Can I rent out my Golden Visa Property in Greece? Rules, limits and what investors get wrong
You bought a property in Athens. You have your Golden Visa. And now you’re wondering: can I rent this out while I’m not here? It’s one of the most common questions investors ask and one of the most misunderstood. The short answer is yes, you can rent out your Golden Visa property. But the rules have changed significantly since 2024, and getting them wrong carries a penalty that goes beyond a fine. It can cost you your residence permit. Here’s what you need to know. The rule that changed everything: no short-term rentals Before 2024, many investors bought Golden Visa properties with one eye on Airbnb. Athens was booming as a tourist destination, short-term yields were strong, and the numbers looked attractive on paper. That model is now off the table. Article 64 of Law 5100/2024 explicitly prohibits short-term letting of Golden Visa properties. This covers Airbnb, Booking.com, and any other platform or arrangement that falls within Greece’s statutory short-term rental framework — broadly, stays under 60 days. The penalty for violations is not a warning. It’s a €50,000 administrative fine and revocation of your residence permit. Both consequences at once. This is the rule that catches most investors off guard, especially those who did their research before 2024 and are working from outdated information. If your plan was built around short-term rental income, you need to rebuild it around a different model. Long-term rentals: fully permitted, and actually working Long-term letting — leases of 12 months or longer — remains fully legal for Golden Visa properties. And in practice, the Athens long-term rental market has absorbed the shift better than many expected. Of roughly 16,000 properties that non-EU nationals had acquired under the Golden Visa program by the end of 2024, nearly 15,000 moved into the long-term rental market. That’s not a slow transition — that’s almost the entire stock redirecting almost immediately. Why did it work? Because Athens has genuine long-term rental demand. Young professionals, international companies relocating staff, diplomatic personnel, students at international universities — the city has a large pool of tenants who want a quality apartment for a year or more. Supply in that segment was undersupplied before the short-term rental ban redirected so much inventory toward it. Long-term rental yields in Athens currently sit between 4% and 6% annually for well-located properties. That’s below the headline figures some investors were projecting with short-term letting, but it’s a stable, predictable return on a qualified asset — one that also serves as your EU residency qualifier. What counts as short-term and what doesn’t The legal definition matters here, and it’s more specific than you might think. In Greece, a stay of 60 days or longer is legally classified as a long-term lease. It falls under standard Greek lease law, requires no Airbnb-style registration, and sits outside the short-term rental regulatory regime entirely. So if you rent your property to someone for three months, six months, or twelve months, that’s a long-term lease — fully permitted, no issues. What’s banned is the sharing-economy model: nightly and weekly bookings through platforms, rolling short stays, the Airbnb playbook. That’s what Law 5100/2024 targets, and that’s what carries the €50,000 fine. There’s a separate layer worth knowing: since January 2025, new short-term rental registrations have been suspended in the three central districts of Athens. This applies to all properties, not just Golden Visa ones. It’s part of Greece’s broader response to the housing affordability pressure that short-term rentals created in the city center. Even if the Golden Visa restriction didn’t exist, you couldn’t register a new Airbnb-style listing in central Athens right now anyway. What about subleasing? The same law that bans short-term letting also prohibits subleasing of Golden Visa properties. You cannot rent to a tenant and have that tenant sublet to a third party. The property must be used by the tenant who signed the lease. This is a less common issue in practice, but it’s worth being aware of if you’re structuring a rental arrangement with a corporate tenant or an intermediary property manager. Any arrangement that creates a chain of occupancy between you and the actual resident falls outside what the law permits. The new Golden Visa category to watch In August 2026, the Greek government published its National Housing Strategy, which includes a proposed new Golden Visa category specifically linked to long-term rentals. Under this proposal, investors would be able to qualify for a Golden Visa through a portfolio of properties, not just a single property provided those properties are committed exclusively to long-term residential letting and kept off short-term rental platforms entirely. This is still at the legislative proposal stage as of October 2026 and has not been enacted. But it signals something important: the Greek government is actively designing the Golden Visa program around long-term rental use. If you’re investing now, you’re investing into the model the government is explicitly building toward. Three mistakes investors make The investors who run into problems tend to make one of three errors. The first is assuming old advice is still current. A lot of information circulating about Golden Visa rental rules predates the 2024 legislation. If someone told you before 2024 that you could use Airbnb for your Golden Visa property, that advice is no longer accurate. The second is confusing Golden Visa restrictions with general Greek property rules. The short-term rental ban applies specifically to properties acquired under the Golden Visa thresholds defined in Law 5100/2024. If you own a separate property in Greece purchased outside the Golden Visa framework, different rules may apply to that property. Don’t conflate the two. The third is choosing a property without thinking about long-term rental demand. Some investors buy purely to meet the investment threshold, without considering whether the property has a real tenant market. A property in a neighborhood with low long-term rental demand doesn’t become easier to let just because the short-term option is closed. Location and tenant profile matter as much in a long-term
Quishing Turns a Simple QR Code Into an Operational Risk
A QR code may be one of the smallest pieces of technology used in modern business operations, but the processes connected to it can be surprisingly important. Companies use QR codes for payments, employee access, event registration, visitor information, equipment management and customer services. They offer a convenient way to connect a physical object, printed document or workplace interaction with a digital system. That convenience also creates opportunities for deception. Quishing, or QR code phishing, involves using malicious QR codes to direct people toward fraudulent websites, credential-harvesting pages or other harmful interactions. What makes the threat particularly relevant to businesses is that a seemingly ordinary scan can move an employee or customer outside an organisation’s expected security controls. The business risk is therefore broader than someone opening a suspicious website. Depending on the circumstances, a compromised QR interaction can affect account security, payments, customer confidence and the continuity of everyday operations. The larger question is no longer simply whether employees know how to recognise phishing emails. It is whether businesses understand the risks created when ordinary operational processes begin depending on scannable links. Quishing brings phishing into a different environment Phishing is not a new problem for businesses. Organisations have spent years investing in email filtering, suspicious-link detection, employee training and authentication controls to reduce the likelihood of successful attacks. Quishing changes how that familiar threat reaches the user. Instead of placing an ordinary hyperlink inside a message, an attacker can embed a malicious destination in a QR code. The recipient scans the image with a smartphone and may be directed toward a website imitating a legitimate business application, payment service or authentication page. The UK’s National Cyber Security Centre has highlighted three reasons this approach can be attractive to criminals: QR codes obscure the destination, some email security tools do not examine