07 Trust in Communications, Paper 6: Why a Relationship Cannot Be Faked at Scale
Why a Relationship Cannot Be Faked at Scale
Bidirectionality, Economics, and the Limits of Impersonation
TRUST IN COMMUNICATIONS · PAPER 6 OF 7 · ICA AI, Inc. · +Trusted Infrastructure · July 2026
A +Trusted Infrastructure series from ICA AI
Series editor: John Perkins, Chief Executive Officer
A fair critic will ask the obvious question: if trust rests on a relationship, can an attacker not simply fake the relationship? This paper takes that objection seriously. A single relationship can be mimicked, for a time, by a determined attacker — this paper does not claim otherwise. The defensible claim is narrower: a relationship cannot be faked at the scale that makes fraud profitable. The load bearing reason is structural — bidirectionality, the fact that the record lives on both sides and across many independent counterparties — and it is the reason that holds even as AI drives the cost of imitation toward zero. Scale-economics reinforces it but is not, by itself, the barrier. The barrier is structural and belongs to the relationship itself — it holds wherever two parties have a history, whoever is keeping the record, and whether or not anyone builds a layer to read it.
Two questions, not one — and only scale matters
The objection collapses two different questions that need to be kept apart, and most of the confusion about relationship-based trust lives in the gap between them. Can a relationship be faked? Yes — with enough effort against a single target, an attacker can study a pattern and mimic it for a while. Can a relationship be faked at scale? That is the question that matters, because fraud is a volume business. An attack that works once but does not repeat is not a fraud operation; it is a stunt. Fraud pays because it is cheap per attempt and runs across millions of attempts, so the only forgery that threatens a trust system is one that scales. This paper concedes the first question without reservation and contests the second, and the whole argument is about why the answer to the second is no.
The distinction tracks how the two sides actually operate. A defender — the party fraud is aimed at — does not need every individual relationship to be unforgeable. They need forgery to be a losing business at the scale that makes fraud profitable. An attacker, conversely, does not win by faking a single relationship; they win only if the forgery repeats cheaply across a large population of targets. So the whole contest comes down to scale, and a claim about a single relationship — forgeable or not — settles nothing. The right question is whether the property that resists forgery holds up when the attacker tries to run it a million times, and that is a question about structure, not about any one relationship’s defenses.
A ladder of forgeries
Impersonation is a ladder: each rung is harder than the last by a different kind of difficulty. The first rung is forging the number — spoofing caller ID — which is cheap and thoroughly solved for the attacker; this is the problem the identity era was built to address. The second rung is forging one side of a relationship — studying how a trusted party behaves and reproducing its texture: the right hour, the right references, the right rhythm. This is harder, and AI is making it cheaper, which is precisely the critic’s strongest point. But there is a third rung, and it is a different problem, not a harder one: faking both sides of the relationship, consistently, across every counterparty that holds its own memory of the dealings. The first two rungs are effort problems, and effort is exactly what better tools reduce. The third is not an effort problem at all, and that difference is the subject of this paper.
Bidirectionality: a relationship lives on both sides
The third rung is hard because a relationship is not a credential the caller carries; it is a record both parties hold, and the two records have to agree. An attacker impersonating a trusted party can control their own side of the story completely — but not the counterparty’s. To fake the relationship convincingly, they would need to write themselves into the other party’s record too, and then into the records of everyone that party deals with, because those cross-references are designed to form part of what the pattern is checked against.
Picture a business with five hundred established relationships, or a person with fifty. That identity is not a badge either one carries; it is scattered across all of those separately held records — five hundred or fifty, the number does not matter — each maintained by a different counterparty, each reflecting a slightly different history. An attacker forging that business or that person controls none of those records. Each one is another independent account the forgery has to survive — records the attacker does not see, does not have practical access to, and does not control. Forging one side is imitation; forging both sides, across a web of counterparties, is a different and far harder problem, because the evidence does not live in one place where a single forgery can reach it. Better tools cannot grind this barrier down: it is a matter of where the records live, and they live in hands the attacker will never hold.
The record the attacker cannot reach
Why are the counterparties’ records out of reach? Not because they are encrypted or well-defended, though they may be. It is that they are held by other parties entirely, maintained independently, and updated by those parties’ own real interactions. When a business genuinely calls one of its five hundred counterparties, that counterparty’s record updates from its own side — its own observation of the interaction, on its own system. The attacker impersonating the business has no way to produce that update, because producing it would require being the counterparty, not the business. This is the difference between forging a document and forging a fact that many independent witnesses separately recorded. You can forge the document you hold; you cannot reach into five hundred other parties’ memories and revise what each of them independently saw. A relationship, distributed across the records of everyone who participates in it, is closer to the second than the first — which is why controlling your own side, however perfectly, does not forge the whole. And those records are not isolated from one another: each is shaped by its keeper’s own dealings with parties the forger never touched, so what a forgery has to match is not a set of separate targets to be taken one at a time, but a shape produced by behavior the attacker has no part in.
