This happens to everyone, the average person checks their phone about 144 times a day. But that isn’t because you lack self-control. It happens because apps are engineered to pull you in, leaving you trapped in a cycle of constant distraction. To break this cycle, the usual advice is a “digital detox”, putting your phone away for a weekend. But when Monday arrives, normal life resumes and you end up right back where you started.

To create lasting change, you need more than a temporary pause. You need a permanent shift in mindset: Digital Minimalism.

What is Digital Minimalism?

Digital minimalism is the philosophy of intentional technology use. Instead of trying to run away from screens, you focus your online time on a small number of carefully selected tools that directly serve your real-world values and happily ignore the rest.

While a digital detox forces a brief period of abstinence, digital minimalism changes how you make choices for the long haul. The problem was never the screen itself; the problem was using it on autopilot. But to take back control, you first have to understand the forces pulling you in.

Why Mindless Habits Take Over: How Apps Hook You

Your phone pulls your focus because most free apps are built to drain your time. They stay profitable by keeping your eyes on the screen:

• Your reaction is the product: Apps do not care if you feel happy or angry, as long as you remain engaged so they can show you ads.

• Alerts trigger your brain: Notifications act like slot machines. A simple buzz creates a spike of anticipation before you even have time to think.

• Your feed is a mirror: Algorithms feed you more of what you already click on, trapping you in an endless loop of scrolling.

Understanding these psychological traps reveals why simple willpower isn’t enough to stop the pull. Instead of fighting the design of your phone every single day, digital minimalism allows you to redesign your relationship with technology from the ground up.

From Awareness to Action: How to Practice Digital Minimalism

Practicing digital minimalism is not about giving up tech entirely, not all screen time is bad. Using your phone to learn, create, or keep in touch with loved ones enriches your life. The goal is simply to eliminate the mindless noise so you can preserve your energy for what matters.

You can build this intentional lifestyle using three connected pillars:

1. Reclaim Your Physical Environment

Because willpower drains throughout the day, altering your surroundings makes staying intentional effortless:

• Charge your phone away from your bed: Keep it across the room so it isn’t the first thing you grab in the morning.

• Hide tempting apps: Move social media off your home screen into hidden folders to cut off automatic tapping.

• Turn off screen colors: Switch your display to grayscale in your phone’s settings to remove the visual rewards of vivid apps.

• Set clear boundaries: Turn off alerts during meals, or disable non-essential notifications entirely.

2. Practice Intentional Selection

Once your environment is clear, begin curating what you allow back into your digital life:

• Ask why: Keep an app only if it directly serves a clear, real-world purpose.

• Clean your feed: Block or mute accounts that leave you feeling anxious or drained.

• Swap habits: Replace empty scrolling with tangible activities like journaling, reading, or a physical hobby.

3. Listen to Your Body’s Warning Signals

As you change these habits, pay attention to physical cues that signal you are slipping back into old patterns:

• Exhaustion immediately after using an app

• Sudden anxiety when your phone isn’t within reach

• Difficulty staying focused on a book or conversation

These signals aren’t proof of weak discipline; they are just early indicators that your environment needs a quick tune-up. Catching them early keeps small distractions from becoming overwhelming habits. I’ve covered digital overload in more detail in a previous post: The 4 Warning Signals: How Your Body and Mind Signal Digital Overload.

Easy Ways to Start Today

Transitioning to a minimalist approach doesn’t have to happen overnight. You can start building momentum today with three simple steps:

• Set a daily offline window: Choose 1 to 2 hours every day to keep your phone in another room completely.

• Trade scrolling for living: Swap 10 minutes of social media for a quick walk, a few pages of a book, or calling a friend.

• Audit your emotional state: Pay attention to how you feel after using specific apps. If an app consistently leaves you feeling worse, delete it.

Taking Back Control

Picture that opening moment once more: your friend is talking, and your phone buzzes.

Before, your eyes would drop automatically. But now, understanding how apps fight for your attention and having a minimalist system to protect it - you are in control. The buzz no longer dictates your focus. Next time your screen lights up, you get to choose what actually deserves your time: the distraction in your hand, or the real world right in front of you.

Your time is your real life. Do not give it away for free.

References & Interesting Reads:

Phone-checking frequency

• Kim Komando / USA Today, “Study shows people check their phones 144 times a day” (2024): yahoo.com/lifestyle/study-shows-people-check-phones-091353535.html

• Alicia Adamczyk, “Americans check their phones 144 times a day. Here’s how to cut back,” Fortune (July 19, 2023): fortune.com/well/2023/07/19/how-to-cut-back-screen-time

Notification/dopamine mechanism (VTA, nucleus accumbens, 100-200ms latency)

• Wolfram Schultz, “Predictive Reward Signal of Dopamine Neurons,” Journal of Neurophysiology, 80:1-27 (1998): journals.physiology.org/doi/full/10.1152/jn.1998.80.1.1

• Schultz, “Reward Signals,” Scholarpedia: reports reward-related dopamine neuron activations with latencies under 100ms and durations under 200ms: scholarpedia.org/article/Reward_signals

Digital minimalism framework

• Cal Newport, Digital Minimalism: Choosing a Focused Life in a Noisy World (2019): calnewport.com/books/digital-minimalism

Let’s go through what actually could happen when you connect to the wrong network.

The Network Threats Are Real

Here’s the setup. An attacker sets up a rogue Wi-Fi hotspot near a legitimate one. They name it something close enough to fool you, Cafe_Guest_Secure instead of Cafe_Guest. You don’t check to verify, you trust and you connect. Now every piece of data you send passes directly through their hardware first. This is called an “Evil Twin” Man-in-the-Middle (MITM) attack, someone positioning themselves right between you and the internet.

Because you are connected directly to their device, the attacker doesn’t even need to use passive packet sniffing to capture your traffic; they are your network gateway.

Without encryption, your data is completely readable. The attacker quietly reads everything passing through - passwords, session cookies, private messages, in real time while you keep typing.

Maybe you’re thinking: sure, but who actually falls for that? Reasonable question. Here’s the answer.

Evil Twin Attacks: A Fake Network Wearing a Real One’s Name

In November 2025, an Australian court sentenced a 44-year-old West Australian man to seven years and four months in prison. He’d been running evil twin networks on domestic flights and at airports in Perth, Melbourne, and Adelaide since at least April 2024. It wasn’t some elite hack. He created fake free Wi-Fi access points to collect personal information from unsuspecting passengers. Passengers connected after mistaking the rogue access point for a legitimate service, typing their credentials into a fake page to gain access. The scam was finally discovered by a flight attendant who noticed a suspicious network name and reported it.

The Australian Federal Police (AFP)’s advice after their case was simple: a network that asks for your social media passwords or private account credentials just to grant Wi-Fi access should never be trusted. Legitimate hotspots won’t ask for your private logins.

A similar case turned up on a Delta flight from Las Vegas to Atlanta. An attacker sent hidden disconnect signals through the airwaves to forcibly kick passengers off the plane’s official Wi-Fi. Right alongside it, they broadcast a fake network named “DELTA WIFI FAST”. Frustrated by the sudden drop and eager to get back online, unsuspecting passengers reconnected straight to the trap. Once the crew discovered what was happening, they had to shut the plane’s Wi-Fi down completely for half an hour to clear the threat.