QR images as thoroughly as ordinary links, and users may switch from a protected workplace computer to a personal smartphone. That final point is especially important for organisations. A phishing message may arrive inside a managed corporate environment, but the next interaction can happen on a device the company’s security team cannot fully monitor. The attack begins inside one security boundary and continues outside it. The move from work computer to personal phone creates a security gap Many organisations have reasonably mature security controls on company laptops. They may use endpoint detection, managed browsers, restricted downloads, network filtering and centralised monitoring. Employees may also access business applications through identity systems that record unusual login behaviour. A personal smartphone does not necessarily have the same protections. When a QR code displayed on a corporate computer is scanned with an unmanaged phone, the suspicious destination may open through a different browser, operating environment and security configuration. In January 2026, the FBI specifically warned about this technique, describing QR-based spearphishing campaigns that attempted to move targets from corporate endpoints to mobile devices before presenting fraudulent login pages. This does not mean personal smartphones are inherently insecure or that every QR scan bypasses enterprise protection. It means the organisation may have less visibility over an interaction that can still affect its corporate accounts and systems. That is an operational problem because the consequences can return to the business even when the initial interaction happens on a device it does not own. The real target may be a corporate identity Many quishing attacks are designed to obtain credentials rather than damage the phone itself. An employee might receive a message claiming that access to a company document requires verification. Instead of providing a familiar login link, the message presents a QR code that appears to lead to the organisation’s authentication service. After scanning, the employee reaches a convincing imitation of a familiar sign-in page and enters their credentials. The attack can then move from deception to unauthorised account access. The FBI’s January 2026 advisory described targeted campaigns associated with North Korean Kimsuky actors, including QR codes that directed recipients toward counterfeit authentication pages. The agency also warned that some operations may involve session-token theft, potentially allowing attackers to compromise cloud identities even when conventional multi-factor authentication is present. The significance for businesses is substantial. The initial incident may look like a single employee interacting with a suspicious code, but the resulting exposure can involve email accounts, cloud services, stored information or other systems accessible through that identity. The QR code is only the entry point. The business account behind it may be the actual target. The threat is not limited to ordinary phishing emails Quishing can also appear through documents and attachments that employees might otherwise consider routine. A PDF containing a registration form, event invitation or administrative notice can include a QR code that encourages the recipient to continue the process on a phone. That is relevant because businesses routinely exchange documents with suppliers, customers, contractors and external organisations. The ENISA Threat Landscape 2025 documented QR-based phishing activity associated with the Scanception campaign. Malicious QR codes embedded in PDF attachments were used to direct recipients toward credential-harvesting pages hosted through trusted cloud environments, with targets including users in the EU. This illustrates how malicious interactions can be wrapped inside familiar document workflows. The employee may believe they are opening a registration form, accessing a shared file or completing an administrative request. The underlying process, however, can redirect them into an attacker-controlled authentication flow. For businesses, the risk becomes harder to manage when employees encounter QR codes across email, PDFs, physical documents and external communication channels. A printed QR code can become a physical attack surface Not every relevant scenario begins on a screen. Businesses increasingly use QR codes in physical environments, including reception desks, customer service counters, parking areas, internal signage and payment points. In these settings, the QR code becomes a physical object that connects people to a digital destination. A criminal who can replace or cover a legitimate code may be able to change that destination without modifying the underlying website or information system. In September 2026, the
The New Identity Layer: How Europe Is Rebuilding Digital Verification
The EU Digital Identity Wallet may eventually look simple from the user’s side: open an app, select a credential and approve what you want to share. Making that interaction work across 27 Member States is anything but simple. Behind the wallet sits an emerging digital identity infrastructure connecting governments, wallet providers, credential issuers, universities, banks, transport companies, public authorities and thousands of organisations that may eventually need to verify information presented by a user. The challenge is not merely to digitise an identity card. Europe is attempting to create a common trust layer in which different organisations can issue and verify digital credentials without every service having to build its own isolated identity system. That makes the EU Digital Identity Wallet as much an infrastructure project as a consumer product. A wallet only works if an ecosystem trusts what is inside it A physical credential works because institutions recognise the authority behind it. A university diploma is useful because a recognised institution issued it. A driving licence matters because an authorised public authority stands behind it. An identity document works because the receiving party trusts the issuing state. Digital credentials need the same chain of confidence. Under the European Digital Identity Framework, users can hold person-identification data and electronic attestations of attributes inside a wallet, while relying parties can request and validate them. The regulation establishes common mechanisms for issuance, presentation, verification and authentication across that ecosystem. The important business shift is therefore not that documents become files on a phone. It is that trust itself becomes machine-readable and interoperable. Europe is building a network of roles rather than one central platform There is no single organisation doing everything. Different actors perform different functions. A wallet provider supplies the wallet used by the individual. A Person Identification Data provider supplies trusted identity data. Public or private issuers can create digital credentials or attestations. A relying party is the organisation that requests information from the wallet in order to provide a service. Behind those actors sit certification bodies, trust-service providers, registries and technical infrastructure designed to establish who is authorised to perform each role. The EU’s 2026 interoperability testing already includes national wallet teams, PID providers, credential issuers, relying parties, certification bodies and standardisation organisations working against production-oriented implementations rather than simple prototypes. That is why describing the EUDI Wallet as simply “an identity app” misses most of the economic story. The app is only the visible endpoint of a much larger network. Issuers become a critical part of the new identity economy A wallet with nothing useful inside it has little value. The system therefore depends heavily on organisations willing and able to issue recognised digital credentials. That can include a public authority issuing a residence credential, a university issuing a diploma, a healthcare organisation providing an eligible credential or another trusted organisation issuing information that can later be verified by a third party. The Commission’s current EUDI guidance describes issuers as trusted public or private organisations capable of issuing identity information or digital documents directly into wallets. Those credentials must follow common schemas, formats and proof mechanisms so that other systems can understand and verify them. This creates