1. The Town Square Problem

Step into a crowded town square and you have stepped into the oldest open room there is. Nobody checked your name — there is no door to check it at, no edge to the place, no threshold anyone is watching. You came in off the street, like everyone else, and you move among strangers who arrived the same way. People come to a square to trade and deal and strike bargains with people they have never met, which means the place is thick with money and with trust — both of them carried by people who have to extend them to strangers to get anything done. That openness is the whole appeal of the place, and it is also the oldest opportunity in the world, and there is a name for the person who comes to take it. Call him the con artist. He works the open room because the open room is where the targets are, and he works it because the open room cannot stop him. Nobody in the crowd knows who he is. He gives a name; the name means nothing, because there is nothing behind it — no record, no reputation, no way to check whether the man introducing himself as a financial advisor today is the same man who drained somebody's savings under a different name last month. When the square turns on him, he leaves, and in the next town's square he is a financial advisor again. His entire business model rests on a single fact about open rooms: in a crowd of strangers, you cannot tell the strangers apart.

He has worked that pitch for as long as there have been open rooms to work. The town square gave the problem its oldest name, but it is only the most familiar of many such rooms. The same shape is the public park, the hotel lobby, the conference floor, the crowded platform waiting for a train, the market stall. The defining feature of all of them is that they are open. There is no membership roll, no one at the gate checking names against a list. That openness is not an oversight; it is the entire point. The square is valuable precisely because anyone can walk into it — the regular and the newcomer alike, the honest stranger carrying exactly the thing you came hoping to find. A place you have to be invited into is not an open square; it is a club. The openness is what makes the square generative, surprising, alive. It is also what lets the con artist in.

Here is the dynamic, stated as plainly as I can: any space that is open to all, that contains something of value, and that cannot reliably tell its members apart, will be exploited. Those three conditions — open access, value in the room, weak identity — are not a list of risk factors that sometimes coincide. They are a single mechanism. Where all three hold, abuse is not a possibility to be managed. It is a certainty to be metabolized. The only question is what form the abuse takes, and that form is set by whatever is most valuable in the room at the moment. In a room full of concertgoers, he sells counterfeit tickets. In a room full of investors, he sells fake tokens. The pitch changes; the structure does not.

But notice that the physical square is not actually defenseless against him, because the contrast is going to matter enormously once we move online. In a real square, the con artist operates under a quiet set of constraints that nobody wrote down and nobody enforces deliberately. He has one body. He can be in one place at a time. His face is the same face today that it was yesterday, and a face that cheated someone last week is a face that person will remember and point to this week. The merchants work the same stalls day after day and come to know who is trouble; the regulars recognize the regulars; a reputation, good or bad, sticks to a person because there is a single persistent person for it to stick to. The square polices itself, imperfectly but persistently, through the simple physics of embodiment: one human being, one continuous identity, a memory the community can attach to that identity and carry forward. The con artist's only escape from his accumulated bad name is to physically travel to a square that has not yet met him — the next neighborhood, the next town, the next market day — and that travel is slow, costly, and finite. He cannot outrun his own face faster than the news of it travels.

Strip away that physics — give the con artist the power to wear a fresh face every minute, to sit in ten thousand rooms at once, to leave and return in the same instant as a complete stranger — and you have not made him a little more effective. You have removed the only mechanism the room ever had for protecting itself. That is exactly the power the open online square hands to every participant, for free, by default. The thing the internet broke was not some specific feature. It was the quiet physics of embodiment that made reputation possible in the first place.

The internet did not invent this; it industrialized it

When people talk about online scams, they tend to talk as though they began with email, as though some specific message in some specific year opened a door that had been shut. Mass unwanted messaging did arrive at industrial scale with the network — we will meet the first documented case of it, sender's name and all, in the next chapter — but the underlying move is older than any network. One operator working a room full of strangers arrived with the first open gathering of human beings. The network did not change the move. It changed three numbers. The first is reach: the con artist working a town square could work one square at a time, and the square held only as many people as he could get to, one conversation at a time; the online square holds millions, and a single message reaches all of them in the time it takes to press a key. The second is cost: working a physical square cost him his time, his travel, his exposure to a crowd that might recognize his face, while a message sent to ten million recipients online costs the sender the same as a message sent to one — almost nothing. The third is identity, and identity is the one that matters most. In the physical square the con artist had one body, one face, one voice. Online he can be anyone, and he can be everyone, and he can be ten thousand someones simultaneously, each with a different name and a different face, none of them costing him a thing.

