Predicting susceptibility to cyber-fraud victimhood

1.1 Victims’ psychological profile

There has been some speculation about the distinctive psychological characteristics of fraud victims, in general. Titus and Gover (2001) believe that victims of fraud are more likely to be: co-operative, greedy, gullible/uncritical, careless, susceptible to flattery, easily intimidated, risk takers, generous, hold respect for authority and are good citizens. Fischer, Lea and Evans (2013), found in their survey research that scam victims or near scam victims were more affected by the high values offered in scams and displayed a high degree of trust in the scammers. Holtfreter et al. (2008) found that self-control is a significant predictor of victimisation. Buchanan and Whitty (2014) found in their research on romance scams that individuals with a higher tendency towards idealisation of romantic partners were more likely to be scammed. Whitty (2013) has theorised that romance scam victims are addicted to the scam. Whilst more research is needed in this area, the current work suggests some merit in considering whether personal dispositions predict cyber-fraud victimhood. The first hypothesis is as follows:

Drawing from the previous literature on scamming compliance behaviour and the research on behaviours related to certain personality dispositions, the following psychological characteristics were examined: impulsivity, locus of control and addictive disposition. Impulsivity was examined given that much of the literature that theorises why individuals become defrauded highlights the use of the scarcity tactic used by criminals and their push for urgency to respond to a crisis (Lea, et al., 2009; Whitty, 2013). Victims of scams, therefore, might be more likely to respond to pushes to respond quickly without checking facts and be pulled into sensational narratives (e.g. handsome military soldiers, stuck in war torn areas). A subset of the first hypothesis is:

Locus of control refers to an individual’s belief about control over his/her environment. People who have an internal locus of control have the conviction that events are contingent upon one’s behaviour. Those with an external locus of control believe that events do not depend upon their actions, but rather upon luck, chance, or fate (Rotter, 1966). If individuals believe that they have little control over events, they might be more likely to comply with a scammer. A subset of the first hypothesis is:

There has been some theorising that individuals get ‘caught up in a scam’ do so because they are addicted to the scam itself and the visceral response they experience from the involvement in the scam (Whitty, 2013; Whitty, 2015b). Addictive disposition was therefore considered important to investigate in this research. A subset of the first hypothesis is:

1.2 Victims’ socio-demographic profile

With respect to socio-demographic characteristics, such as age and education of fraud victims, in general, the literature is fairly sketchy, with much of the research focussing on the elderly given that it is presumed they are more at risk (ACCC, 2016; Bolimos and Choo, 2017; James, et al., 2014; Oliver, et al., 2015; ONS, 2016c; Titus and Gover, 2001). Those who report cyber-frauds tend to be older (ACCC, 2016) and there is a view that those who are uneducated are more likely to be scammed (Titus and Gover, 2001), although empirical research is needed to support this belief. The second hypothesis is:

1.3 Routine activity theory

The premise of routine activity theory, first proposed by Cohen and Felson (1979), is that crime is unaffected by social causes, such as poverty and inequality. Proponents of this theory argue that individuals become victims of crime because they participate in ‘high risk’ activities or behaviours in the absence of capable guardianship and in the company of motivated offenders (Farrell, Phillips and Pease, 1995; Turanovic and Pratt, 2014). According to this theory, opportunity is the root cause of victimisation. Victims of burglary, for instance, are encouraged to change their locks and add alarm systems to decrease their chances of becoming burgled a second time.