an important infrastructure dependency. Europe can mandate wallet availability. But wallet usefulness depends on the supply of credentials around it. Relying parties determine whether those credentials become useful The other half of the network is demand. A diploma inside a wallet matters only if an employer or university can accept it. An age credential matters only if a service can request and validate it. A digital identity becomes useful only where businesses and public organisations can actually rely on it. The EU is therefore paying increasing attention to relying-party adoption. In September 2026, the Commission’s EUDI programme described relying parties as central to turning the wallet into real-world services and launched engagement work around sectors including travel, hospitality, education and public services. This creates a classic platform challenge. Users have little reason to adopt a wallet that few organisations accept. Organisations have less incentive to integrate a wallet that few customers use. The ecosystem needs both sides to grow together. The real network effect sits between credentials and acceptance This is where digital identity begins to resemble other platform markets. More issuers create more useful credentials. More useful credentials make wallets more valuable. More wallet users give relying parties greater incentive to integrate. More relying parties give citizens more reasons to use the wallet. The Commission itself describes this reinforcing relationship in its 2026 relying-party programme: more usable services can drive adoption, which can encourage more credentials and further ecosystem growth. The strongest version of the EUDI ecosystem therefore does not emerge simply because every Member State releases an app. It emerges when credential supply and service acceptance reinforce one another. Trust lists are becoming part of the infrastructure When two organisations have never interacted before, how does one know that the other can be trusted? That is one of the central technical and governance problems the European framework is trying to solve. The EUDI ecosystem uses trusted entities and certification mechanisms so participants can verify roles such as wallet providers, Person Identification Data providers and other authorised actors. During the 2026 Launchpad testing programme, the EU’s eIDAS Dashboard and Lists of Trusted Entities are being tested as a central mechanism for establishing trust between participants. The lists being tested include categories for wallet providers, PID providers, mobile-driving-licence providers and providers of certificates used by wallet-relying parties. This sounds highly technical, but the economic purpose is straightforward. A cross-border digital market cannot scale efficiently if every company must manually establish trust with every issuer and every wallet provider individually. Shared trust infrastructure reduces that coordination problem. Certification turns technical compatibility into an economic requirement Interoperability is only useful if implementations actually conform to the rules. The regulation therefore requires certification of EU Digital Identity Wallets against defined security and technical requirements, with conformity assessment carried out through nationally designated bodies.
Content Provenance Is Becoming Business Infrastructure
For a small creative team, knowing where an image came from is usually straightforward. Someone took the photograph, another person edited it and the final version was uploaded to a campaign folder. At enterprise scale, that simplicity disappears. A single organisation may produce thousands of assets across internal teams, agencies, freelancers, markets and platforms. The same image can be resized, localised, edited with generative AI, reused in another campaign and exported through several different systems before reaching the customer. At that point, the question “Where did this file come from?” stops being only about authenticity. It becomes an operational question. That is why content provenance is beginning to look less like a niche media-verification feature and more like another layer of business infrastructure. The content supply chain is becoming harder to see Businesses already have content supply chains, even when they do not call them that. A campaign may begin with a brief, move to an agency, pass through photography or design, enter an approval process, receive local adaptations, move into a digital asset management system and eventually reach websites, advertising platforms and social networks. AI is increasing the number of possible steps. One source asset can now generate dozens or hundreds of variations. Backgrounds can change, copy can be localised, objects can be replaced and formats can be adapted for different audiences with much less manual production. Adobe describes enterprise content supply chains as increasingly pressured to produce more assets for more channels while maintaining brand consistency and governance. Its 2026 research also notes that generative AI is accelerating content production while organisations continue to face challenges around data readiness, governance and integrated workflows. More production therefore creates another problem: more history to keep track of. Provenance becomes useful before a customer ever sees the asset Much of the public discussion around Content Credentials focuses on the viewer. Can someone determine whether AI was used? Can they see where an image originated? Can they inspect its editing history? Those are important questions, and Athens Pulse recently approached the issue from exactly that consumer perspective in “Why Every Photo Online Is Starting to Need a History” Inside a business, however, the same information can have value long before the asset is published. Teams may need to know which application created a file, whether generative AI was involved, who issued the credential, what modifications occurred and whether the asset being used is actually the approved version. Adobe’s current Experience Manager implementation, for example, can expose information such as the credential date, the application or AI tool involved in changes and the entity that issued the credential. That turns provenance from a public-facing transparency feature into something that can also support internal asset management. The bigger problem is not creation. It is chain of custody Creating digital content has become dramatically easier. Keeping control of it has not. Imagine an international brand producing a campaign through an external agency. The original creative is approved, sent to regional teams, translated, resized, edited again and uploaded to several platforms. Three months later, someone finds another version in a shared folder. Which version is it? Was it approved? Was AI used to modify it? Is the person who created the original asset still correctly credited? Is it safe to publish in another market? Traditional filenames, folders and manual documentation can answer some of these questions, but they become increasingly fragile as content volumes rise. Content provenance introduces the possibility of carrying part of that history with the asset itself. A business may eventually need to know how an asset changed This becomes particularly important when a single “asset” no longer has a single production history. A photograph may begin as a camera capture, enter Photoshop, receive a generative modification, move into another system for localisation and finally become multiple advertising variants. C2PA is designed around the idea that producers and custodians can make verifiable assertions about the creation of an asset and actions taken after its creation. Importantly, the standard is intended to verify the association and integrity of those assertions rather than decide whether they are “good” or “bad”. For businesses, that distinction is useful. Provenance does not need to decide whether an edit was appropriate. It can simply provide more reliable information about what happened. Governance teams can then apply the organisation’s own rules. AI makes asset governance much more difficult Before generative AI, a company could already struggle with duplicate files, outdated campaign materials and inconsistent versions. AI adds another layer because content can now multiply extremely quickly. One approved image can become 20 regional variations, several product adaptations and dozens of social formats. Some may involve only resizing, while others may contain