INTERVIEW Mihailović: Fraudsters are targeting citizens' trust

Modern internet fraud relies less and less on the technical unsophistication of the victim and more and more on professionalized manipulation of the user. Fake portals, misuse of the identities of well-known media and institutions, sponsored ads and content generated by artificial intelligence are changing the way citizens should think about digital security.

What makes it difficult for users to distinguish real content from content that is created with the aim of manipulating it, how artificial intelligence complicates it, who is responsible, what regulations... Andreja Mihailović, manager of the Innovation Hub for Cybersecurity at the University of Montenegro (UCG), talks about this for "Vijesti".

Fraud is becoming more and more convincing. What makes it most difficult for a citizen to recognize that something is fake today?

Modern digital fraud relies less and less on the technical unsophistication of the victim and more and more on professionalized manipulation of the user. Today's campaigns use visually almost identical copies of legitimate media and institutions, internet addresses that differ minimally from the original, stolen logos and identities, compromised accounts, sponsored ads, fake comments and reviews, fake profiles of experts, banks or public officials, and increasingly synthetically generated audio-visual content.

Generative AI is further changing the way scams are prepared and executed. It is now much easier for a scammer to produce grammatically flawless text, a personalized message, a convincing visual identity, a voice imitation, or a convincingly altered video. This reduces the number of indicators that users have traditionally relied on to recognize a scam.

We recently had an example of the misuse of the identity of “Vijesti” and the name of Prime Minister Milojko Spajić for a false investment offer. Why are such scams so convincing?

The example you cite, where the identity of "Vijesti" and the name of Prime Minister Milojko Spajić are used to induce citizens to invest, represents a combination of several very effective techniques: misrepresentation, abuse of the media's reputational authority, the psychological tendency to trust authorities more, and a financial incentive based on the expectation of profit.

It is particularly problematic when fraud passes through legitimate digital infrastructure: a social network, advertising system, search engine, or communication application, because presence on a well-known platform creates an additional illusion of credibility for the average user.

That's why it's no longer enough to tell users to “not click on suspicious links.” The problem is that a link, ad, or portal often no longer looks suspicious, and the key competency of a modern user is not intuitively recognizing fraud, but verifying authenticity through an independent channel.

How should citizens be taught digital security?

The most effective approach to digital security is not based on conveying definitions, but on developing the ability to recognize risks and make the right decision in a specific situation.

It is more useful for a citizen to show the difference between an authentic and a fake bank message, simulate an attempt to download a one-time security code, or demonstrate how to verify an internet address, sender identity, company registration, or source of media content than to familiarize them with terminology without practical context.

Such education should be based on scenarios that mimic real fraud patterns: fake banking messages, investment offers, job advertisements, compromised accounts, fake online stores, urgent payment requests, or messages that misuse the identity of public institutions.

The goal is not for the user to remember the name of a particular type of attack, but rather to develop the habit of checking before clicking, submitting data, confirming a transaction, or making a payment.

To what extent are internet frauds today actually related to financial literacy and psychological manipulation?

The financial component of digital security is particularly important. A significant portion of modern internet fraud lies at the intersection of cybersecurity, financial literacy, and psychological manipulation.

An attacker often does not need to compromise an information system if they can convince the user to reveal access data, approve an authentication request, install an application, transfer funds, or trust a fraudulent investment offer. In this case, the technical protection remains formally intact, but the security goal is still achieved.

This is why social engineering attacks often focus primarily on the user's decision-making process. They exploit authority, urgency, fear of financial loss, the promise of profit, social validation, or a sense of trust.

Education that ignores these mechanisms leaves the user prepared to recognize the term, but not necessarily the manipulation at the moment it occurs.

Can the responsibility for protecting citizens rest solely with the individual?

Cybersecurity cannot be based on a model in which the last line of defense is always an individual, and after an incident it is concluded that "the user clicked the wrong link", because such an approach ignores the fact that the user operates within a broader digital ecosystem in which there are platforms, advertising systems, banks, telecom operators, media, digital service providers and government authorities.

What should be the role of different actors, from schools and media to banks and telecom operators?

