The evolving threat landscape

The threats covered in this model have changed quickly in the last two to three years, and not in a comforting direction. The tools are cheaper, faster, and more accessible. The harm they enable is harder to detect, harder to prove, and harder to escape.

AI-enabled abuse

Voice cloning from a few seconds of audio (a voicemail, a WhatsApp voice note, a TikTok) is now widely available. Realistic fake images and videos can be produced without technical skill. Synthetic identities can be built to interact over time.

The effect is that evidence becomes deniable and harassment can be scaled without direct contact. A friend, an employer, or a court may be shown something that looks convincing and is entirely fabricated. Abuse shifts from “I say this about you” to “here is apparent proof you did it”.

The law has begun to catch up. The EU’s 2024 Directive on violence against women criminalises the non-consensual sharing of intimate images and requires member states to criminalise sexual deepfakes by 2027. That does not undo the harm, but it changes what a survivor can point to.

Spyware and tracking abuse

Commercial stalkerware has become easier to install and harder to detect. “Legitimate” tools are routinely abused: parental control apps, family sharing features, mobile device management profiles designed for workplaces. Bluetooth trackers are used for physical surveillance.

The result is surveillance that is persistent rather than episodic. Survivors often begin to doubt their own perception because they cannot explain how the abuser knows what they know. The tracking is invisible by design.

This is also where the ground has recently shifted a little in the survivor’s favour. Since 2024, iPhones and Android phones share an unwanted-tracker detection standard that can warn when an unknown Bluetooth tracker is travelling with you, whichever phone you carry. It reaches trackers built to the standard, such as AirTags and the brands that have signed up; a cheap generic tag, or a Tile switched to its Anti-Theft Mode, can still ride along unannounced, so it is worth pairing the alerts with a physical check. Stalkerware, too, is increasingly flagged by ordinary antivirus, including the security vendors that make up the Coalition Against Stalkerware. It is not always invisible, and checking a device is possible.

Account takeover via the identity ecosystem

Most account takeover in this context does not involve hacking. It involves exploiting what already exists: shared accounts, reused passwords, recovery mechanisms set up during the relationship. Control the email address and you can reset almost everything else. Control the phone number and you can intercept verification codes.

The critical insight is that digital entanglement often survives physical separation. A survivor can leave a home and remain digitally accessible in ways they may not be aware of.

Platform-enabled harassment

Coordinated harassment using multiple accounts, semi-automated messaging, and the abuse of platform reporting systems has become easier to sustain. Abusers can use reporting features to get a survivor’s accounts suspended, content taken down, or profiles flagged. Algorithmic amplification can spread content further than any individual could manage alone.

One person can operate like a coordinated campaign. Platforms respond inconsistently, and attribution is difficult.

Data exposure and doxxing

Building a profile from public sources has become trivial. Leaked databases, people-search aggregator sites, and social media correlation allow an abuser to assemble a target’s current address, workplace, contacts, and routine with modest effort. The threat expands beyond the individual: friends, colleagues, and family members can become leverage or secondary targets.

Smart home and IoT coercion

Shared or previously shared accounts may retain control over locks, cameras, thermostats, and lights long after a relationship ends. This creates an environment of unpredictability: things that happen in a home without explanation, things that are difficult to describe to someone who has not experienced it. The digital and the physical become indistinguishable.

This is documented rather than anecdotal: researchers assessing consumer smart-home devices for abusability have found that locks, cameras, thermostats and speakers can each be turned to monitoring, lockout or intimidation by whoever holds the administrator account. Isolating these devices on a separate network limits what they can reach, though a retained administrator account is best removed outright.

Financial control via digital systems

Abuse through banking apps, shared subscriptions, and hidden debts is increasingly common. Buy-now-pay-later systems can be used to create debt in another person’s name. Cryptocurrency transfers can obscure financial manipulation. The goal is not always theft; it is often dependency and the removal of options.

Selectively captured screenshots, edited chat logs, and AI-generated audio or images can be used as “evidence” in legal proceedings, custody disputes, and reports to employers or social services. Flooding systems with contradictory documentation is itself a tactic: it wastes time, money, and credibility.

Survivors may face the challenge of proving that something did not happen, or that evidence is fabricated, in systems that have not yet developed reliable ways to assess this.

Cross-platform persistence

Abuse is not contained to one platform or channel. When contact is blocked on one surface, it moves to another: messaging to email, email to social media, social media to workplace tools or mutual contacts. Identity follows the survivor. Safety requires thinking about the whole ecosystem.

What has fundamentally changed

Across all of these, three underlying shifts explain why the landscape feels different now.

Scale: one person can operate like a system. The effort required to sustain harassment, surveillance, or manipulation has fallen dramatically.

Plausibility: fake content is now believable enough to cause real harm in the real world. Courts, employers, and friends are not yet equipped to assess it reliably.

Persistence: access and influence can survive separation. A survivor who has left physically may remain entangled digitally in ways that are not immediately visible.

No single fix

Traditional advice, “block them, change your password, get a new number”, is no longer sufficient on its own. Safety now requires systemic thinking: across devices, accounts, and services; across the people connected to you; and across the places where your identity and data exist.

Last reviewed: 2026-07-16.