generative changes that meaningfully alter the asset. The traditional question “Is this the approved file?” therefore evolves into something more complicated: “Is this approved version derived from the approved source through an approved process?” That is a provenance problem. Modern digital asset management systems are already moving in this direction. Adobe Experience Manager, for example, combines governance features around asset status, rights and compliance with Content Credentials that can expose tamper-evident provenance information. Provenance can become part of approval workflows Businesses rarely publish important assets immediately after creation. They move through approvals. Legal teams may check claims. Brand teams review design. Regional teams confirm localisation. Compliance teams may need to verify that specific imagery or disclosures are appropriate. The more automated production becomes, the more important it becomes to preserve the relationship between the asset being reviewed and the asset eventually published. Otherwise, organisations risk approving one version and distributing another. Provenance does not replace approval software, DAM systems or workflow management. But it can add another layer by helping preserve information about the asset as it moves through those systems. This is especially relevant because the C2PA standard was explicitly designed to fit into existing workflows rather than require one specific hosting or asset-management architecture. The metadata itself can become a governance decision There is another operational issue:
The Replacement Cycle Problem: What Happens When Customers Upgrade Less Often
A company can have more customers, more active devices and stronger loyalty while still facing a difficult commercial problem: those customers may simply be buying less often. That is increasingly relevant in the smartphone market, where replacement cycles have moved close to four years. Devices remain capable for longer, software support has improved and higher prices give consumers another reason to postpone replacement. For Market Insiders, the interesting question is therefore not why people keep their phones longer, but what happens to a business model when the customer remains satisfied while the next hardware transaction moves further into the future. This is the replacement cycle problem. A satisfied customer can become a less frequent customer Most businesses naturally want customers to remain satisfied with their products. Smartphones create an unusual tension because greater satisfaction can also reduce the urgency to purchase again. If a device remains fast, secure and useful for four years instead of two, the customer relationship may be healthy while hardware purchase frequency falls sharply. That makes satisfaction and transaction frequency increasingly separate metrics. A customer who does not upgrade may not be disengaged. The product may simply be working too well to replace. Small changes in replacement timing can have large effects The difference between replacing a smartphone every two years and every four years sounds simple, but economically it is substantial. Over an eight-year relationship, a two-year cycle could theoretically generate four replacement events. A four-year cycle reduces that to two. Real customer behaviour is obviously more complex, but the principle illustrates why replacement timing matters so much for hardware businesses. Even modest extensions across millions of users can materially change annual unit demand. The installed base may remain large while the number of customers entering the market each year becomes smaller. The installed base and annual sales start telling different stories A growing installed base is usually positive because it represents more people using the company’s products. But installed base growth does not automatically translate into equivalent hardware growth. If devices remain active for longer, the number of products in use can rise even while annual replacement demand slows. Second-hand and refurbished devices can extend that divergence further by keeping hardware active after the original owner has moved on. Businesses therefore need to distinguish between how many customers are inside the ecosystem and how many are currently generating a hardware transaction. Those are increasingly different questions. Forecasting becomes harder Replacement-driven markets depend heavily on predicting when existing customers will return. When ownership cycles were relatively stable, historical replacement patterns offered a stronger basis for forecasting. Longer and more variable ownership makes that process harder. Battery health, repair decisions, device prices, software support, economic conditions, trade-in values and new product features can all influence when an individual customer finally replaces a phone. For manufacturers, retailers and carriers, a longer cycle therefore creates more uncertainty around when installed demand converts into actual sales. A delayed purchase is not always a lost purchase This distinction matters. When a consumer decides not to replace a three-year-old smartphone this year, the sale may not disappear permanently. It may simply move into next year. For forecasting purposes, however, that delay still matters. Revenue expected in one period moves into another, production assumptions can become less accurate and inventory planning becomes more difficult. Across millions of customers, repeated delays can reshape an entire annual sales cycle. The replacement cycle problem is therefore partly about timing revenue correctly, not simply about whether the revenue exists at all. Hardware businesses become more exposed to replacement waves Long ownership periods can also create more pronounced cohorts. Large groups of customers who purchased devices during the same strong product cycle may eventually approach replacement at similar times. Conversely, a weak upgrade generation can push that demand forward again. This creates the possibility of irregular replacement waves rather than a consistently predictable annual market. A company may therefore experience periods of strong demand followed by quieter years without necessarily gaining or losing the same proportion of customers. That can make short-term performance more difficult to interpret. Revenue growth becomes less connected to user growth In a rapidly expanding market, acquiring more users can naturally produce more device sales. In a mature market, the relationship becomes weaker. A company can increase its active user base through customer retention, second-hand devices and longer device lifespans without seeing equivalent growth in annual hardware shipments. That means management can no longer treat installed-base growth as a direct proxy for hardware revenue growth. The economic question becomes how much value each active user generates throughout the ownership period, not simply how many active devices exist. Recurring services become strategically more important This is where services enter the equation. If the customer purchases hardware less frequently, recurring revenue generated between those purchases becomes more valuable. Cloud storage, device protection, payments, subscriptions, content services, AI features and other ecosystem products can create commercial activity even when the smartphone itself remains unchanged. The hardware transaction becomes one part of a longer revenue relationship rather than the only meaningful moment. For companies with large installed bases, that can reduce dependence on replacement frequency. The installed base becomes an economic asset A large installed base therefore has value beyond future smartphone replacements. Every active device can represent a customer who may subscribe to a service, purchase accessories, use payments, buy another ecosystem product or eventually trade the device in for something newer. This changes the way businesses can think about hardware. The smartphone is not only a unit sold. It can also function as an entry point into years of additional transactions. That makes the quality and monetisation of the installed base increasingly important. Hardware margins and ecosystem margins become connected Longer ownership can also change where profit is generated. A company may earn less frequently from smartphone replacements but continue generating margin from services, accessories and adjacent devices. That makes ecosystem design more than a retention strategy. It becomes part of the revenue architecture.
