The verification trap: what 8 months of due diligence taught us about modern attackers

If an employee follows every rule in your security policy and still authorises a fraudulent payment, where did the system fail?

At HuFiCon 2025 (now the Signal Security Summit), Pernilla Sjöholm spoke from direct experience. Known globally from the Netflix documentary The Tinder Swindler, she walked our audience through eight months of doing her own due diligence. Targeted by a fraudster posing as a wealthy executive, she did everything by the book. She checked his passport, verified his digital footprint, and met his associates across Europe. Every single check came back clean, yet she still lost over €50,000. 

That day, Pernilla showed everyone what happens when an adversary plays the long game—and if months of extreme caution cannot stop sophisticated, multichannel and multi-chain social engineering, an annual compliance training module stands no chance.

The conversation it started set up this year’s focus, giving Geoff White and Glenn Wilkinson the floor for two headline sessions at the upcoming Signal Security Summit 2026. Investigative author Geoff White breaks down the business models and supply chains behind modern fraud syndicates, showing how organised crime runs like any other disciplined enterprise. Alongside him, ethical hacker Glenn Wilkinson demonstrates how attackers use ordinary workplace habits to slip past hardened technical defences.

When attacks don’t look like attacks

Most security training still treats attacks like a spot-the-difference puzzle, telling staff to look for bad spelling and odd domains.

Pernilla’s experience exposed the flaw in that mindset. Her attacker gave her no early reason for suspicion. Instead, he spent months establishing mutual connections and real trust before asking for money, using broken sleep and manufactured panic to wear down her judgment.

When organisations assume attacks are obvious, falling for one carries immediate stigma. But if employees fear looking foolish or facing disciplinary action, they keep quiet—giving an intruder days of uninterrupted runway. 

The fastest way to catch a threat will always be a team that feels entirely safe admitting when something went wrong.

Deconstructing the business models funding modern cybercrime with Geoff White 

At HuFiCon last year, Pernilla showed just how commercialised these attacks have become. In one Eastern European fraud operation, just 11 people ran a €3 million digital advertising budget in a single year to bring in targets.

At Signal Security Summit 2026, Geoff examines that scale in his session, Inside the criminal economy: How technology is reinventing organised crime.

Drawing on 20 years of reporting, Geoff documents how criminal syndicates operate like commercial technology firms. Independent brokerages sell initial access. Dedicated units use generative tools to craft hyper-personalised pretexts. External laundering networks move capital through international financial rails. They track campaigns through customer acquisition costs, conversion rates, and return on investment.

You are competing against adversaries with product roadmaps, hiring pipelines, and dedicated budgets. Geoff White shows you exactly where these syndicates invest their capital, giving you the commercial intelligence to anticipate their moves and make your organisation a harder, less rewarding target.

Hear Geoff White live and see the criminal balance sheet for yourself. Join us in Cologne on 18 November.

Navigating the subconscious habits that undermine your technical defences with Glenn Wilkinson

In his keynote, What attackers understand about behaviour—and what defenders can learn from it, ethical hacker Glenn Wilkinson shows why adversaries don’t need zero-days when everyday office habits offer an easier way in.

When security controls slow people down, employees inevitably build workarounds to hit deadlines. Attackers study those exact shortcuts, designing requests that reward speed and punish hesitation.

Drawing on decades of red-teaming, Glenn shows security leaders how to build defences that work with human behaviour rather than fighting it:

• Safer defaults: System settings that protect users automatically when workloads spike.
• Native verification: Quick confirmation steps built directly into the tools teams already use.
• Operational safety nets: Controls that absorb human error without grinding business to a halt, and more. 

Build a stronger security culture at the Signal Security Summit 2026

Following an exciting debut in Paris earlier this year, our flagship summit comes to Cologne on 18 November 2026. bringing together over 2,000 security leaders under a shared commitment: becoming resilient, together.

With security incidents demanding constant attention, it is easy to feel isolated and constantly on the back foot. Understanding how these attackers actually operate changes that dynamic, giving leaders the clarity to anticipate threats, look beyond isolated incidents, and start outmanoeuvring the adversary.

For all the frontline intelligence on stage, the Signal Security Summit is ultimately shaped by who sits beside you. As one attendee put it last year, it is “a big get-together in a safe and welcoming place”—a rare opportunity to drop the corporate guard, talk honestly about what is failing in traditional programmes, and trade solutions with peers carrying the same responsibilities.

We would love to welcome you to the conversation in Cologne.

PS: If you can’t join us in Cologne on 18 November, you can still follow the discussions and hear directly from the experts on stage. The Signal Security Summit 2026 will also be available via livestream.

Join the livestream