High-traffic environments like flights, subway terminals, or local cafes rely entirely on users blindly trusting the network name they see. Cybercriminals exploit that automatic trust.

What can protect you

Lock Down Your Network Path

• Verify the network name: Don’t trust the name alone, confirm the exact Wi-Fi network name out loud with staff if you’re unsure.

• Use a VPN: A VPN wraps all your network traffic in an encrypted tunnel before it leaves your device. Even if you land on a compromised network, the attacker cannot inspect or tamper with your data traffic.

• Check for HTTPS: Ensure your browser displays https:// and the lock icon in the URL bar before entering sensitive details.

• Save sensitive tasks for trusted networks: Handle banking, taxes and high-value logins on your home network or mobile data, never on open public Wi-Fi.

Harden Your Device Before You Step Outside

• Turn off “Auto-Connect” for Wi-Fi and Bluetooth: This is the exact setting that lets rogue “Evil Twin” networks catch users off guard when their devices reconnect automatically to a Wi-Fi name that looks familiar.

• Turn off local sharing: Disable AirDrop, Nearby Share, and local file/printer sharing when out in public.

• Enable Multi-Factor Authentication (MFA): MFA blocks attackers who only have your password. Just remember: never enter your MFA codes or passwords into unexpected Wi-Fi login pop-ups.

Treat public Wi-Fi like what it is - a room full of strangers, not your home office. Never leave a device unattended in a public space, not even for 30 seconds.

References

• Australian Federal Police, “WA man jailed for stealing intimate material and using ‘evil twin’ WiFi networks”, November 28, 2025

• CBS News Atlanta, “Possible hoax Wi-Fi network on Delta flight to Atlanta under investigation”, August 2026

• Delta flight carrying DEF CON “hackers” hit by Wi-Fi attack mid-air, August 2026

In January 2024, a finance employee at the engineering firm Arup’s Hong Kong office joined a video call with people he believed were the company’s CFO and several colleagues. He’d already been suspicious of an earlier email requesting a confidential transfer, but seeing familiar faces and hearing familiar voices on the call put him at ease. He went on to make 15 separate transfers totaling HK$200 million, about $25.6 million. Every person on that call was an AI-generated deepfake, built from public footage of the real executives. The money was never recovered. It’s one of the largest AI-powered frauds on record, and it happened to a company with 18,500 employees and a security team. The uncomfortable reality is that our digital likenesses are under constant evaluation by scraping networks. But here is what no one tells you: you are not powerless. Today, we are breaking down the exact science of deepfakes, walking through simple, beginner-friendly tools, and uncovering the legal frameworks that back you up right now.

How Deepfakes Work: The Science Behind the Scams

To defeat a deepfake, you first have to understand how the technology builds them. Remember this core fact: AI cannot build a model of you without clean, high-quality reference data. Your public photos and videos are the raw fuel for their engine. If we corrupt or cut off that fuel, the engine stalls completely.

Deepfake relies on a specific type of artificial intelligence called deep learning. High-quality deepfakes are usually created using two main frameworks.

Autoencoders: The Digital Translators

The first framework utilizes Autoencoders. Think of this like a digital translator. The AI takes a video of Person A and runs it through an ‘Encoder,’ which translates their face into fundamental data points, like the precise distance between eyes, the curve of a jaw, or the motion of lips. Then, it uses a ‘Decoder’ programmed for Person B to reconstruct those exact movements using Person B’s features. The result is Person B’s face perfectly mapped onto Person A’s real body movements.

Generative Adversarial Networks (GANs): The AI Cat-and-Mouse Game

The second framework uses a GAN - Generative Adversarial Network. This is essentially a high-speed game of cat and mouse inside a computer. One AI model, the ‘Generator,’ creates a fake image. A second AI model, the ‘Discriminator,’ evaluates it to see if it can spot the forgery. They train against each other millions of times in a matter of hours. The Generator fails, learns, improves, and tries again until its fakes are so perfect that even the detective AI can’t tell them apart.

How to Spot a Deepfake: 3 Visual & Auditory Clues

Even though this technology is evolving at breakneck speed, human observation combined with healthy skepticism remains a powerful first line of defense. AI models still make subtle structural mistakes, which we call artifacts. When you are looking at a video that triggers a strong emotional reaction, look for three critical indicators:

• The ‘Uncanny Blur’: Look closely at the jawline, the hairline, and the ears. When a person in a deepfake turns their head quickly, the AI digital mesh frequently struggles to keep pace, causing a brief, unnatural lag or soft blurring where the face meets the neck.

• Mismatched Lighting in the Eyes: In a real video, light reflects symmetrically across both pupils because they are catching the same ambient light source. Deepfakes often generate left and right eyes independently, leading to mismatched reflections or strange, dull pupils that don’t match the environment’s lighting.

• Lip-Sync Lag on Explosive Consonants: Pay close attention to hard, explosive consonants like P, B, and M. To pronounce these words, human lips must physically press together completely. In many voice-cloned deepfakes, the audio track and the actual physical positioning of the lips fall out of alignment by fractions of a second. If it feels off, it probably is.

Your Legal Protections and Global Safeguards

What happens if a deepfake gets made? Many people feel helpless because they think the internet is a lawless wild west. But that is no longer true. You are protected by growing global frameworks that tech giants are increasingly held to.

Global Safeguards: Digital Nutrition Labels

Under international accords like the G7 Hiroshima AI Process, the world’s leading technology developers are pushing to build safety mechanisms into their systems. Major entities, including Adobe, Microsoft, OpenAI, Google, and Meta, have backed a standard called C2PA Content Credentials.

Think of this like a cryptographic digital nutrition label embedded into synthetic media files at the point of creation. It’s a real and growing part of the defense but it isn’t an automatic shield. The credential can be stripped by something as simple as a screenshot or a social media re-upload, and it only exists at all if the tool that generated the content chose to embed it, which most AI generators in use today don’t. Microsoft’s own 2026 integrity report put it plainly: no single method- provenance, watermarking, or fingerprinting, can stop this on its own. Treat it as one signal among several, not a guarantee, and don’t assume it shields you regardless of where you are or what platform the content lands on.

Domestic Laws and Rapid Takedown Demands

Alongside global protections, domestic laws have evolved to give you immense local leverage. For example, in India, the legal landscape was updated to deal directly with synthetic fraud under the Bharatiya Nyaya Sanhita and the Information Technology Rules.

Under these IT mandates, social media networks operate under a ticking clock and it keeps getting shorter. The original 2021 rules gave platforms 36 hours to remove a reported deepfake. As of a February 2026 amendment, that window was cut to just 3 hours for most synthetic content flagged through a court order or government notice, and to 2 hours for the most severe category, like non-consensual intimate content. If a company ignores a valid order, they risk losing their ‘Safe Harbor’ legal immunity, making the platform directly liable. To enforce this, you don’t need a lawyer, simply document the link, take screenshots, and submit an immediate report through the government’s centralized portal at cybercrime.gov.in. The system handles the rest.