Hold those three numbers — infinite reach, near-zero cost, free and unlimited identity — next to each other, and the entire economic logic of the scam economy falls out of them automatically. If you can reach everyone, for nothing, while being no one in particular and anyone you like, then the rational move is to reach everyone, constantly, with whatever pitch converts. You do not need a one-in-ten response rate, or one in a thousand, or one in a million. When the marginal cost of an attempt rounds to zero, a response rate that any honest business would consider a catastrophic failure is, for the spammer, pure profit. This is why the scams you receive are so transparently stupid. They are not aimed at you. They are aimed at the one person in ten million credulous enough to respond, and reaching the other 9,999,999 cost nothing, so their contempt is free. Stupidity that scales beats cleverness that doesn't.

This is the part most people get wrong when they first reason about the problem. They assume spam is dumb because spammers are dumb. Spam is dumb because dumb is optimal. A famous 2008 study out of UC San Diego and Berkeley — "Spamalytics," by Chris Kanich and colleagues — made this concrete by infiltrating the Storm botnet and measuring its actual conversion. To sell pharmaceuticals, the campaign they observed converted on the order of one in twelve million messages. One in twelve million. No legitimate enterprise on earth could survive that funnel. The spammers thrived on it, because the twelve million messages were free. That is not a story about bad marketing. It is a story about what becomes rational when cost goes to zero and identity is unbounded.

There is a deeper asymmetry hiding inside those three numbers, and it will define every defensive struggle in this book. The attacker pays per attempt, and his per-attempt cost is approximately zero. The defender pays per defense, and the defender's costs are stubbornly real: engineers, infrastructure, training data, and above all human attention, the most expensive resource there is. The attacker can generate a million new attempts overnight for almost nothing — the price of some compute and a stack of disposable accounts; the defender cannot generate a million new defenses overnight at any price. The game is rigged at the level of basic arithmetic — the cost of attacking falls toward zero while the cost of defending stays anchored to the price of human effort and human judgment, an imbalance of orders of magnitude whose structure we will examine later in the book. And notice what every term of it traces back to. Reach is cheap because the network carries the message for free. Attempts are cheap because sending costs nothing. But the thing that lets a single attacker mount millions of independent-looking attempts — the thing that lets him survive being detected, banned, and blocked over and over without it ever slowing him down — is that identity is free and disposable. Ban a spammer's account and he is back in seconds under a new one, because the new one cost him nothing to mint. Pull on any thread of the scam economy and it leads back to that hinge.

Spam and scam are symptoms; the disease is missing identity

Now we get to the move that the rest of the field has spent two decades not making, and that this book is built around. Almost everyone — platforms, vendors, researchers, the well-meaning admin trying to keep a community clean — treats the problem as a content problem. The reasoning is intuitive: the harm arrives as messages — a spam blast, a phishing link, an impersonator's friendly DM, a fake support agent, a too-good-to-be-true giveaway, the first warm line of a romance con — so the job is to identify the bad ones and stop them. Build a classifier. Train it on known-bad. Score each incoming message; block the ones that score high. This is the entire architecture of email spam filtering, of platform moderation, of the keyword bans and link blocks that every community admin reaches for first. It treats the message as the thing to be judged.

It does not work, because the message is not the disease. Spam is its loudest symptom and fraud its most expensive one — and the whole range between them, from the drive-by link to the patient impersonation to the deepfaked founder, is downstream of a single deeper condition: the room does not know who is in it. Treat the symptom and the disease keeps producing new symptoms, each one shaped to slip past whatever you built to catch the last one. You block a keyword; the spammer changes the word. You block a domain; he registers a new one. You learn the shape of his message; he reshapes it. Every defense you build teaches him exactly what he has to change, and changing it costs him nothing, because there is no cost attached to him. There is only a cost attached to his current message, and he has an infinite supply of messages and an infinite supply of selves to send them from.

Let me make the distinction sharp, because it is the hinge the whole book turns on. There are two questions you can ask about anything that arrives in your community. The first is what is this? — is this message spam, is this link malicious, is this image a scam. The second is who is this? — what account sent it, what is that account's history, what has it done before, what is it likely to do next. Every defense in widespread use today is built to answer the first question. The thesis of this book is that the first question is unanswerable in isolation, and that the second question is the only one that ever mattered.

