In January 2024, a finance worker at the multinational engineering firm Arup in Hong Kong received an email from the company’s UK-based chief financial officer requesting a secret transaction. Suspicious, the worker joined a video conference call to clarify. On the screen, the CFO and several familiar colleagues laid out the parameters of the deal. Reassured, the worker wired $25.6 million across fifteen transactions. Only later, after checking with the corporate head office, did the reality surface. The worker was the only human on the call, and everyone else was a deepfake generated in real-time.
That $25.6 million wire transfer was not a glitch. It was an invoice for a newly abundant resource. For decades, the defining constraint on digital media was production. But if a photograph can be synthesized in three seconds, the file itself ceases to be proof of an event. The burden of trust shifts away from the content and onto the metadata, the issuer, or the cryptographically secured chain of custody. With content infinitely abundant, credibility becomes the sole scarce resource.
This shift is quietly rewriting basic digital infrastructure, starting in finance. Banks have monitored user behavior for years, but the generative AI boom took behavioral biometrics, a practice early adopters like NatWest have quietly built since 2016, and turned it from a niche security layer into a mandatory firewall. Because a short audio clone can easily bypass voice-recognition software, institutions increasingly rely on companies like BioCatch to track the exact angle a customer holds their phone or the cadence of their typing. You are authenticated by the involuntary physical habits of your hands.
Hardware manufacturers are responding by physically anchoring digital files to the real world. Leica’s M11-P digital camera features a secure chip that applies a cryptographic signature to a photograph at the exact moment the shutter clicks. Backed by the Coalition for Content Provenance and Authenticity (C2PA), a standards body including Microsoft, Adobe, and the BBC, the camera operates as a machine designed to prove its output originated from a real lens interacting with real light.
These technical standards, however, are brittle. C2PA metadata relies on manifest and EXIF data embedded in the file, making it trivial for bad actors to strip out simply by screenshotting an image or scrubbing the data during a re-export. The protocol acts less as an ironclad guarantee of truth and more as the opening move in a perpetual arms race.
This suspicion is rapidly dismantling asynchronous trust across the web, turning casual consumer platforms into biometric checkpoints. Dating apps, which rely entirely on user confidence to function, are a primary example. Tinder and Bumble now prompt users for video selfies to earn a verified badge, relying on 3D liveness checks and facial recognition to combat automated romance scams. Users who refuse the scan or fail the automated verification find their profiles algorithmically demoted or locked outright, effectively exiling them from the digital dating pool.
The corporate labor market is undergoing a similar structural correction. As generative tools flood recruiters with thousands of synthetically optimized applications per role, written credentials are no longer a reliable filter. To compensate, screening platforms like HackerRank funnel applicants into live, proctored coding assessments. Enterprise hiring systems now routinely deploy software that actively monitors a candidate’s tab-switching, eye movement, and webcam feeds during the test, ensuring the human matches the output in real-time.
A system built on total verification inherently requires intense surveillance. To prove we are human, we must hand over sensitive biometric data to private corporations. Projects like Worldcoin, which scans human irises using a metallic orb in exchange for a digital World ID, argue this proof of personhood is essential infrastructure for a bot-filled internet. Privacy advocates correctly identify the project as a centralized honeypot of biometric data. If a single private company owns the baseline identity layer of the web, they become a global tollbooth, dictating who gets to participate in the digital economy.
As automated verification scales, verifiable human interaction is quietly being repriced. For over a decade, getting a live customer service representative at Facebook or Instagram was nearly impossible for average users. Then the company launched Meta Verified. For a monthly subscription of $11.99, users receive a blue checkmark, proactive account monitoring, and priority access to direct human account support.
For the last thirty years, the internet was an engine for removing friction. We expected to access information instantly and anonymously. That frictionless abundance remains largely intact for low-stakes entertainment. We rarely need to cryptographically verify a meme. But wherever financial, professional, or social trust is required, the architecture of the web is running in reverse. We are actively re-engineering our digital lives to be difficult, accepting friction as the necessary price of proving we are real.