Take Action: Establish a Family Security Plan

Finally, establish a personal safety contract with your inner circle. Sit down with your family and choose a unique, memorable ‘safe word’ or passphrase known only to you. If you ever receive a chaotic, high-pressure phone call demanding immediate financial assistance, simply ask for the safe word. If they cannot give it to you, hang up immediately. No safe word means no action.

AI is spreading incredibly fast, but technology cannot take away your persona unless you let it.

References:

• CNN, “Arup revealed as victim of $25 million deepfake scam involving Hong Kong employee,” May 2024 https://www.cnn.com/2024/05/16/tech/arup-deepfake-scam-loss-hong-kong-intl-hnk

• Ecorpit.com, “India’s IT Rules 2026: deepfake takedown and AI-labelling,” on the 3-hour and 2-hour takedown windows effective February 20, 2026 https://ecorpit.com/india-it-rules-2026-deepfake-takedown-ai-labelling/

• Truescreen.io, “What Is C2PA? The Standard, Its Metadata and Real Limits,” on the limits of C2PA provenance and Microsoft’s February 2026 Media Integrity and Authentication report

  https://truescreen.io/articles/c2pa-standard-history-limitations/

• Deepidv.com, “C2PA & Content Provenance vs Deepfakes (2026),” on the C2PA coalition’s founding members and standard overview https://www.deepidv.com/media/articles/c2pa-content-provenance-digital-watermarks-fight-deepfakes

Here’s a number that should stop you: 1,409 accounts. 500 on Facebook, 904 on X, working together, hiding in plain sight for three straight years, posting content designed to look like real people talking.

I want you to sit with that for a second. A coordinated machine, not one person, not one bad actor, and it didn’t need to be clever to work. It just needed to be loud, and consistent, and the algorithm did the rest.

That’s the world we’re actually in now. “Watch out for catfishing” doesn’t even begin to cover it. Let’s talk about what’s really going on. So you know exactly what you’re looking at the next time something online feels a little too perfect, or a little too coordinated.

First Thing First: It’s Not Just One Kind of Fake

Fake profiles exist on a spectrum, and their intentions differentiates what you’re actually up against.

The lonely one: Some fake profiles are almost innocent. Someone builds a better version of themselves online because their real life isn’t giving them what they need - attention, validation, a place to feel seen. Or they’re exploring a part of themselves they’re not ready to attach their real name to yet. This isn’t who we need to worry about.

Catfishing: The one you probably already know - the romance scam. Someone spends weeks building a connection with you, learning what you care about, mirroring it back. Then a crisis hits, and because you feel like you know this person, you send the money. Except they never existed. In India, this has grown into organized scam operations, some running blackmail schemes built around private photos and threats.

The local impersonator: This is the one that shows up in your neighborhood group, your community page. It used to be easy to catch - wrong name, wrong face, something off. Not anymore. Now the names sound like your names. The locations sound like your streets. They comment like they actually live there. The tell is rarely what they say - it’s what they choose to comment on, and how it doesn’t quite fit the way a real local person behaves.

The mob-starter: This is where it stops being about one person and starts being dangerous for everyone. A small group of coordinated fake accounts picks up an unverified rumor, spreads it before anyone officially has confirmed anything - they push it hard and fast across social media platforms like WhatsApp, X. India has lived through this more than once, and it’s not an abstract risk. We’ll get into exactly how in a minute.

The illusion machine: This is where you need one new word: astroturfing. It just means making a fake movement look like a real, grassroots one - like fake grass instead of real grass. There’s nothing organic about it, but it’s built to look organic. A single coordinated network can do this at a scale that’s hard to imagine until you see the actual numbers.

The state-level operation: At the very top of this spectrum sits something bigger than any single account or network, a complete infrastructure. Entire fake media ecosystems, built and maintained for over a decade, designed to shape how whole countries see each other. The goal at this level isn’t to convince you of one lie. It’s to bury you in so many conflicting, fabricated stories that you stop trying to figure out what’s true at all. There’s a term for that: epistemic nihilism. It just means giving up on the idea that truth is even findable. And a society that stops believing truth is findable can’t agree on anything. Can’t trust its own government. Can’t trust its own neighbors.

Six categories, using the same tool but with different intentions. Here’s what it actually looks like when each of these plays out for real.

Why This Isn’t Just Talk

The illusion machine, in practice:

Remember the 1,409-account network from the start of this?

That network, according to NewsGuard, was an India-aligned network. What does that mean? Basically, every post pushed the same direction: Pro-India, Pro-Modi government, Pro-military. It hammered India’s rivals, mainly Pakistan, along with China, the Maldives, and Bangladesh. Investigators never proved exactly who was behind it, they found patterns that pointed toward a possible link to the Indian Army, but they were careful not to claim more than that. I’m not going to pretend it’s more settled than it is.

What is settled: it ran completely undetected from September 2021 through late 2024. It used AI to write and post content, and each account was pushing out up to 10 posts a day. At peak, that’s roughly 14,000 posts a day, flooding the feed you scroll through every morning. Over three years, that adds up to millions of AI-written posts, all designed to look like real people talking.

Around the anniversary of Jammu and Kashmir losing its special status in 2019, the network did something even more targeted. Dozens of fake accounts took on local, Muslim-sounding names - Khan, Bhat and flooded the region’s hashtags with praise about peace and unity. Not to convince anyone of anything specific. Just to drown out the real, dissenting local voices under a wave of fake ones, until the loudest opinion in the room wasn’t a real opinion at all.

The same network also reposted content from real, mainstream Indian outlets and accounts tied to the military, over and over, swarming comment sections until it looked like the whole country agreed on something. In June 2024, a page pretending to be a real news outlet posted criticism of Pakistan’s military. Within minutes, not hours, minutes - 429 fake Facebook accounts inside this same network reshared that exact post, word for word, all using the same hashtag. That’s not a story catching on. That’s a machine flipping a switch, and the platform’s own algorithm mistaking it for real momentum and pushing it to more people.

Investigators ran the network’s text through AI-detection tools, and it came back “highly likely” fully machine-written. A few people, sitting behind some keyboards, could run thousands of convincing fake personas at once. That’s not a conspiracy theory. That’s what generative AI makes possible now.

The mob-starter, in practice:

Before ethnic violence broke out between the Kuki and Meitei communities in Manipur on May 3, 2023, tensions were already being inflamed online. Once the violence actually started, it got worse. A graphic photo started circulating on WhatsApp, Facebook, and X, with coordinated posts falsely claiming it showed a local Meitei woman who had been seriously harmed by Kukis. Fact-checkers traced the photo, it had nothing to do with Manipur at all, it was months old and from a completely different place. But by the time that came out, the image had already done its job. It had already made people want revenge. Similarly, a false claim about a village being burned, ended up leading to actual villages being burned.

When researchers later pulled 2.76 million tweets about Manipur from that first month of violence, they found something telling: only about ~11% of those posts were original. The rest were reshares, retweets stacked on retweets, the same amplification pattern you’d expect from a coordinated network, not from a country having an organic conversation.

