Behind the scam, the people

Behind an online scam, there isn’t always just one criminal deceiving a victim. Sometimes there are other victims, recruited with false promises of work, moved far from home, stripped of their documents and forced through violence to take part in large-scale digital fraud.

This is the phenomenon that the United Nations has chosen to bring to the public’s attention on the occasion of World Day Against Trafficking in Persons, which is celebrated today, 30 July. The theme for 2026, “Trapped behind the scam”, highlights a growing form of trafficking for the purpose of forced criminal activity, closely intertwined with cybercrime, financial fraud, money laundering and corruption. Thousands of people are exploited by transnational organised crime groups and forced to carry out fraudulent operations on an industrial scale.

The campaign therefore calls on us to look beyond the screen and beyond the individual suspicious message. Behind digital infrastructures, fake identities and increasingly sophisticated manipulation techniques, chains of exploitation may lie that combine human and technological vulnerabilities. Combating them requires investigation and international cooperation, but also individuals and organisations capable of recognising the risks, protecting data and systems, reporting anomalous behaviour and not unwittingly fuelling the fraud economy.

It is in this context that the experience gained through Cybersecurity Seminars takes on particular significance. This programme is supported by Google.org in collaboration with Virtual Routes, and promoted in Italy by the University of Milan together with the Fondazione Mondo Digitale. The programme combines theoretical lessons, workshops, hackathons and service-learning activities, through which students and professionals put the skills they have acquired to use in the service of schools, businesses, third-sector organisations and other local bodies. The aim is to train 140 students and engage 175 organisations, delivering a total of 675 hours of training and practical activities.

The testimonies gathered during the project already point to an initial shift. Cybersecurity is no longer perceived as a subject reserved for specialists but is becoming a shared responsibility: it is becoming part of day-to-day procedures, guiding organisational decisions and fostering new forms of collaboration between technical, legal, educational and managerial expertise.

From knowledge to prevention

Matteo Alfieri, an electronics engineer specialising in data protection, has transformed his training programme into an awareness-raising initiative aimed at members of the public and staff at the Euroconsumatori association. He independently designed materials and sessions on data protection, artificial intelligence, phishing, fake websites, passwords and online fraud, tailoring them to participants of very different ages and levels of prior knowledge. The experience has enabled him to strengthen his professional skills, but has also produced a body of educational material that can be reused by other organisations. Individual knowledge thus begins to circulate, reaching people who may be more vulnerable to attempts at manipulation and helping to build a more aware digital community [read The skills that protect the future].

Security becomes part of care processes

For Francesca Sanna, a manager at a private healthcare company, taking part in the programme meant bringing cybersecurity directly into her own organisation. After gaining an in-depth understanding of risks and tools, she devoted forty hours to staff training, organising tailored sessions for those working in reception, administration and other departments. Using real-life scenarios, participants learnt to recognise phishing messages, protect patient data, handle documents and credentials correctly, and report suspicious communications. In a sector where system continuity and data confidentiality are integral to the quality of care, the training has begun to change behaviours, awareness and responsiveness [read Caring for Security].

From training to governance

Another participant applied the skills acquired to drawing up the school’s plan for the adoption of artificial intelligence and a new set of school regulations. The work began by listening to pupils, teachers and families and analysing the regulations, leading to agreed guidelines on the responsible use of AI. The documents were approved by the data protection officer without any substantial changes. This outcome highlights an important shift: training does not merely enhance the knowledge of an individual, but helps to define rules, responsibilities and procedures for an entire educational community. Change has also become evident in schools involved in service-learning activities. The analysis of digital infrastructure – from the electronic register to the website, and from firewalls to servers – has helped schools to view cybersecurity not merely as a compliance requirement, but as a shared responsibility. At the same time, pupils have expanded their technical knowledge with legal, regulatory and organisational skills, which are essential for dealing with incidents that affect people even before they affect systems.

Skills that transform organisations

Andrea Cogotti, a systems administrator, used the programme to view his own organisation from a new perspective. He analysed the company’s security posture and drew up guidelines for regulatory compliance, producing a report that went beyond his usual duties and was immediately recognised as valuable by the organisation [read Elevating organisational security].

Roberta Maisano, meanwhile, applied the techniques she learnt at the University of Messina, where she works in the IT systems and services department. Starting with the issue of personal data inadvertently published in online documents, she helped implement scripts capable of identifying potentially critical content. She also shared what she had learnt with an international student, initiating a further transfer of knowledge [read Roberta, the intelligence of change].

These are limited but significant changes. A revised procedure, an email identified before it causes harm, personal data protected, more informed regulations, or a trained individual who trains others represent the first signs of security becoming part of organisational culture.

The theme chosen by the United Nations reminds us that cybercrime is not a phenomenon separate from other forms of violence and exploitation. Digital scams can involve a convergence of organised crime, psychological manipulation, economic vulnerability, data breaches and human trafficking. This is why we need well-trained professionals, responsible organisations and citizens capable of questioning not only what appears on the screen, but also the people and systems that may be hiding behind a scam.

With Cybersecurity Seminars, training thus becomes a social infrastructure for prevention: it prepares new professionals and, at the same time, strengthens communities’ ability to protect themselves, collaborate and look after those most at risk.