AI Can Now Scam 100 People at Once — Here’s How You Stop It

It was past five o’clock on a long day of interviews when I sat down with Alex Tonello, and he opened with the one topic everyone in crypto and finance pretends to have solved and nobody actually has: trust. Tonello is SVP of Global Partnerships at Trustfull, a fraud-prevention platform, and his core challenge is almost philosophical. How do you sell trust to an industry that, by reflex, trusts no one? His answer turned out to be intensely practical, and it ended with a genuinely alarming line about what AI has done to fraud.

The short version of his pitch is this: a fraudster leaves traces before they ever fill in a form, and if you know where to look, you can stop the bad actor at the door without slowing down the genuine customer standing right behind them. We spoke at Money 20/20 Europe in Amsterdam, and what follows is the clearest explanation of modern fraud detection I have heard, plus a warning every business that takes payments should sit with.

Stopping the bad actor at the door

Trustfull, Tonello explained, exists to detect fraud early in the customer journey, usually at the moment someone opens an account or accesses a new service, and to do it without wrecking the experience for legitimate users. That balance is the whole game.

“You always have to strike that balance between stopping the bad guys without stopping the good guys, the people who are really opening an account using a service online. Our job is to detect risk early, spot the bad actors coming into the journey, flag them, and help the organisation make a decision.”

The crucial detail is where Trustfull sits. It does not interrogate the user. It works in the background, on the fly, while someone is signing up, and returns a verdict in seconds with no extra forms or questions. For a crypto exchange or a bank, that means catching fraud before a bad actor is ever let loose on other customers, which is precisely the failure mode this industry keeps suffering. It is the same instinct, applied at onboarding, that Ledger Rocket applies to the ledger: catch the problem the second it appears, not after the damage is done.

The hidden tells in your email and phone number

This was the part that made me sit up because it pulls back the curtain on signals most of us never think about. How, I asked, can you possibly label a stranger as risky? Tonello’s answer was about the digital footprint we all leave without noticing. Trustfull draws on hundreds of open-source data sources tied to the fields everyone hands over at sign-up: a name, an email, a phone number. Then it goes looking for signals.

“If I have an email address that has never appeared in a data breach, well, most of us have had emails for years and they’ve been leaked at some point. So a clean email might actually be newly created, and fraudsters like to use newly created emails. If a phone number has no WhatsApp account attached, that can indicate the number could be risky, because in many countries WhatsApp is used everywhere.”

Any one of these is a weak signal on its own. The trick is volume. Combine hundreds of them, and you get a composite risk score that says, with real statistical confidence, whether you are looking at a genuine person or a fraudster. A high-risk score might block the account outright or stop it before it even reaches the formal identity-verification step; a medium score might trigger a request for more information. The intelligence does the work, and the honest customer never feels a thing.

Genuine new customer, or fraudster? How you tell them apart

I pushed on the obvious objection because I could see the false positive coming. What about someone who just moved countries, with a brand-new email and a new phone number? That person looks exactly like the fraudster Tonello described. How do you avoid punishing them?

His answer was the most reassuring part of the conversation, and it explains why a couple of suspicious signals are not enough to condemn anyone. You never rely on one or two data points, he said. You build a picture from hundreds, and you cross-check them against each other. His example was elegant: you might find a phone number and an email that are each perfectly valid and well-used, but when you put them together, they belong to two different people. They clash. That contradiction is far more telling than any single clean signal. Trustfull also runs proof-of-concept tests with each client, learning from the fraud that client has already flagged because, as Tonello put it, a crypto exchange and a bank have wholly different risk profiles. The model is tuned per sector rather than applied as one blunt instrument.

AI can now scam 100 people at once

Then we got to the warning, and Tonello did not soften it. Fraud used to require effort. A scammer had to socially engineer you one at a time, gathering your details, working the con by hand. AI has demolished that constraint.

“The fraudsters are moving at a speed that is very hard to keep up with. These fraud rings share technology, share ways to commit fraud with others. We call it fraud-as-a-service, people teaching people to do it, which is even worse. Technology is creating exponential growth for these bad actors. They can scam a hundred people at the same time.”

The scale of this is not hypothetical. Deloitte’s Center for Financial Services has projected that generative-AI-enabled fraud losses in the US alone could climb from $12.3 billion in 2023 to $40 billion by 2027. When the cost of running a scam collapses and the playbook is sold as a service, the defenders are simply outnumbered. Tonello was refreshingly honest that no single tool, his included, can solve this. Anyone claiming otherwise, he said, would be the one misleading you.

Why the only real defence is layered

So what does work? Tonello’s answer was an argument against the silver bullet. The smartest clients, he said, run a multi-layer approach, complementing their stack with multiple solution and data providers rather than betting everything on one. A single provider might be brilliant at catching one type of fraud while a different attack slips past it. Trustfull’s own role is deliberately collaborative: it partners with identity-verification providers and sits in the background, enriching their decisions with extra signals rather than trying to replace them. More data points, working together, from more sources.

It is a notably un-salesy thing for a vendor to say at a trade show, and that is what made it credible. The honest position in fraud prevention is that you are never finished and never fully safe; you are only ever better defended than you were, by adding another layer.

Why this matters for the Dutch and European reader

For the crypto industry specifically, this conversation cuts close. Trust is the bottleneck on adoption. Every headline about a rug pull, a drained wallet or a fake exchange teaches another wave of ordinary Europeans to stay away, and AI-powered fraud is pouring fuel on exactly that fire. The uncomfortable truth Tonello leaves you with is that the people trying to defraud your customers are now better resourced, better coordinated and faster than ever.

The constructive half of his message is that the tools to fight back are real, invisible to honest users, and most effective when layered together. For any Dutch or European business onboarding customers online, whether a bank, a payments firm or a crypto exchange, the practical lesson is to stop hunting for one perfect fraud filter and start building a defence in depth. In a world where one person with the right software can target a hundred victims at once, a single lock on the door is not a strategy.

This interview was recorded live at Money 20/20 Europe 2026 at the Amsterdam RAI. For more conversations with the people protecting the financial system, watch the full Cryptofocus series, and read our companion interview with Ledger Rocket on catching crypto fraud the second it happens.