There are a few studies that have examined the relationship between online activities and cyber-fraud. Hutchings and Heyes (2009), drawing from a very small sample, found that computer use was a significant predictor of receiving a phishing email. Pratt et al. (2010) examined whether demographic characteristics (e.g. age, gender, education, marital status) and online routines (hours spent online and Internet web site purchases) increase people’s exposure to scams. They found that demographic characteristics shape routine online activities and that indicators of routine online activities fully mediate the effect of demographic characteristics on the likelihood of being targeted online for fraud. Psychological characteristics, however, were not considered in their study. Moreover, the likelihood that a victim would be taken in by these scams was not considered. In more recent research, Reyns (2015) conducted a study that examined whether online exposure placed users at more risk of online victimisation (phishing, hacking and malware infection) and if online guardianship helped prevent this form of victimisation. He found that individuals who were more likely to make online purchases, engage in social networking and post information online were more likely to be victimised. He also found that online guardianship was positively related to victimisation but in the opposite direction to what he predicted. For example, Reyns found that individuals who installed anti-virus software where more likely to become a victim of a phishing attack, although he suspects the reason for this finding was a temporal ordering problem (i.e. the participants in his sample may have installed the software as a consequence of being phished). Therefore, although Reyns’ results were mixed, the findings suggest there is a need to further investigate the relationship between online behaviours and online victimisation.

Overall, research findings therefore highlight that online routine activities are important to investigate when examining cyber-fraud victimisation. Drawing from previous research the online risky activities this study focussed on included: instant messaging, positing pictures, posting messages, streaming media, online shopping and online banking. It was reasoned that engaging in these activities might increase the likelihood that a user is likely to encounter a scam or provide personal information for scammers to use against that user, thereby increasing a person’s chances of being scammed. In addition, an item on online guardianship was included (visiting online sites for consumer advice, e.g. scammer alert advice). The third and fourth hypotheses are:

1.4 Repeat victims

There is a body of academic literature on repeat victims, which has mostly focussed on crimes, such as: burglary, theft, domestic violence, and child sexual abuse (Farrell and Pease, 2001; Farrell et al., 1995; Grove et al., 2012). Broadly, theorists argue that repeat victimisation occurs because of one or more of the following: predisposing personal characteristics; situational risk factors; and the criminals or connected co-offenders return to the same victims once learning they are a suitable target (Farrell et al., 1995; Farrell and Pease, 2001; Lantz and Ruback, 2015). Whitty (2015a) has reported that about a quarter of cyber-fraud victims are scammed at least twice. This proportion of repeat victims suggests an urgent need to also understand why some cyber-fraud victims continue to be victimised by subsequent cyber-frauds. The empirical literature, to date, provides few clues as to why some victims learn their lessons and others move on to become victims of other cyber-frauds. The fifth and final hypothesis is that repeat victims of cyber-frauds are like to significantly differ on psychological and social characteristics, online behaviours and online guardianship behaviours compared with one-off victims.

2.1 Participants

Overall, 12,060 participants who resided in the UK were recruited from a random sample from a paid panel organised by Qualtrics (a well-established company, often used by academics to recruit representative samples for online studies). Of these individuals, 11,780 participants remained in the final sample. Individuals who were excluded: failed to complete the survey, provided repetitive or inappropriate responses to attention filler items, completed the survey more than once, or completed the survey in an usually short amount of time. In this final sample 10,723 participants were non-victims, 728 were one-off victims and 329 were repeat victims. All participants stated that they had been exposed to an online scam online. The mean age of the sample was 48.5 years (SD = 16.3), ranging from 18-93 years. Overall, 37 per cent of the sample was men and 63 per cent women. With regard to the highest level of education achieved by participants: 1.4 per cent had a doctoral degree, 8.3 per cent had a master’s degree, 29.5 per cent had an undergraduate degree, 29.3 per cent had A levels, 27.6 per cent held GCSE qualification and 3.9 per cent had less than high school qualifications.

