The most common online scams: how could QEI prevent digital identity misuse?
From fake online shops, investment fraud and stolen bank details to synthetic voices and AI-assisted impersonation, online scams are becoming increasingly convincing. Could digital identity be designed so that stealing a password, forging a message or manipulating a user would no longer be enough to carry out an unauthorised action?
Online scams are no longer confined to suspicious emails. A fake shop may look genuine; criminals may send messages from a compromised company mailbox, imitate a manager’s voice or produce a convincing fabricated video.
In some cases, fraudsters do not even need to break into a bank account. They persuade the account holder to transfer the money themselves.
According to Slovenia’s national cybersecurity incident response centre, SI-CERT, 6,196 cybersecurity incidents were handled in 2025, including 1,995 phishing cases. Slovenian police data cited by SI-CERT put reported financial losses from online fraud at €40.4 million.
Behind the figures are individuals, families, businesses and their savings. This raises an important question: could digital identity become an active safeguard for its holder, rather than merely a way of identifying them?
This is among the research questions behind QEI – Quantized Encrypted Identity, a development initiative by Institute 1 April.
Why do online scams still succeed?
Many attacks exploit trust. An email appears to come from a bank; a caller sounds like a relative; a message seems credible because it originates from a familiar company’s address.
Fraudsters create urgency, fear or the promise of an exceptional opportunity. A person may then knowingly approve an action that is in fact fraudulent. A digital service can consider the action legitimate because the user entered the correct password or confirmed the transfer.
QEI explores distinguishing three questions: identity – who is acting; authority – whether they are permitted to act; and authorisation – exactly what they approved, under which conditions.
1. Phishing emails and fraudulent text messages
Criminals impersonate banks, delivery services or public authorities. A link leads to a fake website where users are tricked into entering passwords, payment details or one-time verification codes.
How could QEI help?
In a proposed QEI model, verification could rely on cryptographically protected credentials bound to a trusted device and to the genuine service. Properly binding an approval to the service and to the particular request could prevent an attacker from simply replaying an intercepted credential elsewhere.
Potential QEI effect: preventing unauthorised logins and reducing the usefulness of stolen login information. This would apply where services had integrated the required verification; it would not automatically stop the disclosure of unrelated personal data.
2. Fake online stores and shopping scams
Fraudulent shops advertise extreme discounts, borrow familiar branding and display convincing reviews. The buyer pays but never receives the product. On online marketplaces, fake buyers may also lure sellers into entering card details on counterfeit payment pages.
How could QEI help?
Verifiable organisational credentials could establish which legal entity operates a service and whether a representative has the appropriate authority. A payment could be linked to a verified recipient, specified amount and merchant identity.
Potential QEI effect: limiting impersonation of merchants and certain payment redirection attacks. Verified identity is not a guarantee of honest trading or delivery; consumer protections remain necessary.
3. Investment fraud, cryptocurrency scams and fake trading platforms
Scammers display fictitious returns to encourage further deposits. When customers attempt to withdraw funds, they may face fabricated taxes or release fees. Some victims are persuaded to install remote-access software.
How could QEI help?
Research could explore checking the provider’s organisational identity and authority, verifying payment recipients, and requiring additional approval for high-risk transfers. Purpose-limited credentials could also reduce unnecessary disclosure of personal data.
Potential QEI effect: limiting identity misuse and unauthorised transactions. Verifying a recipient does not establish that an investment is lawful or profitable; financial regulation and fraud-monitoring remain essential.
4. Bank account takeover and unauthorised transfers
Criminals try to capture banking credentials, gain control of devices or intercept transaction approvals. Increasingly, however, they manipulate account holders into authorising a fraudulent transfer themselves. The European Banking Authority and European Central Bank have highlighted how payee manipulation and other social-engineering attacks adapt to stronger authentication.
How could QEI help?
A crucial design direction is authorisation cryptographically tied to the exact amount, recipient and purpose. A transfer could be represented by a verifiable statement: PERSON A → €850 → RECIPIENT B → PURPOSE → EXPLICIT APPROVAL.
If an attacker changed €850 to €8,500 or replaced the recipient, the original authorisation would no longer match the transaction.
Potential QEI effect: rejecting modified or unauthorised transactions. When someone is deceived into approving exactly the payment a fraudster wants, separate anti-fraud controls and risk checks would still be needed.
5. Fake executives, altered invoices and business email compromise
Accounts departments can receive urgent payment instructions apparently issued by a CEO or trusted supplier. The request may even originate from a genuinely compromised business email account.
How could QEI help?
An executive’s email address or voice would not, by itself, constitute sufficient permission to make a payment. A system could verify the requester’s identity, organisational role, authority for the amount, confirmed recipient and explicit approval. Particularly sensitive actions could require more than one independent sign-off.
Potential QEI effect: preventing certain unauthorised corporate payments despite convincing impersonation. This depends on integrating verification into business and payment workflows.
