Introduction · 4 min read

The problem

In short Machines now pass as people online, the robot checks that kept them out are broken, and asking for more personal data only creates more to leak. Apps need a small, private answer: is this a real, unique person?

The internet was built on a quiet assumption: that behind every account there is a person. That assumption no longer holds.

#Machines now pass as people

Language models write replies that read like a friend's advice. Voice and video models copy real faces and voices. A single operator can run thousands of accounts that post, like, follow and argue around the clock. Ask whether a reply was written by a person and, more and more often, there is no way to tell.

The cost is trust. When you cannot tell who is real, you start to doubt everyone: the review that convinced you, the account that agreed with you, the stranger who was kind.

#The old defences have fallen

For two decades, websites kept bots out with puzzles: blurry letters, traffic lights, crosswalks. Today, image models solve those puzzles as well as people do, and often faster. The puzzles still slow down real people, especially people with low vision or slow connections, while barely slowing down machines.

Some newer checks quietly watch how visitors move and browse to guess whether they are human. That keeps some bots out, but it is tracking by another name.

#More personal data is not the answer

The usual fix is to ask for more: a phone number, an ID document, a selfie stored on a server. Each of these creates something new to leak, sell or misuse, and each excludes the billions of people who do not want to, or cannot, hand them over.

The question most apps actually need answered is much smaller: is this a real person, and is it the only account they have here? Today there is no simple, private way to ask it.

#It's already happening

These are not predictions. Each of these happened in the last two years.

Bots now outnumber people online. In 2025, automated traffic made up more than 53% of all web traffic, up from 51% the year before, according to Imperva's annual Bad Bot Report. Humans are now the minority on their own internet. ^[1]

The robot check no longer works. In 2024, researchers at ETH Zurich built an AI that solved 100% of Google's reCAPTCHA v2 image challenges, needing about as many attempts as a person. ^[2]

A video call where everyone else was fake. In early 2024, an employee at the engineering firm Arup in Hong Kong joined a video call with people he believed were the company's finance chief and colleagues. All of them were deepfakes. He transferred about HK$200 million, roughly US$25 million, in 15 payments. ^[3]

Impersonation is a multi billion dollar business. People in the United States reported losing $12.5 billion to fraud in 2024, 25% more than the year before, with nearly $3 billion of it lost to scammers pretending to be someone they are not. ^[4]

Fake reviews became illegal, because they became normal. In August 2024, the US Federal Trade Commission banned fake reviews and testimonials, explicitly including ones written by AI and fake social media followers. ^[5]

Fake accounts are counted in billions. Meta reported acting on about 1.4 billion fake accounts in the last three months of 2024 alone. ^[6]

Rewards go to whoever makes the most accounts. When the crypto project LayerZero prepared its 2024 airdrop, it flagged 803,093 addresses, about 13% of those eligible, as likely belonging to people farming rewards with many wallets. ^[7]

Collecting IDs creates new risks. In 2024, it was reported that AU10TIX, an identity verification company used by TikTok, X and Uber, had left administrator credentials exposed for more than a year, potentially giving access to people's names, birth dates and photos of their identity documents. ^[8]

#What each case needs

#Who pays the price

• People lose trust in what they read and who they talk to, and lose time to puzzles and checks.
• Communities and games are overrun by fake accounts that farm rewards and drown out real voices.
• Businesses pay for fake sign ups, fraud and moderation, and carry the risk of storing personal data.
• Rewards and giveaways end up with whoever can create the most accounts, not with real people.