This same pattern shows up domestically, too, outside conflict zones. In February 2020, riots in North East Delhi killed dozens of people, fueled in part by rumors and fake reports spreading faster than police could knock them down. Then the recurring “Baccha Chor,” or child-lifter, rumors that have swept through state after state for years, that have led to real lynchings, real deaths, of people who were just passing through.

The state-level operation, in practice:

A 15-year operation called “Indian Chronicles,” was exposed by the watchdog group EU DisinfoLab. It ran over 265 fake local news outlets across 65 countries and resurrected NGOs that no longer existed. It built entire fake identities from nothing, with the aim of moving public opinion.

This is the range of spectrum we are looking at, on one-end 1 lonely person creating a fake profile and on the other end a 15 year operation spread over +50 countries. Taking a fake profile seriously, and reporting it the moment you spot one, isn’t an overreaction. It’s the only thing standing between a rumor and what that rumor can do once enough people believe it. A fake photo takes only a few hours to spread and years to undo the damage it can cause.

How You Actually Catch One

Here’s what to check, before you accept requests, reply to messages, or believe viral posts from any account.

If it’s one account:

• Right-click the photo. Run it through Google Lens or TinEye. Real photos rarely trace back to a stock site or someone else’s Instagram. Fake ones usually do.

• Check when the account was made versus when it actually started posting. A lot of scammers buy an old, dead account, wipe it, and dump a dozen photos on it in one afternoon to make it look established. Real accounts grow slowly. Fake ones burst.

• Look at the follower-to-like ratio. Twenty thousand followers and one or two likes a post? That’s a bought audience.

• Check the handle against the name. Someone selling or hijacking an account often forgets to change the handle. “Ananya Sharma” posting as @rahul_verma98 is a dead giveaway.

• Ask for thirty seconds on a video call. If the camera’s always broken, or there’s always a convenient emergency, they’re hiding their face because they’re hiding who they are.

If it’s a network:

• Watch for the exact same phrase or hashtag showing up across dozens of unrelated accounts within minutes. Real people don’t say the same thing at the same time by accident.

• Watch for accounts posting nonstop, every hour, with no breaks. Humans sleep. Bots don’t.

• Watch for accounts where every single post attacks the same group or pushes the same one narrative. Real people post about their actual lives too, their food, their family, a bad day. An account that only ever agitates isn’t a person. It’s a tool.

Platforms Should Do More — And So Should We

Ideally, the tech platforms should be doing a lot more than they are. A network of 1,409 accounts ran undetected on Facebook and X for three years, a disinformation operation resurrected dead people and fake NGOs for fifteen years before anyone caught it. That’s a failure of the systems built to catch this at scale. These are companies with the engineering resources and the data to do better. Platforms have a real responsibility here, and they should be held to it, publicly, and often.

Having said that, here’s the part that doesn’t let the rest of us off the hook: even the best moderation system in the world can’t watch every corner of a platform with a billion-plus users. Not in real time, not at the pace fake networks move now. A group with thousands of members can’t have a handful of people checking every profile by hand either. Keeping a community safe isn’t a job you can fully hand off to a company or an overwhelmed admin, not at this scale. It has to be shared.

Reporting a fake profile is genuinely simple. Tap the three dots on the profile whether it’s FaceBook or Instagram or Whatsapp or X, whichever platform it may be. Hit report. Pick the option that’s actually true - fake profile, impersonation. This is basic upkeeping on a space you share with other people, to address something that the platform’s own systems missed.

Nothing about this fixes itself because we hope it will. It gets better because people keep checking, keep reporting, keep asking questions. Verify before you trust. Watch the pattern, not just the words. And when you spot something that isn’t real, don’t just scroll past it. Say something, and use the report button.

References

The India-aligned network (1,409 accounts)

• NewsGuard, “NewsGuard Uncovers Massive India-Aligned Network Using AI and Fake Accounts to Target Country’s Foes Operating without Detection for Three Years” (Sept. 2024)

• Dark Reading, “Indian Army Propaganda Spread by 1.4K AI-Powered Social Media Accounts”

2020 Delhi riots (misinformation-fueled violence)

• Associated Press (via Inquirer), “India’s riot toll rises to 46 as capital remains on edge”

Baccha Chor / child-lifter lynchings

• Al Jazeera, “India arrests 18 after two men lynched over WhatsApp rumours”

• CBS News, “Police arrest 23 over rumor-fueled lynchings in India”

The Manipur case

• The Tribune, “How rumours, fake news fuelled violence in Manipur” (mislabeled Churachandpur video, “Rumour Free” hotline)

• BOOM, “No, photo does not show...” (fake photo debunk)

• The Print, “No one wants to talk about..” (fake photo, broader context)

• Al Jazeera, “In India’s strife-torn Manipur, narrative battle is fought on social media” (2.76 million tweet analysis, 11% original-post finding)

Indian Chronicles (265 fake outlets, 15-year operation)

• EU DisinfoLab, “Indian Chronicles: deep dive into a 15-year operation targeting the EU and UN to serve Indian interests”

• CBC News, “Huge pro-India fake news network includes Canadian sites, links to Canadian think tanks”

Blackmail scam operations in India

• Al Jazeera, “’Suicidal thoughts strike every day’: India’s...”

The internet parents are posting into today is not the internet they started posting into. Something’s shifted under everyone’s feet and most haven’t even noticed there’s a question to ask. Nobody handed them the memo that the ground has moved. The actual question underneath it is harder: how do you celebrate a kid without handing tomorrow’s version of them a problem you are creating today? Most parents haven’t sat with that question yet. They don’t know they should be sitting with it. They’re still operating on “cute photo or not.”.

The internet parents are posting into today is not the internet they started posting into. Something’s shifted under everyone’s feet and most haven’t even noticed there’s a question to ask. Nobody handed them the memo that the ground has moved. The actual question underneath it is harder: how do you celebrate a kid without handing tomorrow’s version of them a problem you are creating today? Most parents haven’t sat with that question yet. They don’t know they should be sitting with it. They’re still operating on “cute photo or not.”

The internet got hungrier.

If you’ve never heard the word “sharenting” before, here’s what it means. It’s the name for something you’ve probably watched happen constantly, or done yourself without a second thought. It’s a blend of “sharing” and “parenting.” It showed up around 2012 to describe parents posting photos, videos, or stories about their kids online. Most people doing it regularly have never heard the term. That makes sense. Nobody sat anyone down and said, “This thing you do constantly has a name, and researchers study it.”

It’s easy for someone online to throw the word around like it’s a diagnosis. Like admitting to it means admitting to doing something wrong. I don’t think that’s fair. When digital photo albums first showed up, they felt exactly like the sticky-page albums grandparents kept on the coffee table. Just easier to send across the world.

So no, I don’t think parents got reckless. I think the technology got more invasive underneath them. Data scraping. Facial recognition. AI tools that can build a profile out of nothing but a few years of birthday posts. A photo isn’t just a photo anymore. It’s data. What feels like a sweet update reads, to something built to harvest it, as raw material. Barclays forecast that by 2030, “sharenting” could be behind close to two-thirds of identity fraud hitting young people.