The spoofed-context attack, taken seriously
The strongest form of the objection is the spoofed-context attack: the attacker does not just spoof the number but mimics the context — calls at the usual hour, references the expected account, matches the rhythm of a real relationship. Even done well, the mimicry is built from the outside. Reconnaissance harvests what the relationship has shown — the hours, the references, the rhythm. A forgery assembled from the visible surface is thinner than the relationship it imitates, and that is part of why it works only for a time. This is a real attack, and against a single target with enough reconnaissance it can work for a time. But notice exactly what it costs. The attacker has to learn one relationship deeply enough to reproduce its texture, and having done so, has faked exactly one — and only its visible side, the side that faces the target. And none of that work can be reused. The next target is a different pattern, held by different counterparties, with a different history; it requires the same hand-built effort from scratch. The attack that succeeds is the attack that does not scale, and the attack that would scale is the one that cannot succeed, because it would require reaching records the attacker does not control.
It is worth being exact about what the relationship layer reads, because the spoofed-context attack is aimed at something it does not look at. The layer does not read content. It does not listen to the call, parse the message, or interpret what was said. What it reads is the shape of the exchange — who contacted whom, when, through which channel, in which direction, at what cadence, and whether the counterparty’s own record agrees. Metadata and math: structured signals, and the arithmetic over them. An attacker who perfectly reproduces the substance of a conversation has reproduced the one thing the layer never consults — and still has to reproduce a pattern that is held on both sides of a relationship they were never part of.
This is a security property and a privacy property at the same time. A layer that never reads content cannot leak content, and cannot be quietly repurposed to surveil it. The same thing that makes a relationship hard to forge — that it is shape, not content — is what keeps the substance of the conversation out of the record entirely.
Why it does not scale — including with AI
There is an easy version of this paper’s argument, and it goes like this: fraud pays because it is cheap and repeatable — send the same lure to a million numbers and profit on the fraction that respond. Faking a relationship is nothing like that. It is hand-built, one target at a time: expensive, slow, unrepeatable. So — the easy argument concludes — relationship forgery will never scale. All of that is true today. And all of it is fragile, and a sharp critic will say exactly why: it is an argument about human effort, and AI erodes human effort. The same evidence base this series draws on shows AI collapsing the cost of hand-built voice attacks, with deepfake fraud up more than thirteen-fold.
So the easy argument is not where the barrier actually lives, and it should not be asked to carry the case. The barrier is bidirectionality, and AI does not touch it. A model can generate a plausible pattern for one side of a relationship; it has no practical way to write the attacker into the independent records that hundreds of counterparties each hold and check against. AI sharpens the point rather than blunting it. A model can spin up a complete-looking web of relationships for nothing — but complete-looking to whom? The fraudster has no knowledge of the truth it is meant to match, and the records it will be checked against sit in other parties’ hands. Fabricate the web and it is free, and wrong in ways the attacker cannot see. Research the web instead — scrape the public trail, cross reference the connections — and the cost returns, and the harvest is still only the surface the relationship chose to show. Either way, the attacker works without an answer key.
Forging the number is cheap. Forging one side of the story is getting cheaper. Forging both sides, consistently, across every counterparty’s separately held record, is not an effort problem that better tools reduce — it is a structural requirement that cannot be met, because the evidence the attacker would need to control does not live anywhere the attacker can reach. That is why the claim is that a relationship cannot be faked at the scale that makes fraud profitable, not that it can never be faked. Economics tells you the attack does not pay against many targets; bidirectionality tells you it does not work against them, and the second is the claim AI cannot erode.
Designed to surface the mismatch, not to catch the attacker
The honest register for how this shows up in practice matters, because it is easy to slide from a structural argument into an operational promise the architecture does not make. The claim is not that the system catches every forgery or blocks it outright. It is that behavioral divergence from an established, bidirectional pattern is designed to surface as a mismatch or anomaly — a signal that gets weighed, not a verdict that gets pronounced. A patient, well-resourced attacker may narrow the divergence for a while against a single relationship, and against that one relationship they may succeed. What they cannot do economically, or structurally, is narrow it across the many relationships that fraud at scale requires, each held by different counterparties who each hold their own record. This paper establishes only why the structural property exists; how a system surfaces and weighs it is outside the scope of this paper. The barrier is bidirectionality. Fraud pays by repeating cheaply. This forgery starts from scratch every time, so it never gets cheap enough to become profitable at scale.
About this series
Trust in Communications is a seven-part white-paper series, with two companion volumes and a concluding epilogue, examining one question: whether verifying identity is enough to establish trust in voice communications. The list below is in reading order — the companions sit where they are best read, not at the end.
- What Trust Actually Is
◇ Companion — Voice Fraud: The Evidence - The Role of Caller Authentication in Establishing Trust
- The One Layer That Can Stand Alone
- The Permanent Coverage Gap
- Even If the Proposed FCC Rules Work Perfectly, Will They Be Enough?
◇ Companion — The Proposed FCC Rules - Why a Relationship Cannot Be Faked at Scale (this paper)
- The Compromised Account
◆ Epilogue — What Changed, What Remains True
Read the full series at ICATrusted.ai.
Drafted with AI assistance; all analysis, claims, and conclusions rest with the series editor.