Here’s something that keeps me up at night: the criminals winning at cybercrime today probably couldn’t write a line of code if their lives depended on it. That’s a massive shift from what most people imagine when they think about hackers, and it’s actually far more dangerous than the old model ever was.
For decades, we built our understanding of cyber threats around the idea of the sophisticated attacker—someone hunched over a keyboard, crafting malware, exploiting zero-days, breaking through firewalls. It made for good Hollywood material. But that narrative is killing us. It’s killing us because it’s mostly wrong, and worse, it lets the real problem hide in plain sight.
The Democratisation of Crime
The seismic shift happened when scamming tools and techniques became accessible to anyone with basic internet access and zero technical skills. Think about what that means. A person with minimal education, no programming knowledge, and no sophisticated infrastructure can now run global fraud operations. They don’t need to hack anything. They don’t need zero-day exploits. They need a phone, internet connection, and frankly, a willingness to deceive.
What’s enabled this? Mostly mundane things:
- Readily available phishing templates and scripts shared on forums
- Pre-built credential-stealing kits sold for pocket money on dark web markets
- Social engineering tactics that work because humans are predictably human
- Payment systems and money laundering services that operate in the cracks of regulation
- Massive databases of stolen personal information freely distributed online
What strikes me most is that none of this requires genius-level technical ability. It requires patience, shamelessness, and an understanding of human psychology. And honestly? That combination is far more common than actual coding talent.
The Platform Problem We Keep Ignoring
Here’s where it gets complicated. These scammers thrive because digital platforms have become the infrastructure of fraud. They’re not just victims of abuse—though they genuinely are—they’re also the enablers. And I mean that not as blame, exactly, but as fact.
Consider what happens when a fraudster operates: they use messaging apps to contact victims, social media to build fake credibility, payment systems to move money, and cloud services to store stolen data. Every single one of these platforms has safety mechanisms. Every single one claims to fight fraud. Yet the problem only grows.
Why? Because there’s a fundamental tension. Platforms profit from user activity and growth. Adding friction to fight fraud means losing users and engagement. They’ll add detection systems, sure, but these are reactive, not preventive. They catch fraud after it happens, when the damage is already done and the money is already moving through multiple jurisdictions.
The uncomfortable truth is that platforms have limited incentive to make it genuinely hard for scammers until governments force their hands. And even then, they’ll do the minimum required to satisfy regulators while maintaining their user experience.
What Actually Needs to Change
If we’re serious about this—and I’m not convinced we are—we need platforms to become genuine partners in prevention, not just reactive cleanup crews.
This doesn’t mean surveillance states. It doesn’t mean destroying privacy. But it does mean:
- Platforms sharing fraud intelligence with authorities and with each other, not just collecting it
- Verification systems that actually verify something, not just create friction for legitimate users
- Consistent enforcement across regions instead of playing jurisdictional whack-a-mole
- Making money movement slower and more transparent when patterns look suspicious
- Training platform moderators and support staff to recognise scam indicators, not just violations of terms of service
The real challenge is that each of these measures has edge cases and unintended consequences. Slow down money movement and you hurt legitimate international transfers. Make verification harder and you exclude people without access to traditional ID. Share data too broadly and you create new security risks.
These aren’t excuses to do nothing. They’re reasons to think carefully about what we’re optimising for. Right now, we’re optimising for platform growth and user convenience, with fraud prevention as an afterthought. That needs to flip.
The scammer of 2024 isn’t a villain from a techno-thriller. They’re often someone running a fraud scheme from a call centre in a country where law enforcement can’t easily reach them, using tools that anyone can download, targeting victims based on templates that have been refined through thousands of attempts. They don’t need to be smart. They need the system to keep working the way it always has—which it does, reliably and profitably.
Until we redesign that system, talking about cybersecurity is mostly theatre. We’ll catch some scammers, we’ll improve some policies, we’ll add more security features that most people ignore. Meanwhile, the basic machinery of fraud keeps humming along, powered by our own digital infrastructure and our stubborn refusal to ask hard questions about what it’s actually optimised for.
Source: Platforms as Partners: Rethinking India’s response to cyber crime
Natalie Foster
James Holloway