Half More Than Nothing: Interpol's African AI Crime Statistic Fails Its Own Verification

The single most quoted number in African cybersecurity policy is now also the least verifiable. Interpol has reported that AI drives more than half of the continent's cybercrime. The statistic arrived through a media summary with no linked primary document, no operational definition, no sample size, no time window, and no country-level breakdown. A number that cannot be checked has already started shaping budgets. Security vendors will quote it in marketing slide decks. Governments will cite it in procurement justifications. Researchers will model from it. None of them will be able to inspect its foundation. I spent weeks reconstructing the FTX internal ledger from a leaked repository in 2022; the lesson of that exercise is permanent: an unverifiable number is not data, it is a placeholder. Placeholders do not belong in policy. The reporting chain has three links, and all three are weak. First, Interpol itself. The organization operates the African Joint Operational Centre against Cybercrime (AFJOC), a coordination mechanism that aggregates case reports from member-state police agencies. Those reports arrive as structured classifications, not as forensic artifacts. When an officer marks a file as “AI-driven,” that label enters a statistical record. No independent examiner confirms the attribution. The classification system's behavior becomes inseparable from the criminal ecosystem's behavior. Second, the media summary. The article that carried the claim into mainstream discussion is a vertical crypto-industry publication, not a primary source for law enforcement statistics. The author did not provide the original publication date, the report's official title, or any methodology section. The information chain broke at this exact node. Third, the audience. The public receives one sentence and fills the missing context with intuition. Intuition fills gaps with fear. In my experience auditing smart contracts and tracing on-chain flows, I have learned that the most dangerous information is not false information. It is information with invisible provenance. This statistic behaves like an algorithm with uninitialized variables. A forensic reader does not evaluate a claim by its authority alone. I evaluate by inputs, transformation, and output. The claimed output is “more than half of cybercrime.” The inputs are undefined. The following teardown applies the same discipline I would use on a bridge contract or a corporate balance sheet: isolate each assumption, test its load-bearing capacity, and identify the point where the structure fails. The first variable is the definition of “AI-driven.” What qualifies? Consider three candidate readings. Narrow: an autonomous system made a decision in the attack path, such as a reinforcement-learning model optimizing a scam's conversion rate. Medium: a generative model produced at least one component of an attack, such as phishing text, audio cloning, or a fake identity document. Broad: the perpetrator used any AI product at any point, including a general-purpose assistant to correct grammar in a ransom note. Each definition produces a different numerator. A broad definition becomes almost tautological in 2026, because AI tooling has diffused into every civilian digital activity. Interpol has not released its operational definition. Without it, “half” carries no stable meaning. When I reverse-engineered Groth16 in 2020, I learned that an algebraic system yields certainty only when every parameter is fixed. Definitions are parameters. In their absence, the result is not a measurement. It is institutional storytelling wearing a lab coat. The second variable is attribution. The label “AI-driven” is the product of a human decision made at a police station, often in a jurisdiction under political pressure to demonstrate effectiveness. Evidence may be thin. A victim reports a phishing message with suspiciously polished prose. An officer infers AI involvement. The inference becomes a category. This does not require deliberate fabrication; it requires only the cognitive bias of a field agent confronting technology they do not deeply understand. During my 2022 Tornado Cash study, I manually traced more than 500 transactions before I could articulate what “anonymity” meant in operational practice. The mapping consumed weeks. A frontline officer with a caseload of hundreds will not perform that depth of analysis before ticking a box. The dataset, therefore, reflects classification propensity as much as criminal reality. The two are confounded. No statistical correction can separate them retroactively. The third variable is the cost curve. The economic substrate behind Interpol's observation is the collapse in the marginal cost of generating attack content. Commercial inference endpoints now price at fractions of a cent per thousand tokens. Open-weight models run on consumer-grade hardware. Voice cloning converges with three seconds of source audio. The consequence is that scale, not sophistication, has become the decisive variable in cybercrime. A campaign that once required a staffed call center now runs overnight on a laptop in Kwara State. Generating ten thousand personalized phishing emails costs less than a single meal. That is not hypothetical; the tools are sold openly through APIs, bot marketplaces, and Telegram channels. For a defender, the equation has changed permanently. One operator can generate infinite variants, and the defender must classify them all. Variant generation outpaces signature-update cycles by orders of magnitude. The gap between a new attack pattern and its appearance in threat-intelligence feeds is measured in weeks. The attacker's iteration time is measured in seconds. The fourth variable is the terrain on which the damage lands. Africa's financial rails amplify the threat. Mobile money, most visibly M-Pesa, has pushed financial inclusion in Kenya to levels that many wealthier states fail to reach. The infrastructure is fast, final, and small in per-transaction value. Fraud does not need any single large event; it can be repeated thousands of times at volumes a human review team cannot inspect. AI-driven fraud is a volume game. Deepfakes allow attackers to impersonate family members, bank agents, or corporate signatories with terrifying efficiency. The local-language dimension compounds the asymmetry. General-purpose safety classifiers are undertrained on Swahili, Hausa, Amharic, and dozens of other widely used languages. Attacks in those languages evade automated filtering because the defender's models were absent from their training distribution. This is the same class of systematic failure I have documented in cross-chain bridge code: a vulnerable pattern repeats wherever there are no consequences for repeating it. The fifth variable is the laundering interface, and this is where my specialization becomes directly relevant. The stolen value from AI-driven mobile-money fraud does not remain in a single ledger. It moves. It converts into stablecoins, passes through exchange accounts, and exits through over-the-counter desks or informal money brokers. On-chain surveillance is acutely difficult when the fraud volume consists of low-value, high-frequency