AI is making fraud almost free to scale, NordVPN CTO warns

A working set of stolen credentials, a business email, a live credit card, and an ID now runs about $19, according to NordVPN research.

The people who run consumer cybersecurity say AI has made both the theft and the fraud that follows almost free to scale.

For investors, that is quietly turning a commodity VPN business into a higher-value fight over identity and fraud.

Marijus Briedis, chief technology officer of NordVPN, said on the On The Margin podcast that stolen identities are now shockingly cheap.

Citing recent NordVPN research in Lithuania, he said it costs little "to get working business email, a working credit card and some kind of ID; it's about nineteen dollars these days."

The reason is scale. "Those leaks happen basically every day these days," he said. "You are operating at a data level, and basically, you don't care, honestly.You just combine that data from different sources and put it into a basket ... a new database, and you just try to sell it as much as possible."

The reported losses are already at all-time highs. The FBI's IC3 annual report counted $16.6 billion in cybercrime in 2024, up 33% on the year, and Deloitte's Center for Financial Services expects generative-AI fraud to reach $40 billion in the US by 2027, from $12.3 billion in 2023.

Why AI has industrialised fraud

The tooling has collapsed to almost nothing. Standing up a fake storefront to harvest card details, Briedis said, "is just like a ten-minute job these days, including buying the domain, putting the website, pushing it to the prod as we call it."

That, he said, is why scam and phishing campaigns scale "exponentially," especially around Black Friday, and he expects AI tools to push it "basically exponentially" from here.

The next front is voice, and he said it is already running.

"There are already advanced attacks that people first try to call your relative to get your voice and how you're talking, and then use that AI-generated voice to call your relative to try to scam you," Briedis said. He expects fraud to keep combining "text, voice, video."

It has already cost companies real money. Briedis pointed to the 2024 case at Arup, the London engineering group, whose Hong Kong finance worker wired $25.6 million after a video call in which every other participant was an AI-generated deepfake.

"The accountant was lured into sending twenty-five million to the scammers because he was in the Zoom meeting with all the executives at the time," he said.

The automated frontier worries others in the field. Varun Kabra, chief growth officer at identity-focused blockchain Concordium and a former executive at privacy firm Proton, said on the same podcast that AI agents are starting to transact for people, and nobody can see who is really behind them.

"The counterparty on the other side, the airline in this case, or the ticketing platform, whatever it is, they have no way to verify where a real accountable human is behind the transaction," he said.

"And that could open a door to fraud, bots acting as humans, agents operating with no accountability."

He put a clock on it: "We're probably six to twelve months away where these transactions might overtake the human-to-human transactions, and hence the human-to-agent accountability is the biggest problem I think the world needs to solve for."

The point for investors is that today's fraud market runs on stolen human identities, and the next one runs on machine identity, agents spending with no human in the loop to blame.

Why the VPN is becoming a fraud-defence product

NordVPN has widened from a VPN into a fraud-defence bundle, and Briedis said the overlooked hole is the session cookie.

"A lot of people like to log in to their account and just forget it. They don't like to log out. And usually that's the problem because if the cookie gets generated and it's leaked through info stealers or malware or whatever it is, that cookie could be used with different techniques to log into your account and take over your data," he said.

His yardstick for shipping a feature is not technical. "The biggest and the greatest QA of our product is my mom," he said.

"If the feature is too geeky and she doesn't understand how to use it, that's a really good indicator whether we should push it or not."

The pivot is a margin story too. A standalone VPN is now a price-war commodity, while identity and fraud protection is stickier and higher-value, wired to a customer's bank details.

Market estimates for identity-theft protection range from roughly $14 billion to $17 billion in 2025, with most forecasts pointing to low-double-digit annual growth.

The tell came in April 2025, when Gen Digital, which merged Norton with Avast in 2022, paid about $1 billion for the consumer-finance app MoneyLion, bolting banking and credit tools onto its identity-protection business. Nord's "more than VPN" is the same bet from the private side.

That Vilnius firm, last valued at $3 billion in a 2023 Warburg Pincus round, competes with Gen Digital and McAfee, while ExpressVPN, Surfshark, and Proton remain the direct VPN rivals.

Briedis said the moat is trust, and that it is what separates a paid provider from the crowd of free ones.

"There are free VPNs, a lot of free VPNs," he said, questioning how they keep their infrastructure running: "maybe they are doing something with the data, we don't know."

His own answer is an annual audit: "We do no logs audits every year. We started as the first VPN in the industry to do that."

The regulatory risk investors should track

Selling privacy carries a political cost. Briedis said Nord has walked out of whole markets rather than store user data.

"Some people want to get the data from that to have the access," he said. "We're not gonna operate in that country in general; we just remove our servers from there."

India is the clearest case: its 2022 CERT-In rules told VPN providers to keep customer data for up to five years, and NordVPN, ExpressVPN, Surfshark, Proton and Hide.me all pulled their Indian servers rather than comply.

For a business whose promise is that it holds nothing, a data-retention law is less a cost than an eviction notice.

Not everyone frames privacy the way Briedis does. Kabra draws a hard line between privacy and anonymity:

"I always think of privacy and anonymity as completely different things," he said, arguing an account can carry a verified human linkage while zero-knowledge proofs keep the identity hidden.

That is the opposite instinct to a no-logs VPN built to know nothing at all.

What it means for investors

For investors, it is a demand shift: AI is cutting attack costs faster than users raise their guard, and the money is moving from plain VPNs toward bundled identity, scam, and dark-web protection.

Briedis frames it as a fight with no finish line: whatever the defence, the attackers evolve too, he said, calling it a "never-ending battle."

His bottom line is that the software is only half of it. "It's again about education ... how you behave," he said.

"Usually all those schemes is about the urgency, trying to push you into some action that you shouldn't do in a normal behavior of your own."