2.2 Materials

Data were collected using a questionnaire hosted on the Qualtrics online survey platform. The questionnaire consisted of personality inventories and items devised to measure demographic descriptive data, routine activities and online guardianship behaviours. Those who had been scammed were also asked to describe the type of cyber-fraud/s they has been tricked by and as a consequence lost money. Impulsivity was measured using the UPPS-R Impulsivity Scale (Whiteside and Lynam, 2001). The 45-item scale measures a person’s tendency to act on whim, displaying behaviours characterised by little forethought or consideration of the consequences of their actions. The scale comprises four subscales: lack of premeditation (11 items), urgency (12 items), sensation seeking (12 items) and lack of perseverance (10 items). Possible scores range from 11 to 44 for the lack of premeditation subscale, from 12 to 48 for both the urgency and sensation seeking subscales, and from 10 to 40 for the lack of perseverance subscale. A lower score indicates low impulsivity for that dimension. In the current study, all of the subscales demonstrated good internal consistency (Cronbach’s alpha = 0.86, 0.91, 0.89, 0.83 for lack of premeditation, urgency, sensation seeking and lack of perseverance, respectively).

Locus of control was measured using the Internal-External Locus of Control scale (Rotter, 1966). The 29-item scale measures a person’s general tendency for an internal or external locus of control. For each item on the scale, participants indicate which of two statements they agree with most. Possible scores range from 0 to 23, with a lower score indicating a more internal locus of control insofar as a participant believes that everyday events are contingent on his or her own behaviour. In the current study, the study demonstrated acceptable internal consistency (Cronbach’s alpha = 0.65).

Addictive disposition was measured using the Eysenk Personality Questionnaire (EPQ-A). Acceptable internal consistency was obtained for this scale (Cronbach’s alpha = 0.68). There are 32 dichotomous items in the EPQ-A scale, with possible scores ranging from 0 to 32. A high score equates with high addictive disposition.

Routine activities included items on frequency of the following online activities: Instant messaging, posting pictures, posting messages, streaming media, shopping online and banking online. Participants were also asked a question on online guardianship: how frequently they viewed consumer advice sites, for example, fraud alerts, Which? magazine). For each of these items participants were presented with five-point Likert scales with 1 = never and 5 = several times a day. Non-victims were asked to answer these questions considering the past six months, one-off victims were asked to consider six months prior to the scam and repeat victims were asked to answer six months prior to the last scam they were taken in by.

An exploratory Factor Analysis was performed on all routine activities items, except for the online guardianship question. Before subjecting the scale to principle axis factoring the data were assessed to ensure suitability for analysis and it was found that none of the assumptions were violated. The Kaiser-Meyer-Olken measure of sampling adequacy was 0.75 which exceeded the recommended lowest value of 0.6. The Barlett’s Test of Sphericity also reached statistical significance, supporting the factorability of the correlation matrix. Principal axis factoring revealed the presence of two components with eigenvalues exceeding 1. Together they accounted for 60.71 per cent of the total variance (42.86 per cent and 17.85 per cent, respectively). Inspection of the scree plot confirmed two factors. Direct Oblimin separated these components obliquely, which allows for the possibility of intercorrelation among factors. All items exceeded loadings of 0.4, and therefore, they were all considered for further analysis. The rotated factor solution took four iterations to produce and is reported in Table I. Factor 1 was labelled Exposing online activities and Factor 2 was labelled Risky online spaces. Factor-based scales were generated by obtained regression scores.

2.3 Procedure

Participants were recruited via a Qualtrics online panel. Qualtrics recruited a random sample from its large panel of UK participants. Participants were asked to complete a series of socio-demographic questions (e.g. age, gender, education), personality items (e.g. impulsivity, locus of control, addiction disposition) and whether they had been scammed by a cyber-fraud. Participants were all asked a series of questions about routine activities and whether they had ever come across a cyber-scam. They were also asked if they had been defrauded by more than one cyber-fraud. They were also asked questions about the type of cyber-fraud.

3.1 Bivariate associations

Bivariate associations between the independent variables were first examined (see Table II). Most correlations were moderate to low. Correlations of note include those between: age and exposure online (Pearson’s r = −0.533), urgency and addiction (Pearson’s r = 0.497), exposure online activities and risky online spaces (Pearson’s r = 0.617), and risky online spaces and online guardianship (Pearson’s r = 0.433). Unsurprisingly, many of the correlations between subsets of impulsivity were moderate and ranged from Pearson’s r = −0.290 to 0.497.

