/cyberSecurity

A few months ago, someone I know, a retired teacher, almost transferred a lifetime of savings into an account "the bank" had asked him to verify. He got a call, then a text confirming the number he already had on the phone, then a link that opened a page identical to his online banking. The only reason he didn't go through with it is that his daughter happened to stop by that afternoon. This isn't a rare case. It's practically the standard script behind half the fraud circulating right now, and what strikes me most isn't the technical sophistication behind it — it's how little sophistication it actually needs to work. Digital literacy tends to get treated as a problem of "older people who don't understand computers," and that's maybe the biggest trap in how we talk about this. Because it's not really like that. Twenty-year-olds fall for crypto investment schemes with the same ease their parents fall for fake delivery text messages. The channel changes, the pretext changes, but the psychological mechanism underneath is surprisingly similar: manufacture urgency, mimic a recognizable authority, and exploit the gap between what someone thinks they know about online safety and what they actually know. ## Operational Fluency Isn't the Same as Critical Understanding That gap is really the core of the problem. Most users aren't fully illiterate when it comes to digital tools — they know how to use a phone, shop online, send messages all day long. But that operational fluency isn't the same as critical comprehension. People know how to tap a button without knowing how to read a URL. They know how to install an app without checking what permissions it's asking for. It's a surface-level literacy, trained for repetitive tasks, and it collapses completely the moment something falls outside the usual pattern — which is exactly the moment fraud happens. It's worth pausing on a technical point that tends to get misunderstood: modern phishing no longer relies on obvious typos or badly built sites with blurry logos. Phishing kits sold on forums — yes, this is an organized market, complete with technical support, almost resembling a legitimate SaaS product — replicate bank pages, government portals, postal services pixel by pixel. Some even clone valid SSL certificates, which makes that old "check for the padlock" advice pretty much useless. The padlock only tells you the connection is encrypted, not that the destination is trustworthy. It's a small detail, but it illustrates how much of the digital education still in circulation is out of date compared to the actual tactics being used. Then there's the emotional dimension, which technically isn't even "digital" — it's human, just with a technological coat of paint over it. The most effective scams don't exploit technical ignorance, they exploit trust, fear, and haste. A message saying your account will be locked within 24 hours triggers a completely different decision-making process than the same message evaluated calmly on a quiet Saturday morning with no pressure at all. This isn't a character flaw in the people who fall for it — it's essentially behavioral engineering applied with malicious intent. And it works across every education level, because the target isn't intellect, it's the brain's fast-response system. ## Nobody Owns the Problem, So Everyone Pays for It What makes all this worse, at least from what I've seen following online communities for a few years now, is the fragmentation of responsibility. Schools teach computer skills, not digital security — and even when they do teach it, the curriculum rarely keeps pace with how fast tactics evolve. Banks invest in generic warnings nobody reads, like that tiny footer in emails saying "we never ask for your password," ironically placed in the same email that sometimes looks like phishing because of excessive corporate design. Tech platforms, meanwhile, have weak commercial incentive to invest heavily in prevention, because the cost of fraud falls mostly on the user and on the banks, not on them. This creates a strange vacuum where nobody clearly owns the problem but everyone suffers the consequences. And the consequences aren't just financial. There's a psychological cost that rarely shows up in the statistics — the shame of having been fooled, the isolation of someone who stops trusting any digital contact after an episode like this, including legitimate ones. I know of at least one case where the person stopped using online banking for months, going back to handling everything in person at a branch, which ironically exposed them to a different kind of risk and inconvenience without fixing the underlying problem. One aspect that often gets left out of the conversation is the reversed generational imbalance that sometimes plays out within families. It's common to assume younger people teach older ones how to use technology, and to some extent that's true — but when the topic is security, it's often the opposite. Older people, who grew up with stronger instincts around skepticism toward strangers ("don't talk to people you don't know," "don't hand money to someone who calls out of nowhere"), instinctively apply that skepticism to the digital world once someone draws the parallel for them. Younger people, digital natives in the sense of having grown up surrounded by screens, developed an almost automatic trust in any well-designed interface — and that's exactly the trust that fake investment schemes and marketplace scams exploit. ## AI-Cloned Voices Are Changing the Rules It's also worth mentioning a phenomenon that's been growing more quietly: AI-assisted fraud. We're no longer just talking about mass-generated, badly written emails. We're talking about cloned voices — a few seconds of public audio, like an Instagram clip, is enough to generate a fake call convincing enough to fool a close relative. There have been documented cases in Brazil of "virtual kidnapping" scams where a cloned voice of a son or daughter was used to simulate an emergency and extort money from parents within minutes, with no time to verify anything. This completely changes the level of digital literacy required, because it's no longer enough to distrust texts or links — people now need to distrust their own hearing, which is psychologically much harder. So what actually helps, beyond the worn-out advice of "don't click suspicious links," which, let's be honest, has lost its effectiveness from being repeated to the point of becoming background noise? One thing that seems to work better, based on some behavior and security research I've come across, is training lateral verification habits instead of rigid rules. In other words, don't memorize a list of warning signs — memorize a behavior: whenever a message demands urgent action involving money or personal data, stop, leave that communication channel, and contact the entity involved through an independent, already-known method. Call the bank using the number on your card, not the number that came in the text. It sounds obvious written down like this, but under pressure, it's exactly the step most people skip. Another thing I've noticed, more as a personal observation than a settled fact, is that effective digital literacy doesn't teach well in lecture or manual format — it teaches through repeated exposure to real examples, ideally close to the person. Showing a family member a screenshot of a scam that caught a neighbor has more impact than any institutional infographic. There's something about recognizing the pattern in a concrete context that drives far more retention than the abstraction of "be careful of online scams." Platforms carry real responsibility here too, and it's not just symbolic. Anomaly detection systems for transfers, deliberate delays on high-value transactions to allow time for "second thoughts," contextual warnings at the exact moment of decision instead of unreadable terms of service read once and forgotten — all of this reduces harm in measurable ways, and mature technology already exists to implement pretty much all of these mechanisms. The problem is rarely technical. It's about priorities and business models. At the end of the day, what's at stake isn't just lost money, though that alone is serious enough. It's the gradual erosion of trust in the very digital tools that, used well, should make people's lives easier instead of exposing them. A society where more and more people avoid digital tools out of fear, or where more and more people trust blindly out of alert fatigue, are two extremes of the same collective failure to build real literacy — the kind that isn't limited to knowing how to use technology, but to understanding, even at a basic level, how and why it can be used against us. Maybe the more honest question to ask isn't "how do we better educate users," but rather why we keep placing almost all the responsibility on those with the fewest tools to defend themselves, while the people who design these systems — and who profit from their speed and minimal friction — remain largely unaccountable.