Schools should develop practical competencies in source verification, digital identity protection, phishing, manipulative techniques, investment fraud, and synthetic content recognition. Therefore, special emphasis should be placed on critical decision-making in the digital environment.

Media outlets play a particularly important role when their identity is misused. If a fake portal or advertisement appears that uses the name and graphic identity of a particular media outlet, a quick and visible warning to the public can directly prevent financial damage. Protecting the integrity of the media brand in such situations also becomes a matter of citizen cybersecurity.

Banks and other payment service providers have data and technical mechanisms that can enable the recognition of certain anomalies in transactions. Preventive warnings, additional verification of unusual payments and rapid channels for reporting fraud can be crucial at the moment when user manipulation turns into concrete financial damage.

Telecom operators play a significant role in the fight against spoofing, SMS phishing, and other forms of abuse of the communications infrastructure.

What is the role of large online platforms?

Online platforms can no longer reduce their role to neutral technical mediation when their advertising or recommendation systems enable the distribution of fraudulent content to a large number of users.

The European Digital Services Act therefore introduces a more developed model of duties for large online platforms, including the assessment of systemic risks associated with the misuse of their services, misleading content, and the functioning of advertising and recommendation systems.

This is an important regulatory change: the focus shifts from the sole responsibility of the individual to the sharing of responsibility across the entire digital intermediation chain.

Does artificial intelligence further increase risk?

Yes, on two levels. First, artificial intelligence enables extremely effective personalization of fraud. Based on publicly available data, it is possible to adapt the content to the language, profession, interests or financial position of the potential victim. This makes the manipulation of the user more convincing.

Second, synthetic content reduces the evidentiary value of what the user sees or hears. A photo, audio recording, or video can no longer have the intuitive credibility they once had.

Can regulation address this problem?

The European Artificial Intelligence Act therefore introduces specific transparency obligations. Article 50 provides, among other things, for the obligation to label certain content generated by artificial intelligence in a machine-readable format and for the obligation to disclose when image, audio or video content that constitutes a convincing artificial imitation of reality has been generated or manipulated.

However, there is a fundamental limitation to the regulatory response: a legitimate provider of an AI system may be required to comply with transparency rules, while a person intentionally using AI to commit fraud will not voluntarily flag content as fake.

Therefore, technical labels and regulatory rules must be accompanied by detection mechanisms, platform accountability, rapid removal of fraudulent content, effective reporting, and the ability of users to conduct independent verification.

What is the minimum that every citizen should adopt?

The goal is not for every citizen to become a cybersecurity expert, but rather to develop a minimum set of verifiable procedures: stop, check the source, verify identity through another channel, assess the financial logic of the offer, do not share authentication data, and do not approve an action that you did not initiate yourself. It is at this level that real digital resilience of citizens is built.

The legal dimension of fraud

What is the legal dimension of fraud, and is it important to avoid automatically identifying every fraud with computer crime?

It is very important from a legal perspective to avoid automatically identifying every fraud committed via the Internet with computer crime in the narrow sense. The Internet can only be a means of committing classic fraud. If the perpetrator, by misrepresenting or concealing facts, has misled a person and induced them to make a voluntary payment, the legal analysis can primarily move within the framework of the criminal offense of fraud.

A different situation exists when the unlawful gain is achieved by entering, changing, deleting or otherwise influencing computer data or the functioning of a computer system. Then the issue of computer fraud as a special form of cybercrime can be raised. This distinction is important because the fact that WhatsApp, Telegram, a website or a social network is used as a communication channel does not in itself transform a classic fraud into a computer fraud.

In more complex schemes, other issues of criminal liability may arise, depending on the organization of the system, the role of individual persons, the flow of money, the manner in which data is obtained and used, and the possible existence of organized activity, and the final qualification depends on the established facts and belongs to the state prosecutor and the court. There is also a second regulatory dimension. If the offer is made by a trader or a person presenting himself as a service provider, consumer protection rules may become relevant, in particular the prohibition of misleading and aggressive business practices. Likewise, if personal data is obtained, used or further processed in the context of fraud without authorization, a separate issue of data protection arises.