Weaponizing trust: How AI and social engineering bypass personal security boundaries
Tue, 8th Sep 2026 (Today)
Fraud syndicates now treat trust as their primary attack surface, opening with friendship or romance on social platforms before introducing fake AI trading tools that promise steady returns. The technology sounds credible because it is designed to, and the relationship feels real because cybercriminals invest time in fabricating it. Victims rarely see the deception until they cannot withdraw their funds.
The Singapore case shows the pattern in practice: A 68-year-old retiree met a supposed AI company employee on TikTok, then moved money across 23 transfers into a fake investment platform. Investment scams cost Singapore victims S$169.8 million in the first half of 2026, the top category in Singapore Police Force data, with an average loss of about S$75,000 per case.
Japan is confronting the same threat at scale. The National Police Agency recorded 79.79 billion yen in social network-based fraud in the first half of 2026, and people in their 60s suffered the heaviest losses of any age group. The Financial Services Agency urges the public to treat social media investment pitches as suspect, including schemes that borrow AI branding to appear credible.
Older adults face disproportionate risk because decades of savings make them high-value targets, and social isolation gives cybercriminals direct access without the organizational safeguards that protect enterprise environments. Applying zero trust to personal finance reduces that exposure: verify every identity through independent channels and ensure no one holds permanent access to funds. Limit what public profiles reveal about age, wealth, and family. Enable multi-factor authentication (MFA) on financial accounts, and require a trusted second person to confirm any large or unusual transfer.
When criminals weaponize trust, verification becomes the strongest defense. Verification must precede every transfer. If an investment opportunity penalizes due diligence, it's likely not legitimate.