6. Romance scams and impersonation
Fraudsters build trust over weeks or months using stolen photographs, invented stories and emotional manipulation before asking for money for a supposed emergency, illness or journey.
How could QEI help?
Supported communication platforms could offer voluntary proof that someone is the legitimate holder of a given digital identity, without requiring the disclosure of all their personal data.
Potential QEI effect: reducing impersonation and misuse of someone else’s identity. Verified identity does not verify intentions: a person using their genuine identity may still deceive others.
7. Deepfake voices, video and AI-assisted fraud
Artificial intelligence can produce convincing synthetic speech and images. Someone making a phone or video call may falsely present themselves as a relative, executive or business partner.
How could QEI help?
Instead of trusting a familiar voice, a sensitive action could require independent cryptographic proof linked to the present communication session. Without the proof, the claimed identity would remain unverified.
Potential QEI effect: preventing synthetic speech or images from serving as the sole evidence of identity or approval. QEI itself would not stop the creation of manipulated media.
8. Personal-data theft and contracts made in someone else’s name
Stolen identity documents and personal information can be used to try to open accounts, order services or take out loans under another person’s name.
How could QEI help?
Routine attribute checks could rely on limited proofs, while significant contracts could require verification of the rightful holder and explicit authorisation of the precise legal action. A photograph of an identity document or a list of stolen personal details would not be sufficient.
Potential QEI effect: preventing certain unauthorised contracts and registrations. The result depends on making these checks a mandatory part of the actual procedure.
9. Compromised user or administrator accounts
One compromised account should not automatically unlock every related personal record. QEI therefore explores separating system administration from access to identity data, isolating keys and sensitive functions, and restricting administrative permissions.
Where an administrator account is compromised, additional authorisations, limited privileges, traceability and revocation could reduce the scale of a breach.
Potential QEI effect: reducing the consequences of intrusions and the risk of mass identity exposure. No architecture can promise absolute protection, particularly if attackers control critical devices or recovery mechanisms.
Four levels of protection: prevent, block, limit or reduce
Level one – prevent
An attacker cannot sign in with stolen credentials without producing the valid cryptographic proof for the relevant service.
Level two – block
The system rejects an operation because it lacks valid authority, independent approval or authorisation for the precise transaction.
Level three – limit
Compromise of one component does not automatically grant access to every key, personal record or linked identity.
Level four – reduce
Additional checks, data minimisation, risk detection and recovery procedures reduce the likelihood or extent of harm even when an attack cannot be fully stopped.
What would QEI actually need to include?
Research into protection from online fraud would need to combine verifiable identity, purpose-limited credentials, verified organisational roles, transaction-specific authorisation, separation of security keys, independent approvals for high-risk actions, and secure revocation and recovery.
Such an infrastructure would need to work with banks, public bodies and digital service providers. Without integration, QEI could not independently monitor or block actions within third-party systems.
Could QEI eliminate online scams altogether?
Eliminating all fraud is not a realistic promise. Cryptographic evidence can verify certain identities, rights and approvals, but it cannot automatically prove that a seller is honest, that goods will be delivered or that a person has good intentions.
Nevertheless, a carefully designed architecture could prevent unauthorised use of credentials, make impersonation harder, restrict privileges and require verifiable approval of sensitive actions.
The aim is not only to tell people to be careful, but to design digital environments in which certain forms of abuse are far harder or technically impossible.
QEI as a research initiative of Institute 1 April
Through QEI – Quantized Encrypted Identity, Institute 1 April is exploring digital identity built around privacy, minimising unnecessary disclosure, and verifiable management of access rights. Preventing online fraud is one possible focus of further development.
QEI remains a research and development concept, not a completed, independently security-tested or certified production system. The mechanisms described are architectural proposals whose effectiveness must be demonstrated through implementation, pilot testing and independent security evaluation.
Conclusion: safety cannot depend on user vigilance alone
People will continue opening messages, shopping online, signing contracts and trusting others. Sometimes they will make mistakes. With advances in artificial intelligence, recognising fraudulent communications may become even more difficult.
Digital safety should therefore not depend only on expecting everyone to be permanently alert. We also need systems able to verify the rightful identity holder, their authority and the exact nature and scope of an approved action.
QEI explores such an infrastructure: not a miraculous solution to every scam, but a potential defence capable of preventing, blocking or limiting certain abuses and reducing their consequences.
“Digital identity in the future should do more than prove who we are. It should also help prevent others from doing things in our name that we never approved.”
— Institute 1 April
Sources and further reading: SI-CERT – Cybersecurity 2025 in figures (Slovenian); Varni na internetu – Safer Internet programme; EBA and ECB – Payment fraud report (2025).
Note: the QEI mechanisms described are research proposals, not demonstrated capabilities or guaranteed safeguards of an operational system.
