No one sees the whole scam

There is a sentence in the Global Anti-Scam Alliance's write-up of its 2026 Europe summit that should be pinned above the desk of everyone working in fraud:

"A single scam can begin with a fake advertisement, continue through a messaging app or phone call, move through a payment rail and end with funds routed through mule accounts or cross-border criminal infrastructure. No one organization sees the full picture. Public-private partnerships are needed because scammers already operate across the boundaries that legitimate institutions often struggle to cross."

That is the whole problem in four sentences. Not that we lack detection. Not that we lack investigators, or takedown vendors, or fraud teams. We lack a shared view. The scammer runs a single continuous operation across advertising, messaging, telecoms, and banking, while the institutions defending against it each hold one disconnected fragment of the same attack and rarely compare notes in time to matter.

We are building Trust Defender because that fragmentation — the boundary problem — is, in our view, the defining weakness of modern fraud defense. This is what we think is broken, why the usual fixes do not solve it, and what closing the gap would actually require. Trust Defender is early, so read the last section as the approach we are building toward, not a finished capability.

The attack is one chain. The defense is a dozen silos.

Consider a coordinated impersonation campaign against a bank. A criminal group registers a look-alike sender, buys ads, seeds a messaging-app channel, sends "urgent invoice" emails to the bank's finance team, and simultaneously pushes fake "account security" messages to the bank's customers pointing at the same payment infrastructure.

Now look at who sees what.

The bank's email security tool sees a suspicious inbound message to an employee — one event, scored and quarantined, then forgotten. A digital-risk-protection vendor might spot the look-alike domain and file a takedown, on its own timeline, with no idea an employee was just targeted by the same actor. The fraud team sees anomalous transactions days later, after money has moved, and opens a case with no link to either of the first two signals. And the customers who received the scam message? They are, in almost every case, never told anything at all — even though the bank's own systems detected the campaign hours earlier.

Four defenders. Four fragments. One attacker who sees all of it, because the attacker built it as one operation. The criminal's advantage is not superior technology. It is that they operate across boundaries that email security, domain monitoring, fraud operations, and customer communications were never designed to cross.

Point solutions are excellent — at seeing one slice

This is not a criticism of the incumbents. The email-security platforms are very good at catching business email compromise. The digital-risk vendors take down phishing infrastructure impressively fast. The fraud case-management platforms give investigators a serious workspace. Each is best-in-class at its own layer.

But "best-in-class per layer" is precisely the shape of the problem. A bank can buy a leading tool for each slice and still have no system that recognizes the same campaign is hitting an employee's inbox and a thousand customers' phones at the same time. The correlation across layers — the thing that turns four weak signals into one confident picture of an active attack — falls into the gap between the tools. And the gap is exactly where the scammer lives.

The industry's instinctive answer is data sharing: get the banks, telcos, platforms, and vendors to exchange indicators. That is right, and GASA is doing important work to make it happen. But sharing indicators between organizations is only half of a loop. The other half — the half almost everyone forgets — is telling the people who were actually reached.

The forgotten half of the loop

Here is the failure that bothers us most. When a fraud campaign is detected, the detection almost never travels back to the individuals in its path.

The employee who received the impersonation email is quarantined and moves on, unaware they were part of a coordinated campaign. The customers who got the matching scam message hear nothing, because "we detected a scam targeting you" is not a workflow any bank currently runs at speed. So the same campaign keeps working on the next person for hours or days after it was first caught, because the knowledge sits in a quarantine log instead of reaching the humans who need it.

A signal that is detected but never returned to the people it could protect is, functionally, a signal that was wasted. Detection without a return path is a report, not a defense.

What closing the loop would take

The approach we are building toward with Trust Defender starts from a simple premise: put detection at the communication endpoint — where the scam message actually lands — on both sides of the boundary at once. The employee's channel and the customer's channel, running the same engine, feeding one shared view.

That does three things a stack of point solutions cannot.

First, it correlates across populations. When the same look-alike sender, the same payment destination, or the same malicious link shows up in both an employee's inbox and a wave of customer reports, that is not two incidents. That is one campaign, and seeing it as one is the difference between a shrug and an escalation.

Second, it manages the campaign as a single case, rather than as scattered events in four separate tools — so detection, correlation, attribution, and response live in one place instead of four inboxes.

Third, and most importantly, it closes the loop back to people. Once a campaign is confirmed, the warning returns to the endpoints that are still at risk — the customers who received the message, the colleagues who might be next — instead of dying in a log. That return path, from a detected campaign back to the specific individuals it reached, is the piece the current market structurally cannot deliver, because no existing vendor sits on both the employee and the customer endpoint at the same time.

We are honest that this is hard and unproven at scale. Doing it responsibly means treating employee and customer channels very differently on consent and privacy — an employee communication and a customer's private message cannot be handled the same way, and getting that wrong would make the whole approach both unsellable and wrong. It means earning the right to sit on those endpoints. And it only reaches its full value plugged into the wider public-private sharing networks that GASA and others are assembling, because no single company — us included — will ever see the entire chain alone.

Why this is the right fight

GASA's framing is correct: scammers win in the space between institutions. The response cannot only be better detection inside each silo. It has to be connection — across layers, across the employee and customer boundary, and ultimately across organizations — plus a return path that gets the warning back to the person in the scammer's crosshairs before the money moves.

No one organization sees the full picture today. We think the job is to build the tools, and join the partnerships, that let more of that picture be seen — and, crucially, acted on — while there is still time to stop the next victim rather than count them.