If that phrase doesn’t mean much yet, here’s the plain version. Identity theft isn’t someone breaking into an account that already exists. It’s someone collecting enough real details — full name, birthdate, hometown, mother’s maiden name — to convincingly become that person on paper. With those pieces, someone can open a credit card in a child’s name. Take out a loan. Pass a security check meant to confirm they’re really them. It usually doesn’t surface for years. A kid’s identity sits unused and unchecked until they’re old enough to apply for their first credit card or apartment. That’s exactly when they find out someone’s already been using their name.

That’s what the Barclays forecast is actually about. Not some vague future risk — the birthdays, hometowns, and mother’s maiden names sitting in years of posts, becoming the exact toolkit someone needs. Pulled together patiently, one caption at a time.

None of this is a case for paranoia. It’s a case for noticing that the ground has moved.

Here’s what nobody quite spells out

“Be careful what you post” gets repeated so often it’s stopped meaning anything. So let’s actually sit with why. Most people aren’t connecting these dots automatically. Two things are happening at once, and they’re different problems.

The identification problem, explained plainly. Once a company can reliably match a photo of a face to a name, it can find that same face anywhere else it turns up online — in someone else’s photo, on a different platform, in a context the original poster never imagined. A birthday photo posted for grandma stops being a private moment between family and becomes a searchable entry point into a person’s whole identity. That’s what “identification” means here: not that a stranger saw one photo, but that one tagged photo can now unlock everything else connected to that face.

Here’s how it already happened, not hypothetically. A company called Clearview AI scraped billions of photos off public social media — Facebook, Instagram, wherever a face happened to show up. It used them to build a facial-recognition tool, then sold access to that tool to police departments and businesses. Nobody whose face was in there knew it was happening. The UK’s data regulator, the ICO, fined the company £7.5 million in 2022. Clearview challenged the fine, and the case has moved through UK tribunals since; a 2025 ruling restored the ICO’s authority to pursue it, though a lower tribunal is still finalizing the fine itself as of this writing. France, Italy, and Greece have each fined Clearview roughly €20 million outright — and, notably, none of those regulators have actually collected a cent. Australia investigated the company too. This isn’t a hypothetical. It already happened, to real people’s photos, quietly.

And that’s really the point Clearview proves: it’s not a one-off villain, it’s a demonstration of what’s possible. Clearview only became visible because journalists and regulators eventually caught up to it. For every company regulators catch, there’s no way to know how many others are running the same quiet collection and simply haven’t gotten caught yet — smaller data brokers, apps with vague terms of service, tools nobody’s heard of that exist specifically to scrape and resell what’s public. None of them need permission to start. They just need a public photo and time.

That’s what makes this different from a one-time risk. A stranger downloading a single photo creates a bad moment. An unknown company patiently building a profile on a child for years, unnoticed, creates something else entirely — because that profile doesn’t do anything today. It just sits there, complete and waiting, until the day that child is old enough to open a bank account or sign a lease. Nobody sends a warning when someone finally uses it. The years of quiet collection and the moment of misuse can sit a decade apart, which is exactly why it doesn’t feel urgent now. The absence of visible harm today doesn’t prove nobody’s collecting anything — it’s often exactly what unauthorized collection looks like while it’s happening.

The permanence problem, explained plainly. Normally, if you regret posting something, you delete it and it’s gone. Training data doesn’t work that way. Once a company has trained an AI model on a photo, deleting the original post doesn’t undo what the model already learned from it. The lesson the model absorbed — this is what a face looks like, this is how it ages, this is the pattern of a name attached to a place — stays baked into the system whether or not the photo is still online. You can take back the post. You can’t take back what it taught.

In 2024, Meta changed its policy to let its AI train on public Facebook and Instagram posts and photos. It made the opt-out process complicated enough that most people never got around to it, and even where opt-outs exist, they’ve mostly covered EU and UK users under stronger local privacy law — US users have much weaker footing to object at all. Even the people who did opt out found the request only covered what happens going forward. Whatever the model had already used, stayed used.

A photo someone posts is a moment. It has a beginning and an end. You can delete it if you regret it. The training data that photo becomes isn’t a moment anymore. It’s a permanent ingredient in something else — something a company built for a purpose nobody agreed to, and can’t undo. A kid’s birthday photo, posted for grandma, doesn’t just sit there. It can become one small piece of a system that learns to recognize faces, target ads, or predict behavior — a system a company built without ever having a conversation with that child, using a face they didn’t get a vote on.

Most people are used to thinking about who can see a post. Almost nobody’s used to thinking about what that post can turn into, simply because nobody framed it as the real question

Things people say to wave this off

1.“They already have everything anyway.”

This is understandable. There’s some truth buried in it. Data brokers already hold huge amounts on all of us. A single new photo probably isn’t the difference between private and not private in some absolute sense. So why bother?

Here’s where that logic quietly breaks. “They have some of your data” and “they have your face, matched to your name, matched to your child’s face, matched to a decade of locations and routines” are not the same category of exposed. Most of what’s already out there is scattered. Fragments. Probabilities. Patterns. A clear, tagged photo of a specific child’s face is not a fragment. It’s a key. It turns everything else scattered about them into something matchable, searchable, identifiable in a crowd. A stranger could theoretically piece together a kid’s school, routine, and face from scraps across the internet, if they tried hard enough. A tagged, named, dated photo now can do that work for them quite conveniently. Every post doesn’t just add to a pile. It makes the pile easier to search.

There’s also a version of this argument that quietly gives up on a child’s choice. “There’s nothing to hide anyway” assumes the decision has already been made for them. Even if total privacy isn’t on the table anymore for anyone, the amount of searchable, identifiable material tied to a specific child, by the time they’re old enough to have an opinion about it, is still something being actively chosen. One photo at a time.

2.“There’s nothing worth stealing.”

The instinct behind it is understandable. Most people grew up thinking of “valuable” as money in an account, or an expensive thing someone could physically take. Data doesn’t feel like that. It doesn’t feel like property in the same way. Losing control of it doesn’t register as a loss. However, a child’s data doesn’t need to be worth anything to their parent for it to be worth something to somebody else.

A name, a birthdate, a school, a face — none of that pays for itself directly. But it’s the raw material for things that do make money. Data brokers buy and sell exactly this kind of information in bulk. Not because any single kid’s birthday is valuable, but because a complete, accurate profile of a real person is.

Remember the identification and permanence problems from earlier. Identity theft isn’t about stealing money directly out of an account. It’s about stealing enough real information about a person to convincingly become them. The Barclays forecast isn’t warning about someone hacking a bank. It’s warning about someone using a kid’s own birthday, hometown, and mother’s maiden name — collected patiently over years of posts — to impersonate them later. The theft isn’t of data. The data is just the tool. What gets stolen at the end is money, credit, or reputation, using pieces that child never knew had been handed over.