Watch how the impossible problem becomes trivial the moment you shift the question. Take the message "Hey, check out this project, I think you'll like it." Asked as a content problem — is this spam? — it has no answer; the words are innocent, the words are everywhere, the words are exactly what a real friend would say. Now ask it as an identity problem. Who sent this? If the answer is "an account that has existed for three years, that hundreds of people in this community have interacted with, that has never once posted a malicious link, that is the same account the project's founder has used since the project began" — then the message is almost certainly fine, and you knew it was fine without reading a single word of it. If the answer is "an account created eleven minutes ago, with no history, whose display name and photo were changed an hour ago to match the founder's, that has sent this identical message to four hundred people in the last ten minutes" — then the message is almost certainly an attack, and again you knew it without reading the words. The content carried no signal. The identity carried all of it. The classifier was staring at the one part of the situation that was deliberately designed to look innocent, while ignoring the part that gave the whole thing away.

Two honest caveats hide inside that almost. A trusted account can be stolen — the prologue's victim lost more than a million dollars to a message from exactly such an account, established and real and simply not in its owner's hands that afternoon. And a patient enough adversary can do what the cheap flood never bothers to: spend years behaving well to build a reputation worth betraying, then cash it in a single day — a sleeper rather than a spammer, and in the AI era a sleeper that need not even have a human behind it. Those two are real, and the back half of this book keeps circling back to them, because they are what is left after everything else is solved. But notice what they are not. They are not the flood. The overwhelming bulk of what these rooms drown in is the disposable, no-history, minutes-old account, and that entire category — the part that makes spam an industry — cannot survive the question who is this? at all. The expensive, patient attacks survive it; the cheap, infinite ones do not. Shifting from content to identity does not promise certainty about any single message. It does something more valuable: it turns an unbounded problem into a bounded one.

I want to be precise about a word I just used, because I will use it for the rest of the book and people mean different things by it. By identity I do not mean your legal name, your passport, your face on a government file. I mean something narrower and, for our purposes, more powerful: a persistent, costly-to-create handle to which a history can attach. The con artist's problem, from the room's point of view, is not that we don't know his real name. It is that we cannot bind anything to him — no track record, no accumulated trust or distrust, nothing that persists from one encounter to the next. A pseudonym would be fine, even excellent, if it were expensive to make and impossible to discard. The catastrophe of the open online square is not anonymity per se. It is that identity is free, infinite, and disposable. You can be anyone, you can be many, and when one identity earns a bad reputation you simply throw it away and mint another at no cost. That is the disease, stated exactly.

And there is a reason the open square cannot simply decide to tell its strangers apart — not laziness, not a missing feature someone forgot to build, but something closer to a law. Suppose your defense finally gets good. Suppose you build a system clever enough to look at the behavior in the room — the timing of messages, the patterns of connection, the shape of the activity — and conclude, correctly, these ten accounts are all behaving like spam. You ban all ten. Now ask the question that breaks the whole approach: how many accounts were those ten, really? If they were ten different people, you just cleaned up your community. If they were one person wearing ten faces, you have accomplished almost nothing, because the cost of the eleventh face is zero, and the twelfth, and the thousandth. You banned ten symptoms of one disease. The actor walked.

A computer scientist named John Douceur stated this precisely in 2002, in a paper that gave the problem its lasting name, and we will give his result the full weight of its own treatment later in the book. Its shape is this: in an open system with no trusted authority to vouch for identities, a single participant can manufacture an essentially unlimited number of distinct identities, bounded only by the resources they choose to spend. He called the manufactured identities Sybils, after a famous case of multiple personality, and the attack of one actor presenting as many the Sybil attack — and the corollary is that no amount of observing behavior can reliably collapse the many apparent identities back down to the one actor behind them. The result is conditional, not cosmic: introduce a trusted authority, or attach a real cost to each identity, and the conclusion loosens. But the open square as we have built it has neither, and under those conditions the strangers genuinely cannot be told apart. Every defense that judges messages instead of actors is, by construction, fighting symptoms while the actor stands untouched behind an inexhaustible supply of fresh faces. This is why, two decades on, the war feels unwinnable to the people fighting it. It is not that they are not trying hard enough. They are answering the wrong question, and the wrong question has no answer.

Telegram is the sharpest instance, not the special case

I am writing this book with Telegram as the setting, and I should say plainly why, so you do not mistake the setting for the subject. Telegram is not the cause of any of this. It is the place where the timeless dynamic of the open square reached its most extreme and most instructive expression, for three reasons that map exactly onto the three conditions I gave you at the start.