3.2 Relationship between personality and socio-demographic characteristics with routine activities

First, statistically significant relationships between personality (impulsivity, locus of control and addictive disposition) and socio-demographic characteristics (age, gender and education) with routine activities (exposing online activities, risky online places and online guardianship) were investigated.

Prior to running the analysis it was found that the assumptions were met to run simultaneous forced entry multiple regressions. It is also noted that there were no issues with multicollinearity given that VIF levels were less than 2. The total variance of the model examining exposing online activities was 34.5 per cent, F (9, 11700) = 689.54, p < 0.001 (see Table III). The total variance of the model explaining risky online spaces was 15.1 per cent, F (9, 11700) = 232.08, p < 0.001 (Table IV). The total variance of the model explaining ‘online guardianship’ was 7 per cent, F (9, 11700) = 99.524, p < 0.001 (Table V).

As shown in the tables these findings demonstrate that psychological and socio-demographic characteristics are associated with routine activities. Notably, younger people were more likely to engage in routine activities that potentially expose them to cyber-frauds and older people were more likely to engage in online guardianship behaviours. Educated people were more likely to engage in routine activities that potentially expose them to cyber-frauds and were more likely to engage in online guardianship behaviours. Those who scored higher on the impulsivity sub-scales urgency and sensation seeking, and high on addiction were more likely to engage in routine activities that potentially expose them to cyber-frauds and were more likely to engage in online guardianship behaviours. In contrast, those who scored low on the impulsivity subscale, lack of perseverance, and low on external locus of control were more likely to engage in routine activities that potentially expose them to cyber-frauds and were more likely to engage in online guardianship behaviours.

3.3 Predictors of cyber-fraud victimhood

H1-4 were next examined. Given that a statistical relationship was revealed for personality, socio-demographic variables and routine activities, these were initially considered in separate models before considering them in a combined model. Three binary logistic regressions models were therefore conducted (Tables VI-VIII). Given gender was found to be a weak predictor of routine activities and there were no gender hypotheses developed to predict victimhood, gender was not examined in these models. Model 1 examined the psychological characteristics examined in the previous regression analyses with the exception of gender. Model 2 examined the routine activities examined in the previous regression analyses. Model 3 was the saturated model, which included both psychological characteristics and routine activities.

Model 1 was significant, with a good fit to the data, [χ²(8, N = 11,780) = 536.90, p < 0.001] (Nagelkerke R² = 0.098). Model 2 was significant, with a good fit to the data [χ²(3, N = 11,780) = 395.80, p < 0.001] (Nagelkerke R² = 0.073). Model 3 was significant, with an improved fit to the data [χ²(11, N = 11,780) = 685.05, p <0.001] (Nagelkerke R² = 0.125). Notably, all predicator variables were significant in all models, with the exception of lack of perseverance. The saturated model was a better fit and none of the psychological characteristics dropped out of the model. Furthermore, although the predictors, education, lack of perseverance, locus of control and guardianship were significant, they were in the opposite direction to what was hypothesised.

Finally, any differences between one-off victimhood and repeat victimhood were examined. This was carried out using a multinominal logistic regression, including both psychological characteristics and routine activities in the model, with one-off victimhood as the reference category (Table IX). The model was significant, χ²(22, N = 11,780) = 727.28, p < 0.001), (Nagelkerke R² = 0.117). When considering non-victims and one-off victims, most of the predictor variables were significant with the exception of lack of perseverance. Furthermore, although the predictors, education, lack of premeditation, locus of control and online guardianship were significant, they were in the opposite direction to what was hypothesised. When considering one-off victims and repeat victims very little separated these groups, except for online guardianship, which was in the opposite direction to what was predicted.