So “there’s nothing valuable to steal” isn’t really the right question. The better one is this: does this information make it easier for someone to become this child, or to profit off knowing everything about them, without that child ever getting a say?

Not every post is a catastrophe. There’s room to be wrong about exactly where the real risk sits. “it’s already out there” or “it’s not worth anything” have always felt like reasons to stop trying, not actual arguments that trying doesn’t matter.

The gift kids aren’t being given

There is a different way to look at the situation, not as a restriction but as something parents are actually capable of giving.

Think back to anyone’s own late teens. There was room to mess up. To change your whole personality twice. To walk into adulthood mostly unwritten. That blank slate was a privilege, even if nobody called it that at the time.

Kids today are inheriting a version of themselves they didn’t write. A 2017 study, referenced by the American Academy of Pediatrics, found that teens judge their parents’ posts about them far more harshly than they judge posts from friends.

Long before they apply for a job or open a bank account, there’s already a searchable record of their tantrums, their milestones, sometimes their medical stuff. Put there with love, without a second thought. Pulling back on what gets posted isn’t hiding a kid. It’s leaving them room to tell their own story later, in their own words.

Nobody has to disappear. There’s a middle ground.

None of this means going dark. Privacy isn’t all-or-nothing. Plenty of families are finding a version that works:

1. Post the vibe, not the face. Hands, muddy boots, the back of a small head at the park.

2. Cover the face with an emoji if the moment should be public but the biometrics shouldn’t.

3. Move the real archive somewhere closed, a private group chat, a family-only app and save the public feed for the parts anyone would be fine with someone finding in ten years.

Before hitting share — three seconds

Next time a thumb’s hovering over the share button, ask yourself three question with no judgment attached.

1. Is there operational information in this — a school uniform, a house number, a full birthdate?

2. Would this be okay on a billboard outside your own office?

3. Is this being shared for the kid, or for the parent?

This is the first generation figuring it out in real time. There’s room to be wrong about exactly where the line should sit. There’s no clean answer here, but the shift is simple, even if the questions aren’t: share the moment, not the identity.

References

• Security.org, Parents’ Social Media Habits: 2021 — security.org/digital-safety/parenting-social-media-report

• Barclays / Techmonitor, Sharenting to Reach £676 Million by 2030 (2018) — techmonitor.ai

• Blum-Ross, A., & Livingstone, S. (2017). “Sharenting,” parent blogging, and the boundaries of the digital self. Popular Communication, referenced via American Academy of Pediatrics — aap.org

• TIME, Why Regulators Can’t Stop an AI Company That Scraped Billions of Photos — time.com

• The Conversation, Australia’s privacy regulator just dropped its case against Clearview AI — theconversation.com

• MIT Technology Review, How to opt out of Meta’s AI training (2024) — technologyreview.com

Most people hear "cyberbullying" and picture teenage drama. Someone posts a mean comment, everyone moves on, it sorts itself out. That's not what it is. It's calculated. It's varied. It’s willful, repeated harm. Not a one-off insult and it's evolved into something a lot bigger than a mean comment.

Here's what it actually looks like:

Harassment: a relentless stream of hostile or threatening messages. What makes it bullying instead of a fight is that it doesn't stop.

Outing: someone shares your private information without your consent. Your sexuality. Your mental health history. Something you told them in confidence, now weaponized.

Exclusion: deliberately cutting someone out of group chats or online communities. It sounds small. For a teenager, it's social exile.

Impersonation: a fake account using your name and your photos, posting things you never said, so you get blamed for them.

Cyberstalking: tracking someone's location tags, check-ins, and activity across platforms to intimidate them.

Sextortion and image-based abuse: sharing, threatening to share, or morphing intimate images of someone without their consent to blackmail or humiliate them.

Coordinated pile-on: someone screenshots you out of context, rallies a crowd, and hides behind it while you get buried under hundreds of strangers who think they're doing justice.

When the internet started, cyberbullying was a mean email or a harsh message on MSN. You closed the laptop and it was gone. Then social media gave it a permanent audience, a bad post from 2018 can still be the first thing that comes up when someone Googles your name today. Now we're in the AI phase. Perpetrators can morph someone's photos, clone their voice, build an entire fake digital footprint of things they never said or did. The tools have gotten sophisticated.

Why Ordinary People Do This

Here's the part that surprises most people. Majority of cyberbullying isn't done by career criminals or pathological monsters. It's done by classmates, coworkers, ex-partners - regular people.

So why do ordinary people do something so mean online when they wouldn’t do it in person?

The answer is in a concept called moral disengagement, and psychologist Albert Bandura mapped it out decades ago. It describes how a person can switch off their own conscience without even realizing they're doing it. They don't feel like they're doing something wrong. They've quietly convinced themselves they aren't.

There are five switches that flip to make this possible.

Moral justification: This is the reframe. “I mocked someone” becomes “I was calling out bad behavior.” “They deserved it.” “It’s just honesty.” This happens before the bullying, not after. The person’s conscience is still active, so they need the justification first. Once they have it, dressed up as fair or necessary or even righteous, they move forward.

Dehumanization: When you see a face, hear a voice, watch someone’s reaction in pain, your brain automatically triggers empathy. That’s the natural brake on cruelty. Dehumanization removes that brake. Online, that brake disappears. A username isn’t a person. A profile picture isn’t a face. The person on the other end becomes an idea instead of a human, and ideas are a lot easier to hurt than people.

Diffusion of responsibility: When a lot of people are piling on at once on a target, each person’s sense of personal responsibility shrinks. The math in their head goes something like: “I’m one of sixty people. I only said one thing. The blame is spread across all of us.” The bigger the crowd, the lighter each person feels. Nobody’s fully responsible, so nobody stops.

Displacement of responsibility: This is different from diffusion, it's not spreading the blame, it's handing it off. "My friends started it." "I was just going along." The person tells themselves they had no real choice. They're a participant, not someone who chose this.

Disregard of consequences: The perpetrator sends the message and closes the app. They never see the person at 3 am, unable to sleep. The harm only exists in the victim's world, and because they can't see it, some part of their brain decides it isn't real. “If it was really that bad, I would have seen evidence of it.” This allows them to maintain the belief that they didn’t actually cause harm, even though they did and the harm is real.

Put those five together and the cycle closes.

Justification gets it moving. Dehumanization removes empathy. Displacement and diffusion strip away responsibility. Disregard makes it all invisible. By the end, the person hasn't lost a fight with their conscience, they've rewritten what their conscience is willing to accept.

How You Actually Break the Cycle

If moral disengagement is a system, set of switches, that means they can be flipped back. There's real research on exactly how.

Dismantle moral justification by questioning the reasoning, not attacking the person. When someone says “they’re annoying so I can mock them,” the counter isn’t anger, it’s a question: would you accept that logic if it were used on you? Research on moral reasoning shows that when people are forced to apply their own excuse to themselves, the inconsistency destabilizes the excuse. You can’t hold “mocking is fine when someone annoys me” and “I’d hate to be mocked” at the same time.