The Authentication Cost: What Businesses Pay for Password-Based Identity
A password looks inexpensive. It is a string of characters, a login field and a database record. From that perspective, password-based authentication can appear to be one of the simplest pieces of digital infrastructure a business operates. The real cost appears later. Employees forget passwords. Customers lose access. Helpdesk teams handle resets. Security teams investigate compromised credentials. IT departments maintain recovery systems, multifactor authentication, access policies and legacy exceptions designed to compensate for weaknesses in the original authentication model. This is the authentication cost hidden behind password-based identity. For Market Insiders, the relevant question is therefore not whether passwords work. They clearly do, and businesses have relied on them for decades. The more important question is how much organisational complexity is required to keep them working safely at scale — and whether that cost still makes sense as passwordless alternatives mature. The Password Is Free Until Someone Forgets It The direct technical cost of creating a password credential is tiny. The operational cost of supporting that credential throughout its lifecycle is not. A user forgets the password and starts a reset. The reset email does not arrive, so they contact support. An employee changes devices and loses access to an authentication method. A customer enters the wrong credential repeatedly and locks the account. A compromised password triggers additional investigation. Each incident may appear minor in isolation, but at organisational scale they become repetitive operational work. The password therefore creates an unusual cost structure. It is cheap to issue, but potentially expensive to maintain. That makes the economics of authentication different from the economics of many other digital features. The business does not pay primarily when the password is created. It pays whenever the credential fails, is forgotten, is stolen or needs to be recovered. Password Resets Are an Operations Problem The familiar “Forgot password?” link hides an entire workflow. The system must verify identity, send recovery messages, manage tokens, expire reset links and prevent attackers from abusing the recovery mechanism. When automated recovery fails, the task moves to customer service or internal IT. In workforce environments, this can become particularly repetitive. FIDO Alliance’s 2026 workforce research found that among organisations already rolling out passkeys, 35% reported reductions in helpdesk tickets for password resets, while 45% reported faster employee login times. The survey covered 1,400 decision-makers in organisations with at least 500 employees across ten countries, so the figures should be read as evidence from that population rather than a universal business benchmark. The significance is not the precise percentage. It is that authentication design can change the workload of an IT organisation. A login method that fails less often does not merely improve UX. It removes tickets before they need to be handled. Helpdesk Cost Is Only the Visible Part Password-reset tickets are relatively easy to see because they appear in support systems. Other costs are less obvious. Employees lose productive time while waiting to regain access. Managers become involved when identity verification is unclear. Security teams create procedures for high-risk resets. Systems need audit logs and abuse protection. Customer-support agents require training around account recovery. The cost is distributed across departments, which makes it difficult to recognise as a single category. There is rarely a line in the financial statements called “password complexity.” Instead, the cost appears as slightly more support headcount, slightly longer onboarding, slightly more security engineering and slightly more downtime whenever access fails. That distribution is precisely why password-based identity can remain operationally expensive without looking expensive. The Business Pays When Credentials Are Stolen Too The cost of passwords is not limited to legitimate users forgetting them. Attackers can steal them. Verizon’s 2025 Data Breach Investigations Report found that stolen credentials were involved in about 88% of breaches classified as Basic Web Application Attacks, illustrating how central compromised credentials remain in that specific attack pattern. Verizon’s broader findings also continued to show strong overlap between social engineering and credential abuse. A compromised credential creates a completely different category of business cost. Incident response. Fraud investigation. Account restoration. Customer communication. Potential downtime. Security remediation. Regulatory or contractual consequences depending on the nature of the incident. The password is therefore unusual because the same mechanism creates both support cost when users cannot remember it and security risk when attackers manage to obtain it. Businesses Compensated by Building More Authentication Around the Password Most organisations did not respond to password weaknesses by removing passwords. They added more layers. SMS codes. Authenticator apps. Security questions. Backup codes. Risk-based verification. Device approvals. Recovery emails. These controls can substantially strengthen authentication, but they also expand the identity system that must be maintained. Now the organisation is not managing one credential. It is managing a credential ecosystem. The employee has a password plus an authenticator app. The customer has a password plus SMS recovery. Administrators may use stronger authentication again. Legacy applications may require different rules. Contractors may have separate access processes. Each additional layer solves a real security problem while simultaneously creating another operational process. Authentication Complexity Becomes Identity Complexity As organisations grow, identity management stops being simply a login issue. Employees join. Employees leave. Roles change. Contractors gain temporary access. Administrators receive privileged accounts. Customers change devices. Systems move to the cloud. Applications are added through acquisitions or departmental purchases. The organisation must continuously answer a fundamental question: Who should still have access to what? Recent FIDO Alliance and HID research illustrates how complicated this environment has become. In a 2026 survey of 500 IT and cybersecurity decision-makers across five countries, 59% of organisations reported managing three or more credential or authentication systems, while 58% said digital identity management had become more complex during the previous two years. Passwords are only one part of that complexity, but they often sit at the centre of it. Onboarding Creates Credentials — Offboarding Must Destroy Them Identity systems have a lifecycle. When an employee joins, the organisation creates accounts and permissions. When that employee changes position, access may need to change. When they
Feature Creep: When More Product Features Create More Cost Than Value
Adding a new feature can look like progress. It gives product teams something new to announce, sales teams another benefit to mention and customers one more reason to consider an upgrade. The problem begins when features accumulate faster than the value they create. This is feature creep: the gradual expansion of a product through new functions, options and exceptions until the product becomes harder to build, maintain, explain and support. What appears to be a small addition on the roadmap can create costs across development, testing, documentation, customer service and operations. For Market Insiders, feature creep is therefore not simply a product-design issue. It is a business question about where growth in functionality stops creating meaningful value and starts creating structural complexity. Feature Creep Rarely Starts With a Bad Idea Most unnecessary complexity does not begin with an obviously unnecessary feature. A customer asks for something. A competitor introduces a new capability. A sales team wants to remove an objection. A large client needs an exception. A product manager sees an opportunity to improve retention. Individually, each request can look reasonable. The problem appears when these additions are evaluated one by one while the cumulative cost of the product is ignored. Over time, a product that once solved one clear problem can become a collection of overlapping functions, legacy options and edge cases that nobody originally intended to support indefinitely. Feature creep is therefore often less about poor decisions than about many locally rational decisions creating a globally inefficient product. Every Feature Creates More Than Development Cost The visible cost of a new feature is usually the engineering time required to build it. That is only the beginning. Once released, the feature may need to be tested every time the product changes. It needs documentation, onboarding, analytics, customer support and