Scammers are waiting to swindle new internet users. How do we protect them?
Getty ImagesThe global internet continues to welcome first-time users – and many of them have little experience with the kind of confidence tricks scammers use against them. How can we protect them?
In 2022, Anicet Etekpo, a security officer in Benin, clicked on a Facebook link sent by someone he believed was a friend. "The link led me to a fraudulent platform that asked for my personal information, including my bank account," he told the BBC. Etekpo suffered a significant financial loss and began to question the security of his personal data.
He had only been online for a few years when the incident happened. As internet connectivity expands in places like West Africa, millions will encounter online risks like his for the first time. How can they be protected?
An estimated 2.6 billion people – roughly a third of the global population – currently have no access to the internet. If connectivity continues to increase at its current rate, approximately two billion more people will gain access to the web by 2030. For many new users, that will mean navigating spam, ransomware and fake websites for the first time.
Such exposure creates fresh opportunities for cybercriminals: a kind of cybercrime "gold rush". But the systems designed to protect new users, from digital literacy training to consumer fraud protections, have not always expanded at the same pace.
"What we're seeing is an increasingly professionalised and opportunistic cybercrime ecosystem," says Zeki Turedi, field chief technology officer at CrowdStrike, a cybersecurity company that tracks digital adversaries. "While we primarily work with companies, the ripple effects of that protection extend to individuals, especially when we help secure vital infrastructure like healthcare, education and public services that many new users rely on."
Getty ImagesCybercriminals are using automation, AI and social engineering to exploit any digital weakness, regardless of how long users have been online. But for those encountering these threats for the first time, the internet's changing landscape can make spotting them even harder, says Turedi: "On the one hand, a new internet user today gains access to life-changing information, services, and opportunities. On the other, they're met with a digital environment that is far more complex and dangerous than when many of us first came online."
Adversaries are now able to use lures that are culturally or linguistically tailored to impersonate local banks, offer fake government assistance and promote mobile apps that appear benign but contain spyware. "We expect this to intensify as criminals adapt their tactics for AI-generated content and deepfakes," adds Turedi.
These criminals often coordinate plans in dark web forums, over encrypted channels. Some groups even offer "starter kits" for cybercrime, providing pre-packaged phishing supplies or access to stolen credentials that make it easier for less technically savvy criminals to enter the space.
International law enforcement agencies have warned that cybercrime has become increasingly organised and commercialised. The International Telecommunication Union Global Cybersecurity Index, for example, highlights risks facing new internet users, including fraud, phishing, and an increase in ransomware attacks.
For Etekpo, the scam's consequences were real. "I felt very vulnerable," he said. He believes that vulnerability lies less in technical ignorance than in trust: "Many people trust their online contacts and react quickly, without verifying a message's legitimacy."
Vulnerability is particularly acute in Africa: the continent remains the least connected on Earth, even as it experiences some of the fastest growth in internet adoption. (A recent paper found wide disparities across the region).
AlamyWhile countries such as South Africa and the Seychelles now have penetration rates approaching 80%, rural regions in parts of Benin and highly populous countries like the Democratic Republic of the Congo remain largely offline. Satellite connections are expensive, fixed-line internet infrastructure is limited and often unreliable, and inadequate protections leave those who do manage to get online vulnerable to fraud. Given that the number of internet users in Africa is forecast to increase by more than 280 million over the next four years, there is urgent need for better cybercrime prevention measures.
According to Interpol, cybercrime-related losses in Africa have more than doubled since 2024, rising from $192m (£141.5m) to $484m (£357.6m).
Safeguards do exist, but experts believe they need to be more robust: digital literacy programmes in schools and stronger consumer protections for online fraud.
The United Nations Office on Drugs and Crimes has developed smart detection technology solutions and native security measures (access controls and malware detection) as part of its response to cybercrime, while the FBI has specially trained cyber squads in each of its field offices. In the UK, the National Crime Agency has launched several successful international investigations into cybercriminal gang activity. But these measures largely focus on investigating cybercrime, rather than targeting the risks faced by new internet users.
"Cybersecurity is a huge concern," says Robert Anderson, founder of Telecom4Good, a nonprofit IT partner that helps other global nonprofits (many of which are Africa-based) secure safe, affordable internet services. CrowdStrike recommends that organisations "think of cybersecurity not as a checklist, but as a continuous process of improvement."
Such risks are likely to grow as the digital ecosystem expands. The number of internet-connected devices – from power plants to pacemakers to self-driving cars – is projected to reach more than 38 billion worldwide by 2030, according to industry forecasts. As the number of connected systems grows, so too does the potential attack surface– that is, the entry points for hackers.
Governments and law-enforcement agencies are scrambling to experiment with ways to respond. Some administrations have tried to criminalise various forms of cybercrime. The African Union made cybersecurity a key priority under its "Agenda 2063," while Interpol is helping African police agencies prevent and investigate cybercrime, including teaching small businesses how to protect themselves from online scams.
In Myanmar, where internet use expanded rapidly during the 2010s, the Department of Foreign Affairs funded an awareness campaign specifically targeting new internet users. In 2024, Nigeria revised its Cybercrimes Act, adding protection measures for emerging digital markets. India, meanwhile, set up a national hotline that allows victims to report scams immediately and freeze stolen funds through banks and payment apps.
More like this:
Education, another part of government's remit, may prove just as important as enforcement. But governments can undermine the very freedoms they’re meant to protect. "Governments implement digital lockdowns, [preventing] open use of communications during elections, civil disruptions or national disasters," says Anderson.
Technology companies have also attempted to address the problem, though their efforts often focus more on platform security than on preparing first-time users for emerging threats. In 2018, Microsoft launched a Cybersecurity Tech Accord, a coalition of more than 150 global technology companies committed to foundational cybersecurity principles, including protecting users against cyberattacks and providing tools to help people stay safe online.
These commitments represent an important step toward making the internet safer for everyone, regardless of technical expertise or location. But translating broad industry pledges into practical protections for first-time internet users remains a challenge, particularly as cybercriminals develop increasingly sophisticated methods of exploitation.
When asked about its free security tools, Google pointed to a suite of tools, including Google password manager, two-step verification, passkeys (passwordless forms of authentication such as biometrics), and its Advanced Protection Program, which offers additional protection to high-profile users like campaign workers and journalists, says Kimberly Samra, a security spokesperson for Google.
As for any thoughts about a "cybercrime goldrush," Samra said: "I don't think we have much visibility there, given it's speculative."
As connectivity spreads faster than digital literacy or cybersecurity infrastructure, the question may not be whether new users will encounter cybercrime – but how prepared they will be when they do.
--
For more insights, sign up to our Tech Decoded newsletter, where Lily Jamali and Thomas Germain break down the biggest stories of the tech world, and help you live a better digital life. Sign up for free here.