Dismantle dehumanization by making the person impossible to forget. This is why victim impact statements work in courtrooms. It’s why anti-bullying programs that show real testimonials, an actual face, an actual voice, saying “this is what it did to me” work better than ones that just list rules. If you’re a bystander, simply asking a perpetrator “do you know how that person actually felt?” is more disruptive than it sounds.

Dismantle diffusion of responsibility by naming individuals. In Latané and Darley’s classic 1968 research on bystander behavior, the single most effective way to break up mob behavior was one person stepping out and naming what was happening, specifically, by name. “The group did it” collapses the moment someone says “you did this.” Suddenly everyone in the crowd has to decide, individually, whether they’re actually in.

Dismantle displacement by naming complicity. Research on complicity is clear on this: joining in makes you responsible too, even if you didn’t start it. “My friends started it, I just went along” is the classic move. The counter is direct: you chose to participate, and that’s on you.

Dismantle disregard of consequences by making the harm concrete. There are two ways to do this, and they work differently.

Understanding consequences: Showing someone the real impact - the tears, the sleepless nights - the abstract harm becomes concrete. This creates genuine guilt, shame about the action and desire to repair.

Experiencing consequences: Legal or formal consequences - a police complaint, a school record - make the harm undeniable. A bully who faces an FIR, a court appearance, or a documented complaint can no longer tell themselves nothing happened. The consequence is suddenly real in their world, not just the victim’s.

Fear of consequences can stop the behavior but it doesn’t resolve the disengagement underneath.

You need both. Fear stops the behavior. Understanding stops the disengagement.

Shame Vs. Guilt

Shame says “you are a bad person.” When someone feels shame, their brain goes into defense mode. They double down on justifications, blame the victim harder, find reasons they’re actually the victim. Shame triggers moral disengagement deeper, not reversal of it. This is why public callouts and humiliation-based consequences often backfire, the person becomes more entrenched into the behavior you’re trying to stop.

Guilt is different. It’s shame about the action, not the self. Guilt says “what you did was wrong, and I know you as someone better than this.” That’s a completely different feeling. It creates a cognitive dissonance - the action doesn’t match who they think they are - and that dissonance is destabilizes moral disengagement. This triggers desire to repair, to correct course, to be who they think they are again.

Psychologist June Price Tangney’s research on moral emotions backs this up clearly: shame leads to defensiveness, denial, and further interpersonal hostility, whereas guilt leads to real change. “You’re a monster” gets you nothing. “This isn’t who you are. You’re capable of better. So why did you do this?” triggers guilt and the possibility of actual change. It’s also why a private conversation with someone they respect often works better than public pile-on. Public consequences create shame. Private accountability creates guilt.

That last point connects to something Karl Aquino's research on moral identity found: when people are reminded of their own values, of who they actually believe themselves to be, disengaged behavior drops fast. "Is this who you actually are?" destabilizes someone far more than "this is wrong" because most people already know it's wrong. What they haven't asked themselves is whether it fits who they think they are.

None of this works as a one-time conversation. Moral disengagement doesn't reverse in a single talk. It takes repetition, ongoing reminders of identity, ongoing exposure to the humanity of the person on the other end, ongoing accountability. This is why schools and platforms need to build this in as a system, not a lecture they give once.

That's how you help someone stop. But if you're the one being targeted right now, dismantling their psychology isn't your job. Protecting yourself is.

What You Actually Do If This Is Happening to You

Document everything, first. Before you block. Before you report. Before you even respond. Screenshots of messages, profiles, timestamps, usernames, the URL if it's public. Once a perpetrator knows they've been reported, they often delete everything. Get the evidence before they do.

Do not engage. This is harder than it sounds. Every response feeds the cycle, it tells them their behavior is working. Silence isn't weakness here. It's a strategic choice that starves the whole mechanism.

Report it, and document that too. Every major social media platform has mechanisms to report harassment, fake profiles, and non-consensual intimate images. Use them. Note the date, what you reported, and any reference number they give you. In India, you can file complaints directly through the national cybercrime portal at cybercrime.gov.in, women and children have the option to do it anonymously. Your documented screenshots serve as the foundational evidence required to initiate action.

Loop in someone you trust. Isolation is exactly what sustained harassment is designed to produce. It wants you alone. Counter that by showing someone the full picture, not "someone's being mean," but the actual pattern, so they understand the real scale of what's happening.

Cyberbullying is not a personality conflict. It's not drama that sorts itself out. It's a psychological attack, built on features of our digital world, sustained by mechanisms that let perpetrators feel fine while the person on the other end falls apart.

If you know someone this is happening to: take it seriously. Being online doesn't make it less real.

If it's happening to you: document, don't engage, report, and reach out. The law exists for exactly this. Use it.

Reference materials:

• Read Bandura’s foundational 1996 study on the mechanisms of moral disengagement

• About Latané and Darley’s classic 1968 research on group size and the diffusion of responsibility

• Research on moral emotions by June Price Tangney

• Karl Aquino’s research on the self-importance of moral identity

It isn't some complicated technical break-in that only happens to people who "don't know better." It's actually the opposite of technical. It's psychological.

So Why Do Smart People Actually Fall For It?

There's a real myth that phishing only catches people who are careless or not tech-savvy. The data says otherwise. Doctors, tech executives, finance controllers, highly trained, highly intelligent people fall for this constantly. Why? Because phishing was never designed to beat your IQ. It's designed to beat your biology.

Psychologist Daniel Kahneman, who won a Nobel Prize for his work on human judgment, spent decades showing that your brain runs on two different modes:

• System 1: fast, automatic, intuitive. It runs on autopilot, scanning for familiar patterns so you can decide in a split second without burning energy.

• System 2: slow, deliberate, analytical. It's the part that actually double-checks a URL, questions a request, catches the thing that feels "off." It takes real effort to switch on.

When you're calm and unhurried, System 2 is right there, ready to spot a lookalike link. The problem is, scammers have gotten very good at making sure you never get to use it.

They do that by pulling three specific levers.

1. The urgency lever (amygdala hijack): "Your account will be frozen in 30 minutes." "Your card is about to be blocked." Your brain reads that as a threat, and a threat triggers what's called an amygdala hijack - a real physical stress response, cortisol and adrenaline flooding your system. When that happens, System 2 goes quiet. Your brain isn't being lazy, it's prioritizing speed over accuracy, because that's what a threat response is built to do. You're not choosing to skip the check. Your biology is skipping it for you.

2. The familiarity lever (cognitive ease): We're wired to trust what feels familiar, and scammers know it. That's why they research their targets - the right formatting, the right tone, the right internal jargon, mentioning your actual boss or a project you're actually working on. When something requires zero effort to process because it already "looks right," System 1 waves it through without ever calling in System 2 to check. The scam isn't fighting your judgment. It's making sure your judgment never gets involved.

3. The authority lever (conditioned obedience): This one hits hardest at work. If an email looks like it's from your CEO, a senior vendor, or a tax official, most people's instinct is to respond fast and respect the hierarchy - not to question whether the sender is really who they say they are. The desire to be efficient and professional overrides the instinct to verify.