compatibility with other parts of the product. Bugs have to be fixed, security issues monitored and future updates checked against the new functionality. A feature can therefore move from being a one-time project to becoming a permanent obligation. The real question is not simply: How much will this feature cost to build? It is: How much will this feature cost to keep? That distinction changes the economics of product expansion. Complexity Compounds One feature rarely exists in isolation. New functionality interacts with existing functionality, which means complexity often grows faster than the number of features themselves. A new pricing option may affect billing, checkout, reporting and support. A new integration can create compatibility questions across multiple workflows. A new permission level can require changes throughout the interface. As these dependencies increase, teams spend more time understanding how changes affect the rest of the system. This connects directly with a broader principle explored in Market Insiders’ “The Cost of Complexity: When Growth Makes a Business Weaker Instead of Stronger” Growth does not only add revenue or capability. It can also add coordination cost. Feature creep is one of the clearest ways that principle appears inside a product. More Features Can Make Development Slower A larger product does not simply contain more code. It contains more relationships between different parts of the product. That means developers may need more context before making changes. QA teams must test more scenarios. Product managers need to consider more dependencies. Releases become harder to coordinate because changing one area may create unexpected consequences elsewhere. Eventually, the organisation can enter a strange situation: the product contains more functionality than ever, but the team becomes slower at improving it. The feature set has grown while product velocity has declined. This is one of the hidden costs of feature creep. Complexity created by past additions begins consuming the resources required for future innovation. Customer Support Becomes More Expensive Every additional capability creates another way for a user to become confused. Different configurations produce different problems. Older features may behave differently from newer ones. Support teams need to understand more workflows and explain more exceptions. A feature used by a small percentage of customers may still generate documentation, tickets and training requirements for years. The cost is particularly difficult to see because it is distributed. There may be no single budget line called “cost of feature X”. Instead, the cost appears gradually across support time, onboarding calls, knowledge-base articles and internal training. A product can therefore become more expensive to operate without anyone identifying one specific moment when the cost increased. Feature Creep Can Make Sales Harder, Not Easier More functionality initially appears helpful to sales because every feature creates another possible selling point. But once the product becomes too broad, another problem appears: the story becomes harder to explain. Sales teams may need longer demonstrations. Prospects can struggle to understand which functions matter to them. Different customers hear different versions of what the product actually is. A product with twenty capabilities may technically address more use cases, but it can also become more difficult to position. This is where product complexity begins affecting go-to-market efficiency. The recently published Targeted.gr article, “The Anti-Feature Consumer: When Simplicity Becomes a Marketing Advantage” examines the customer-facing side of this problem: when fewer features can make a value proposition easier to understand and the product easier to position. For the business behind the product, the same simplification can reduce internal complexity as well. Customer Requests Are Not Automatically Product Strategy One of the biggest drivers of feature creep is the belief that customer demand should always determine the roadmap. Listening to customers is essential. Building everything they request is not. Customers experience their own problems, not the entire product architecture. One customer may reasonably request a specialised workflow that creates long-term complexity for thousands of other users. Enterprise clients can make this pressure even stronger because a feature request may be connected to a significant contract. That creates a strategic tension between winning revenue today and maintaining product coherence tomorrow. The correct question is not whether customers want a feature. It is whether enough customers experience the underlying problem, whether the feature strengthens
Discovery Risk: What Businesses Lose When Customer Research Moves Outside Their Website
For years, businesses could observe a large part of the digital customer journey through familiar signals: search impressions, website sessions, product-page visits, downloads, enquiries and conversions. AI-assisted research is beginning to complicate that picture. A potential customer can now ask an AI assistant to explain a market, compare several products, identify trade-offs and narrow the options before visiting a company website. When the first measurable session finally appears, part of the decision-making process may already have happened elsewhere. This creates what we can call Discovery Risk: the strategic risk that arises when a growing share of customer discovery, comparison and early decision-making takes place in environments the business does not own and cannot fully observe. At Market Insiders, this matters because the issue is bigger than lost website traffic. It affects attribution, customer insight, competitive intelligence and the company’s ability to understand how buyers are forming their first impressions. What Is Discovery Risk? Discovery Risk describes the loss of visibility and control that can occur when customers begin researching a category outside the company’s own digital properties. The problem is not simply that someone may receive an answer from AI instead of clicking a search result. The deeper issue is that the company may no longer see what happened before the customer arrived. A buyer could ask which solutions are suitable for a particular use case, compare three competitors, eliminate one because of price and choose another because it appears easier to use. None of those interactions necessarily creates a website visit. Yet commercially, something important has already happened. The customer has formed a shortlist. The Website Is No Longer Always the Beginning of the Journey Businesses have traditionally treated websites as one of the central points of digital discovery. Search, advertising, social media and email might bring the customer in, but the company could then observe what happened next. AI can move some of that activity upstream. Google says users of AI Mode tend to ask substantially longer questions than traditional search users and often continue with follow-up questions, illustrating how conversational interfaces can support more complex research inside the search experience itself. The result is not necessarily the disappearance of websites. It is a change in timing. A customer may still visit the site, but much later — after the category has already been explained and the alternatives narrowed. That distinction is strategically important because the business may only observe the final part of a much longer decision process. What Businesses Lose First: Visibility Into Intent One of the most valuable assets in digital commerce is not traffic itself, but information about intent. Search queries, landing-page behaviour, product comparisons and conversion paths have historically helped companies understand what customers want and where they struggle. When research moves into AI assistants or AI-enhanced search environments, some of those signals become less visible to the business. The customer may ask extremely specific questions such as: Which accounting platform is best for a ten-person agency that works across three countries and wants to avoid enterprise-level complexity? That question contains far more context than a traditional keyword such as best accounting software. But unless the user eventually reaches the company, the business may never see that intent directly. The irony is that customer questions may become richer at exactly the same time that companies gain less direct access to them. Discovery Risk Creates an Attribution Blind Spot The second problem is attribution. Imagine that a customer first encounters a company through an AI recommendation, remembers the brand name and searches for it directly two days later. Traditional analytics may record: Branded Search → Website → Conversion But that is not necessarily where the journey began. The actual sequence may have been: AI research → AI comparison → brand shortlist → branded search → website → conversion The earlier part of the journey is largely invisible. The Targeted.gr article “The Zero-Click Customer: What