Why the infrastructure that funds the internet was built for speed, not security.
Two years ago, in 2024, the FBI recorded $1.46 billion in reported losses from tech support fraud alone, nearly double what it was two years before that. That figure reflects only reported losses, meaning the true cost is almost certainly higher. Yesterday, a woman in Ohio wired money to a help desk that never existed, for a problem she never had. The warning on her computer looked exactly like something Microsoft would send. It appeared on a site she trusted, delivered through advertising infrastructure that had already reviewed and approved the campaign.
The ad system didn't catch it, and the digital advertising world doesn't like to talk about why.
Most of the modern internet is funded by advertising, a global market that now exceeds $600 billion a year. News, entertainment, search, social, and countless services: all of it underwritten by a system designed above everything else to move fast and sell influence.
Programmatic advertising can buy, sell, and deliver an impression in milliseconds. That speed was the engineering goal. Security came later (if at all) intermittently bolted onto infrastructure built for a different priority.
The resulting programmatic frankenstein is a patchwork process that resembles procedural compliance more than real risk management. Ads are reviewed (sort of, sometimes), policy boxes are checked, campaigns proceed. The documentation records that evaluation occurred. Whether the evaluation means anything is a different question entirely.
In the platformed internet, the gap between how a campaign behaves during review and how it behaves once it reaches users has a name: cloaking. A campaign stays cloaked during review and reveals itself once it reaches users. The attackers are not breaking the system. They're exploiting the assumptions the system was built on. Advertising infrastructure evaluates how a campaign behaves during inspection and uses that observation to infer how it behaves everywhere else. But cloaking is specifically designed to break that assumption. What appears compliant during review can behave entirely differently once it reaches real users. More reviews would help, but every company doing its review and applying a rubber stamp would still result in the attack reaching its victim.
Cybersecurity needs a new paradigm for the next decade, especially when dealing with supply-chain-level risks like those facing the digital advertising industry today.
Worth naming, too, is what keeps the current rubber stamp inked. Friction costs money. Slower review means less inventory cleared, less revenue flowing. For some participants in this ecosystem, the speed-first architecture is a load-bearing feature for their continued scamming.
Advertising infrastructure becomes the distribution system for that borrowed credibility, and the cost of running these operations has dropped sharply. Creative templates, targeting parameters, and call center scripts circulate widely in underground markets, accessible to groups without significant technical resources. What they need is access to legal ad systems built to prioritize volume over scrutiny.
Artificial intelligence has supercharged the scammers' ability to launch attacks, pivot them, or shapeshift them. Now, the incoming pace far surpasses what any human-based review process could hope to achieve.
Comparisons to the 2008 financial crisis are common, and not entirely wrong, but they undersell something specific about how advertising differs. Yes, complex instruments moved through rating and approval processes that generated documentation without generating understanding. Yes, the gap between process and actual risk eventually became a structural crisis. But mortgage-backed securities were opaque because they were complicated. Digital advertising is opaque because it was designed to move faster than transparency allows. Visibility cannot keep pace with the speed and fragmentation of the system. Visibility ends at the boundary of each platform, and attackers live in those seams.
The financial industry's rubber stamp era ended because inaction became more expensive than accountability. The ad economy is on the same trajectory, but the difference now is that you get to choose to defend yourself before there is a critical failure.
The pressure is building. Regulators are paying closer attention. Advertisers are getting tired of having their budgets associated with scams. Consumers do not forget.
The Ohio woman certainly won't. She fell victim to a system performing exactly as designed: fast, frictionless, and largely indifferent to what it was moving. She did not fall for a scam that slipped through the cracks. She encountered a system where the cracks are part of the design. The industry isn't paying for that. She is.