It is the most open. A Telegram supergroup can hold up to two hundred thousand members; a channel's audience is unbounded; link sharing is frictionless, joining is a tap, and the platform built its culture around exactly the kind of permissionless reach that the open square represents. There is the most value in the room, because Telegram became, for reasons we will trace, the operational backbone of the cryptocurrency world — and a crypto community is a town square where the strangers are carrying transferable, irreversible, anonymous crypto in their pockets. And it has, among the major platforms, historically the weakest native identity. A Telegram account is a phone number, and phone numbers are cheap, rentable, and disposable at industrial scale; the displayed name and photo are arbitrary and changeable at will; there is no built-in notion of a persistent, portable reputation that travels with an account across the communities it touches. Maximum openness, maximum value, minimum identity. The result, as the prologue's takedown numbers hinted and as Chapter 18 will count properly, is enforcement at a scale no platform with a real identity floor ever needs. If you wanted to design a laboratory for studying what the open-square problem does at full intensity, you could not do much better.

But resist the temptation to file any of this under "Telegram," because you can watch the same disease produce differently shaped symptoms wherever the three conditions hold. Discord, with its open invite links and its sprawling crypto and gaming communities, fights the same swarms of free identities; the form differs — webhook abuse, raid bots, server-nuking — but the structure is identical. WhatsApp, despite being nominally tethered to a phone number, runs an entire underground economy of bulk numbers and warmed accounts behind its waves of investment and romance fraud. X turned the question of who is real into a daily public spectacle. Email has spent thirty years fighting a fight that is, at its core, about not being able to trust who a message claims to be from. Different rooms, different values, different surface symptoms. One disease: open access, value in the room, weak identity.

There is a tempting counterargument worth dispatching here, because it comes up every time someone proposes that identity is the root of the problem. The objection runs: but X tried verification, and it didn't work — so identity isn't the answer. It is true that X spent enormous energy and public attention on the question of who is real, and it is true that the result was, by most accounts, a mess. But look closely at what X verified, because the lesson is precise and it is not the lesson the objection draws. The blue checkmark, once it became a paid product, verified that someone had paid. It did not verify a persistent reputation, it did not raise the cost of creating a new identity to any meaningful level, and it did not bind a history to an account in a way the community could trust and carry forward. It answered "did this person pay us?" — which is not "who is this, and what is their reputation?" A verification system that confirms payment while leaving identity cheap and reputation absent is not a counterexample to the identity thesis. It is a confirmation of it: it shows that doing identity badly — verifying the wrong thing, attaching no real cost, encoding no portable reputation — solves nothing, exactly as the thesis predicts. The failure of a bad implementation is not evidence against the idea. It is evidence about how hard the idea is to implement well, which is a different matter entirely, and one we will spend a great deal of the book taking seriously.

So when I tell you, in the chapters ahead, the specific story of how the scam economy grew up inside Telegram communities, read it as a case study, not as a biography. Telegram is the lens because it shows the phenomenon at the highest magnification. The phenomenon is about every open community there is, and every open community there will ever be, because the conditions that produce it are not bugs in any platform. They are the price of openness itself.

Which leaves the obvious question: if the disease is structural — if it has been baked into open squares since the first one, and a researcher named it precisely back in 2002 — why did nobody treat it at the root? The honest answer is that for a long time we did not have to. The early open squares of the internet — the mailing lists, the forums, the chat rooms — had the disease in full, but what was in the room was, by the standards of what would come, almost worthless: the con artist was selling counterfeit watches and herbal supplements and the chance to help a stranded prince move his fortune, a numbers game played for small money. The genuinely dangerous frauds of the age did exist — the phishing that hijacked a bank login, the trojan that emptied an account once a careless click let it in — and they took real money. But they reached for it through the bank, over email and the web, in a system with chargebacks and fraud desks and a recovery window; they almost never lived in the open room, which was a place to be lured from, not a vault to be drained. When the stakes inside the room are that low, a defense that is merely annoying to the attacker is good enough, and the structural cure — putting cost and friction in front of the open door — works against the very openness that makes a community worth joining in the first place. No community in its right mind would trade away its frictionless, welcoming front door to swat at a problem that cost its members a few dollars and a little irritation. The leaky defense was not a mistake. It was the correct answer to the question being asked — and the question was about to be replaced by a far worse one, while the old answer carried forward, unexamined, into a world where it was catastrophically wrong. Every open community, from the first mailing list to the largest channel on the largest platform today, has always had the same single question lurking under every message that arrives: who is in the room? For decades we got away with not answering it. Not because the question went away. Because the stakes were low enough that the wrong answer didn't cost us much.