4.1 Susceptibility theoretical framework

Much of the previous research on cyber-fraud (of which there are still few studies) has focussed on the types of people and the routine activities of those who are targeted (Pratt et al., 2010). Research that has examined predictors of victimhood has typically considered personal dispositions (Buchanan and Whitty, 2014) or routine activities (Reyns, 2015) in isolation. The work here demonstrates that a susceptibility to cyber-fraud framework needs to include: personality and socio-demographic characteristics, exposing online activities, risky online spaces and online guardianship behaviours. Combining psychological theories of individuals’ differences and criminological theories of routine activities is essential if scholars are to further their understandings of why individuals are tricked by cyber-scams as well is in the development of methodologies to prevent these types of crimes.

This study found that most of the psychological characteristics predicted online routine activities – both risky activities and online guardianship activities. However, although certain types of people are more likely to place themselves at risk and protect themselves (which in itself is important to understand), the saturated model found that both psychological characteristics and routine activities are important to consider when predicting victimhood. Therefore, it is proposed here that a predictive model for cyber-fraud victimhood needs to include socio-demographic characteristics, personality traits and online routine behaviours.

Most of the predictor variables proposed in this study were significant; however, they were not all significant in the direction hypothesised. The research supported the hypotheses that age, some of the impulsive sub-categories (urgency and sensation seeking), addiction and the risky online behaviours (exposure and risky places) significantly predicted victimhood. Significant predictors in the opposite direction to what was predicted included: education, lack of premeditation, locus of control and online guardianship behaviours.

The explanation for why educated people are more likely to be scammed by these types of scams might be explained in a number of ways. Although education was significant in the saturated model where routine activities were also included (meaning that education still made a significant contribution to the model in spite of this variable significantly predicting routine activities) it might be that there are other online routine activities that educated people engage in that place them at risk that were not considered in the research (van Deursen and Dijk, 2014; Estacio et al., 2017, in press, for a discussion on how educated people use the Internet differently compared with less educated people). An alternative explanation can be offered by drawing from the work of Lea et al. (2009). Lea and colleagues theorised that overconfidence in the ability to recognise scams places people at greater risk of becoming scammed as they hold a ‘belief of invulnerability’. Educated people might be more likely to be more likely to hold the view that they can spot a scam, and thereby spend less efforts seeking out persuasion and deception cues.

Counter to the hypotheses, those who were more likely to be premeditative and have a high internal locus of control were more likely to be scammed. Although this finding is counter-intuitive, this suggests that cyber-fraud victims do not recognise the control others might have over them and as a consequence are pulled into a scam – with the false belief that they are in control. These findings might also suggest that spending time considering one’s actions online is not, in itself, protective. Further research might consider which cues individuals’ believe signal a scam and whether individuals are able to correctly discern authentic material from scammer material (e.g. profiles, advertisements, emails).

Perhaps the most interesting and important finding here is that online guardianship behaviours did not protect individuals from becoming scammed. In fact, the opposite finding was revealed in this study with one-off victims more likely to engage in online guardianship behaviours compared with non-victims and repeat victims more likely to engage in guardianship behaviours compared with one-off victims. The finding might be interpreted in a number of ways. Engaging in online guardianship behaviours might be exposing individuals more to scams/scammers and/or the sites that present information on how to protect individuals from scams does not communicate this information effectively. This final point is not trivial, given the criticisms that are often made of fraud information sites. As Sasse and Smith (2016) contend, useful cybersecurity advice needs to be both correct and actionable. Moreover, given that, as this study found, victims are typically impulsive, information might need to be written succinctly so that users can easily and quickly digest the details needed to change their behaviours. It might be useful to provide more engaging and interactive advice to capture and hold users’ attention.

When considering repeat victimisation it is noteworthy that there were no significant distinguishing psychological or socio-demographic characteristics between one-off victims and repeat victims. In this sample, 45 per cent of cyber-fraud victims were repeat victims. This finding highlights an urgent need to develop effective preventative strategies for this group. Alarmingly, the only variable that predicted whether someone was a repeat or a one-off victim was their likelihood to read e-safety websites. Although more research is needed to understand this finding – at face value, at least, this suggests that e-safety websites need to improve on the content and possibly presenting of information placed on these sites.