Happens When AI Answers Before the Brand Does” examines this marketing problem from the brand perspective: customers can begin forming opinions and shortlists before a company receives a measurable click. For executives, however, the issue extends beyond campaign reporting. If management misidentifies where demand is being created, budget allocation and channel strategy can also become distorted. A Direct Visit May No Longer Mean Direct Discovery This is why some familiar analytics categories may become less informative on their own. A customer who reaches a website directly is not necessarily discovering the company directly. They may have learned about the brand through an AI assistant, a community discussion, a creator, a comparison article or another external environment before typing the URL or brand name. This makes the difference between discovery channel and arrival channel increasingly important. The channel recorded by analytics tells the business how the customer arrived. It does not always explain where the customer’s interest began. The Company Also Loses Control Over the First Explanation Discovery Risk is not only about measurement. It is also about framing. When customers begin their research on a company website, the business controls the initial explanation of its products, positioning and differentiators. When research begins through AI, the first explanation may come from an external system synthesising information from the broader web. The business does not decide which competitors appear next to it, which strengths receive emphasis or which weaknesses are considered important. This creates a strategic asymmetry. The company remains responsible for the quality of the product and the clarity of its positioning, but it no longer controls every environment in which that positioning is interpreted. The Wider Information Environment Becomes a Business Asset For this reason, the value of a company’s digital presence increasingly extends beyond its own website. Reviews, professional coverage, product comparisons, customer discussions, industry publications and other third-party references can all contribute to the information environment in which a brand is understood. This is not entirely new. Reputation has always extended beyond owned media. What changes with AI is the speed at which fragmented information can be
George Chatzigeorgiou: The Co-Founder Leading Skroutz’s Transformation Into a Greek E-Commerce Powerhouse
Some companies begin with a detailed business plan, funding targets and an ambitious vision of the market they want to dominate. Skroutz did not. When George Chatzigeorgiou began working on the first version of Skroutz in 2005, he has said that he did not initially think of it as the beginning of a major company. He was a programmer with a regular job, experimenting in his spare time with a simple idea: make it easier for consumers to find and compare prices across Greek online stores. More than two decades later, that side project has become Greece’s leading online marketplace. Skroutz today connects approximately 2.5 million active users with around 9,000 merchants and more than 26 million products, while the business has expanded far beyond product search into proprietary logistics, fulfilment, payments, subscriptions and retail media. And 2026 opened another major chapter. Blackstone agreed to acquire a majority stake from CVC and part of the founders’ holdings, while the founders will retain an interest and continue leading the company. George Chatzigeorgiou remains CEO. Greece’s Competition Commission approved Blackstone’s acquisition of sole control on July 30, 2026. The story is therefore no longer simply about how a Greek price-comparison website became successful. It is about something much larger: how a technology company gradually took control of more and more layers of the e-commerce experience until it became an integrated commerce platform. Market Insiders examines the entrepreneurial journey of George Chatzigeorgiou, the transformation of Skroutz from search engine to marketplace, the role of CVC and Blackstone and why the company’s next major challenge may be turning a dominant Greek position into a broader Southeast European growth story. Who Is George Chatzigeorgiou? George Chatzigeorgiou is the President, CEO and Co-Founder of Skroutz. He studied Electrical Engineering at the National Technical University of Athens. Although his original interests included hardware, his professional career moved strongly toward software. Before Skroutz developed into a full-time business, he worked independently as a programmer and was responsible for much of the early technical development of the platform and its search engine. He founded Skroutz alongside Vasilis Dimou and Giorgos Avgoustidis in 2005. The company itself describes the three founders as friends brought together by an enthusiasm for computing and technology rather than by a grand initial plan to build one of Greece’s largest technology businesses. That detail is important because it helps explain much of the company’s later culture. Skroutz was not originally built around an elaborate corporate theory of e-commerce. It was built around a technical problem. How can software make shopping easier? That question would remain relevant long after price comparison stopped being the company’s main product. Skroutz Started as a Hobby The earliest version of Skroutz was remarkably simple compared with the company that exists today. Chatzigeorgiou created a basic crawler — essentially a small bot — capable of visiting online stores, collecting product information and prices and displaying them through a searchable webpage. As traffic grew, the original system repeatedly reached its limits and had to be rebuilt. The first version focused heavily on computer and electronics shops, including retailers around Athens’ Stournari Street, then one of the city’s best-known technology shopping areas. Chatzigeorgiou has recalled beginning with just a handful of stores and contacting merchants by email to ask whether they wanted to appear on the platform. There was no enormous launch. No international investor. No carefully engineered startup narrative. The company grew because users found the tool useful. That may be the simplest explanation of why the original idea worked: it reduced the amount of effort necessary to answer one very practical consumer question. Where can I buy this product, and at what price? The First Business Model Was Traffic In its earliest phase, Skroutz did not sell products itself. Its value to merchants was traffic. Consumers arrived at Skroutz while researching products and prices, then moved to participating online stores to complete purchases. The company formalized that relationship through a CPC — cost-per-click — commercial model in 2007. By 2009, the platform had exceeded 500 merchants and 300,000 products. For retailers, appearing on Skroutz could solve a visibility problem. A smaller store did not necessarily need the marketing reach of a major retailer if it could appear beside larger competitors at exactly the moment a consumer was comparing products. That model helped Skroutz become deeply embedded in Greek e-commerce. But it also created a limitation. Skroutz could help a consumer decide where to shop. It did not control what happened after the consumer left. The Critical Shift: From Comparison Engine to Marketplace The most important strategic transformation began when Skroutz stopped thinking of itself primarily as a source of traffic. In 2016, Skroutz introduced its marketplace model, allowing customers to complete purchases through the platform rather than simply clicking through to another store. This changed the economics of the company. A price-comparison engine influences discovery. A marketplace participates directly in the transaction. That means considerably greater responsibility. The platform must manage payments, ordering, returns, merchant reliability and customer expectations. But it also gains something strategically valuable: control over much more of the customer journey. The shift from price comparison to marketplace would eventually become the foundation on which almost every subsequent Skroutz service was built. The Product Was No Longer Just Search This distinction is easy to underestimate. As a search and comparison platform, Skroutz’s primary job was helping a user find information. As a marketplace, its job increasingly became helping the user complete the entire purchase confidently. That means the relevant questions changed. Will the payment work? Will the product arrive on time? What happens if it is wrong? Can it be returned easily? Can the merchant fulfil the order? Can delivery be made faster? Can the customer trust the platform enough to shop there repeatedly? The company had moved into a much more difficult business. But it had also entered a business with considerably more strategic depth. 2020 and the CVC Chapter Another major turning point came in
The Economics of Unlimited Photography: What Changes When Taking One More Photo Costs Almost Nothing?