Stack those three together - urgency, familiarity, authority, and you've got a message that never gives your analytical brain a chance to show up. That's the actual answer to "why smart people fall for it." It was never about intelligence. It's about which system got to make the decision.

It's Not a Hack. It's a Trap Dressed Up as Something Official

The word "phishing" comes from the same place as fishing. You cast a hook, bait it with something convincing, and wait for someone to bite. Except instead of fish, attackers are after your data - your full name, your date of birth, your Aadhaar or PAN number, your net-banking login, your card details. Enough pieces, and they can walk straight into your bank account or if you work for a company, straight into its network.

We used to say "just check for bad grammar and you'll spot the fake." Not anymore. Attackers are using AI to write these messages now. The grammar is flawless. The formatting is perfect. The urgency feels real, because it's engineered to feel real.

It's also not just email anymore. There's smishing - phishing through text messages. There's vishing - phishing through phone calls, usually someone claiming to be your bank. There's quishing - phishing through QR codes that quietly send your money out instead of bringing money in. The attack surface is everywhere your phone touches. Different channel, same three levers.

When a Global Cricket Body Lost ₹20 Crore to One Email

If you think this only happens to careless individuals, look at the International Cricket Council (ICC) - the body that governs cricket worldwide and drives a massive part of the sport's ecosystem in India.

In 2022, the ICC lost close to $2.5 million (roughly ₹20 crore) to what's been widely reported as a business email compromise, or BEC, attack. In a BEC scam, criminals don't hack their way in through code. They study an organization's email patterns, then send a message that looks like it's coming from someone trusted, a vendor, an executive, a finance contact and convince an employee to authorize a payment or wire transfer. Notice which levers that pulls: familiarity, because the message mirrors something the employee already trusts, and authority, because it appears to come from someone whose request you don't stop to question. The ICC reported the incident to law enforcement in the US, and the exact mechanics of how the fraudsters got in were never fully made public. But the outcome was blunt: real money, sent by real people who believed they were dealing with a real, trusted party, gone.

This is the high-stakes version of spear phishing, not a wide net thrown at millions of random people. A targeted, researched message aimed at one person or one role, built to look exactly like something they'd already trust.

The Everyday Version: Real Scams Hitting Indian Phones Right Now

You don't have to run a global cricket body to be a target. This same playbook runs at massive scale on ordinary phones across India, every single day.

Smishing - the fake delivery text.

Over the past couple of years, India Post has had to repeatedly warn people, through the government's own fact-checking body, that a viral text message is fake. It reads something like: "Your package couldn't be delivered due to incomplete address information. Update your details within 12-48 hours or it will be returned." There's a link. The link leads to a cloned website that looks almost identical to the real one. Some versions ask for a small "redelivery fee" of ₹25 to ₹100 and quietly harvest your card details the moment you enter them. Others plant something worse on your device the moment you tap the link. India Post has said, plainly and repeatedly: they never send messages like this. If you get one, that's your answer already.

Vishing - the call that already knows your card number.

This is the one that catches people off guard, because the caller sounds like they know you. They'll state your actual card details back to you, or reference a real recent transaction, to win your trust fast. Then comes the pressure: your card is about to be blocked, unless you "verify" by reading out an OTP right now. The moment you do, the money's not being verified, it's being moved. No real bank will ever call you and ask you to read out an OTP. That single fact is the whole scam, once you know it.

Quishing - the QR code that takes instead of gives.

This one is especially sharp because it plays on a mistaken assumption. In India's UPI-driven world, a QR code shows up claiming to be a "cashback," a "refund," or a "lottery win." People scan it expecting money to land in their account. But a QR code is built to send money, not receive it. The second you scan it and enter your UPI PIN, you've authorized an outgoing payment, straight to the scammer. There is no such thing as "scan this QR code to receive money." If a code implies otherwise, that's the tell.

Why None of This Is About Being Careless

Look at the pattern across all three. The ICC case. The fake delivery text. The "your card will be blocked" call. None of them hacked anything. Each one just pulled the same three levers - urgency, familiarity, authority, and let biology do the rest.

That's the real skill scammers have built: manufacturing a feeling, not writing better code.

Your Practical Checklist - Use This Every Time

1. Pause on urgency: Any message demanding instant action, "24 hours or your account is suspended," "12 hours or your package is returned" is a signal to stop, not to comply. Real organizations, banks included, don't threaten instant account closure over a text message.

2. Check the actual domain, not the logo: Scammers can copy a logo, a font, an entire page design in minutes. What they can't do is legally own a company's real domain. If a message claims to be from your bank or India Post but the link doesn't match their official domain exactly, that's your answer. Look at the URL bar, not the pretty design around it.

3. Go direct, every time: Never act through the link or number inside an unsolicited message. If you're worried about a delivery or an account, close the message, open a fresh browser tab, and type in the official website yourself. Or open the company's app directly. You're bypassing their fake doorway entirely, and this one habit alone blocks most of these attacks.

4. Hang up, then call back yourself: If someone calls claiming to be your bank, a government office, or any company asking you to "verify" details or read an OTP, hang up. Find the real number from your bank statement, your card, or the official app, and call that number yourself. You're the one initiating the verification now, not them.

5. Report it: India has a dedicated portal for this: cybercrime.gov.in, and a national helpline at 1930. Reporting a scam doesn't just protect you, it helps shut the operation down before it reaches someone else who might not pause in time.

The goal here is to build one habit: trust after you've checked, not trust by default. That's it. That's the whole shift. You're smart enough to spot the patterns. You just have to remember to actually look.

Reference materials:

ICC ₹20 crore business email compromise (2022)

• ESPNcricinfo report as covered by The Daily Star: https://www.thedailystar.net/sports/cricket/news/icc-loses-25m-phishing-scam-3226706

• The Federal: https://thefederal.com/sports/icc-lost-close-to-2-5-million-in-phishing-scam-in-2022-report

• Business Standard (via TBS News, same wire pickup): https://www.tbsnews.net/sports/icc-falls-prey-online-scam-loses-close-25-million-usd-571586

India Post smishing scam

• Press Information Bureau (PIB) Fact Check, via Business Standard: https://www.business-standard.com/finance/personal-finance/that-india-post-parcel-message-on-your-phone-it-s-a-scam-says-pib-125101300283_1.html

• PIB Fact Check follow-up, via Business Standard: https://www.business-standard.com/finance/personal-finance/another-delivery-scam-surfaces-pib-flags-fake-india-post-sms-125102000484_1.html

• Business Standard (case detail, ₹23.26 lakh Hyderabad victim): https://www.business-standard.com/india-news/new-india-post-scam-targets-citizens-what-is-it-and-how-to-be-safe-124091700490_1.html

Daniel Kahneman - System 1 / System 2

• APA Monitor on Psychology, official summary of Kahneman's work: https://www.apa.org/monitor/2012/02/conclusions

• The Decision Lab (academic reference guide): https://thedecisionlab.com/reference-guide/philosophy/system-1-and-system-2-thinking

A note on the rest: "amygdala hijack" and "cognitive ease" are established psychological terms (the former coined by Daniel Goleman, the latter from Kahneman's own book)