transactions, because the signal-to-noise ratio collapses. Every scam victim creates a trace; ten thousand victims create a fog. The FTX ledger taught me that buried discrepancies only become visible when you aggregate across sources. The same principle applies here. The missing billion in African fraud losses is not a single transaction. It is a distributed pattern obscured by the volume. Analysts who rely on a single report will miss the pattern. Analysts who reconcile mobile-money settlement data against stablecoin flows will find it. The sixth variable is industrialization. A rate above fifty percent indicates supply chains, not lone actors. The operational structure mirrors the established cybercrime-as-a-service model: tool developers who lease phishing kits, generative copywriting assistants, and deepfake generators; operators who orchestrate campaigns against chosen targets; and financial logistics specialists who convert stolen mobile-money value into untraceable stores. The upfront capital required to enter this market is now negligible. The unit economics work because the AI tool's marginal cost is less than the smallest transaction the operator steals. That is not an anomaly. That is a business model with a positive gross margin. Response frameworks that assume the attacker is an isolated hacker will underperform. The applicable logic is closer to counter-fraud economics than to conventional law enforcement. The seventh variable is the data governance vacuum on the defense side. An effective AI detection system requires labeled, current threat data from the exact context in which it deploys: African languages, local scam narratives, mobile-money abuse forms, and region-specific fraud scripts. These datasets exist, but they are bureaucratically siloed. Telecom logs, bank investigations, police case files, and fintech fraud reports do not interoperate. Without a trusted data-sharing framework, any imported detection model is trained on the wrong distribution. The result is a spam filter optimized for English, dropped into Nairobi. In my contract audits, the root issue was rarely a single malicious line of code. It was the system's inability to reconcile state across heterogeneous sources. The African cyber-defense architecture has the same flaw: state fragmentation. No cloud purchase order fixes it. A data governance treaty might. Now I will submit to the strongest objection. The statistic may be an artifact of classification, but its direction is almost certainly correct. The bulls who accept the claim are not being irrational, and here is why. First, the label's very existence is new. That African police forces now recognize and record “AI-driven” as a crime attribute indicates institutional awareness has crossed a threshold. Detection propensity, not just criminal propensity, drives the count. Adding surveillance cameras raises theft reports before it reduces theft. Interpreted correctly, a rising number can be a healthier signal than a stable one: better calibration, more capacity, more available evidence. Commentators who cite the number as proof of accelerating crime commit a categorical error, but they are correct that attention is overdue. Second, the official number is almost certainly an undercount of the true burden. Reported crime is a fraction of actual crime in African informal economies. Victims of small-amount mobile-money fraud rarely file complaints because the effort of reporting exceeds the value lost. Deepfake extortion carries stigma; victims do not report it. The credible lower-bound interpretation of Interpol's finding is that a material share of every attack arc in the region now engages a generative AI step at some point. Even if “half” is an overstatement, the true underlying rate is well above zero and climbing. The absence of reliable casualty data is itself a finding. I have learned to treat missing information as data. Third, the insecurity will produce the defensive market it predicts. Strategic readers and security investors should separate themselves from the crowd at this point. The demand for localized, AI-capable defense is real and driven by unavoidable developments: financial inclusion, digital identity programs, central-bank digital currency pilots, and regional trade integration. Each expands the attack surface. International security vendors cannot easily localize pricing, models, or languages. Domestic African security startups, built by engineers who speak the languages and understand the payment rails, hold a structural advantage. The Interpol statistic, regardless of its methodological flaws, will serve as the opening argument in procurement cycles across the continent. The firms that win those contracts will be the ones that already understood the data governance vacuum. This is not scandal. It is how markets respond to a recognized threat. Fourth, the regulatory tailwind is already visible. The African Union's Malabo Convention on Cyber Security and Personal Data Protection has accumulated ratifications. National data protection laws in Kenya, Nigeria, and South Africa are being operationalized. These legal instruments will be interpreted through the lens of AI-enabled crime, and “AI-driven” classifications will feed directly into sentencing, insurance underwriting, and corporate compliance obligations. The legal risk of handling a criminal classification without methodological clarity is severe. A defense attorney who understands statistics will challenge cases built on an undefined label. Courts will demand the operational definition Interpol has not yet published. When they do, the number's authority will either be vindicated or dissolved. A statistic without a methodology is not knowledge; it is a hypothesis in uniform. The responsible analytical stance is to track the Interpol finding as a signal under review, demanding release of its operational definition, its source sample, and its classification standards before it enters any deterministic decision model. Regulation will run ahead of verification. Budgets will move first. Proof exists; it is merely waiting to be verified. The algorithm remembers what the witness forgets, and the ledger records classification decisions as if they were facts. Ledgers balance, but ethics remain uncalculated. The question that matters is not whether half of African cybercrime is AI-driven. It is whether the institutions publishing that number can survive the audit they publicly invite. I intend to be there when the dataset arrives. Until that day, the only defensible conclusion is that African law enforcement has decided to measure AI-enabled crime. That decision itself changes the record. What the new ledger contains will shape procurement, legislation, and the digital trust layer of an entire continent. The statistic is an opening bid, not a closing finding. Treat it as such. I will close with a forward-looking observation. The next twelve months will reveal which analysts are working with primary sources and which are working with press releases. The gap between those two groups will become the most valuable information asymmetry in the cybersecurity investment landscape. Verify. Then calculate. — Isabella Jackson, independent investigative journalist, Shenzhen. Filed under forensic analysis, not prediction.