute and less likely to succeed, reducing both the harm to victims and the financial rewards that motivate further attempts.