For most of photography’s history, every additional photograph had a visible cost. Film was limited, while developing, printing and physical storage all required money and resources. Taking another picture meant consuming something scarce. Smartphones changed that equation. Once someone owns the device, taking one more photo usually has almost no immediate financial cost. Taking 20 photos instead of two no longer means another roll of film or a visit to the photo lab. Storage is not truly infinite, and cloud services are not always free, but the marginal cost of capturing another image is extremely low. This shift has transformed how we take and keep photographs. We capture duplicates instead of choosing a single shot, photograph information that might once have been written down, and preserve images with little expectation of ever seeing them again. The Economics of Unlimited Photography is therefore less about the cost of creating another image and more about what happens when creation becomes abundant. As the marginal cost of producing another digital object approaches zero, the scarce resource shifts to something else: our ability to organize, retrieve and assign value to what we have already created. Market Insiders examines the economics of photographic abundance and why eliminating scarcity from creation does not eliminate costs — it often moves them somewhere else. Photography Once Had Built-In Scarcity A roll of film imposed a simple constraint: there were only so many exposures available, and using one meant having one fewer for later. That created an economic trade-off every time the shutter was pressed. Even if people did not consciously calculate the monetary cost of each exposure, scarcity was embedded in the medium. Development added another cost, printing added another, while physical storage imposed limits of its own. As a result, photography naturally contained a selection mechanism. Not every moment became a photograph because producing photographs required resources. Digital photography weakened that relationship, and smartphone photography weakened it further. Today, the decision to capture another image usually requires almost no calculation at all. When Marginal Cost Approaches Zero Marginal cost describes the additional cost of producing one more unit. In traditional photography, another photograph consumed film and eventually incurred processing costs. In smartphone photography, once the infrastructure already exists — device, storage and potentially a cloud subscription — the immediate incremental cost perceived by the user can be close to zero. That changes incentives. If taking one photograph and taking five feel economically identical, there is less reason to choose beforehand. Instead of asking “Which photograph should I take?”, the user can simply take all five and decide later. Economically, abundance shifts selection from before production to after production — and sometimes selection never happens at all. Cheap Creation Encourages Overproduction This pattern is not unique to photography. Whenever the cost of producing another digital item becomes extremely low, producing more can become easier than deciding whether more is necessary. Photography offers a particularly visible example: take ten versions and choose the best later, screenshot information instead of deciding whether it matters, or keep the blurry image because deleting it offers no immediate reward. The rational threshold for creation becomes very low because the apparent downside of overproduction is small. But when millions of users repeat this behavior every day, an interesting economic paradox emerges: almost-free individual creation can produce enormous aggregate volumes. The individual unit is cheap, but the system required to store, organize and manage all those units is not necessarily cheap. This economic shift also has a distinctly human side. When capturing another image requires almost no sacrifice, photography can become less about carefully selecting what deserves to be preserved and more about recording first and deciding what matters later. Athens Pulse explores this behavioral change in “Why do we take so many photos we never look at again?”, examining why smartphone users accumulate thousands of images, screenshots and temporary visual records even when many of them may never be revisited. The Cost Does Not Disappear — It Moves Calling smartphone photography “free” would therefore be misleading. The costs have changed form. Consumers buy devices with storage capacity and some pay for cloud storage. Manufacturers provide increasingly sophisticated storage-management systems, cloud providers operate data centers, and software companies invest in indexing, synchronization, backup, compression and search. The Cost Does Not Disappear — It Moves Calling smartphone photography “free” would therefore be misleading. The costs have changed form. Consumers buy devices with storage capacity and some pay for cloud storage. Manufacturers provide increasingly sophisticated storage-management systems, cloud providers operate data centers, and software companies invest in indexing, synchronization, backup, compression and search. Then there is another scarce resource that is harder to price: attention. The user may pay almost nothing to create the twentieth photograph of the same scene, but reviewing those twenty photographs later requires time. When production becomes cheap, downstream management becomes more important. This reflects a broader economic pattern: reducing friction in one part of a system does not necessarily eliminate cost; it can simply transfer the burden somewhere else. Abundance Changes the Value of Selection Under scarcity, selection happens naturally. If only a limited number of photographs can be taken, deciding what deserves to be photographed carries value. Under abundance, capturing becomes easy and curation becomes the scarce activity. Which images should be kept? Which are the best? Which belong in an album? Which duplicates can be deleted? Which photograph from three years ago contains the information someone now needs? These are no longer production problems. They are organization and retrieval problems. The economic value therefore begins to migrate from production toward organization and retrieval. This helps explain why photo-management software becomes more important as personal libraries grow. The more images people create, the greater the potential value of technologies that can help users understand, search and manage what they already have. Storage Creates the Illusion of Infinity Smartphone storage is finite. Cloud storage is finite, and data centers are certainly finite. Yet from the perspective of everyday behavior, digital photography can feel effectively unlimited. That