Abstract

Background: As older adults spend more time online, exposure to cybercrime increases. Factors that constellate in old age are associated with greater susceptibility, suggesting that older demographics might face increased risks, though evidence is limited. Methods: We analysed responses from 35,069 participants aged 16+ in the 2019/20 Crime Survey for England and Wales (CSEW). We tested our hypotheses that, due to a higher prevalence of vulnerabilities associated with ageing, increasing age would predict greater likelihood of cybercrime victimisation, repeat victimisation, and resulting financial loss. Results: Contrary to our hypothesis, 16-24s were most likely to report cybercrime, though as hypothesised, poor health was associated with victimisation. Participants of Black and mixed ethnicities were more likely to report victimisation than White participants. 75+’s were most likely to report repeat cybercrime victimisation (OR 2.03, p=0.074) and associated financial loss (OR 4.25, p=0.037) relative to 16-24s. Discussion: Older adults may under-report less-serious victimisation relative to younger adults, reflecting a lower propensity to report their victimisation to authorities. Equally, older victims may be less able to avoid repetition and loss. Future developments should focus on empowering older adults to recognise and report cybercrime early. Ethnic disparity in victimisation warrants investigation.

INTRODUCTION

Global digitalisation has increased the risk of cybercrime, and risk factors that constellate in older age groups may be associated with greater susceptibility ((Lin et al. 2019); as well as significant social, physical, emotional and financial consequences for those who experience it (e.g. (Tripathi, Robertson, and Cooper 2019). COVID-19 pandemic lockdowns caused a spike in cybercrime due to increased time spent online (Johnson and Nikolovska 2022), and though the growing number of older people with online access has many positive benefits for society and individuals, it has increased exposure of this demographic group to cybercriminals (Cross 2021). This is consistent with Routine Activity Theory (RAT) (Cohen and Felson 1979) which states that crime occurs in spaces where a likely offender converges with a suitable target (in the absence of a capable guardian). Cybercrime includes hacking through technological methods, and ‘social engineering’, where a victim is tricked into disclosing information needed to access a device, network or programme, such as a banking application, or into electronically transferring money (Peltier 2006) (e.g. phishing and romance fraud). Age UK (Age UK 2020) estimated that over 55s in England and Wales lost over £4m to cyber fraud between April 2018 and March 2019.

The Crime Survey for England and Wales (CSEW) is a rich source of crime victimisation data, unaffected by issues that limit police-recorded statistics, such as unwillingness to involve police (Van Dijk 2015) and non-standardised reporting practices across forces (Tilley and Tseloni 2016). CSEW data has been used to analyse the prevalence of crime ((Cooper and Obolenskaya 2021)), explore risk profiles ((ONS 2018), understand prevention techniques ((Tseloni et al. 2017)), reporting ((Myers and Lantz 2020)) and trust in the police ((Bradford et al. 2017)).

The current study was conceived to provide quantitative substantiation to the small, mostly theoretical body of literature on cybercrime against older adults, with the intention of informing the development of tailored and targeted preventative measures for the contexts experienced by older populations. We aim to explore how reporting of cybercrime victimisation, repeat victimisation and financial impact are associated with age and other sociodemographic characteristics, and whether these relationships are influenced by economic and health-related factors and behaviours. While previous studies, many of which have reported lower rates of cybercrime and fraud risks in older adults, do not account for online usage ((Ross, Grossmann, and Schryer 2014); e.g. (van de Weijer, Leukfeldt, and Bernasco 2019) we explore cybercrime risks, across the age range, in people who have used the internet in the past year.

We tested our hypothesis that, among people who have used the internet in the past year, the risk of cybercrime is greater in older, compared with younger, adults; and that this is explained by socioeconomic and health vulnerabilities that are more common in older age. We selected CSEW variables that represent four of Burton et al.’s (2022) core cybercrime victimisation risk factors in older adults: health vulnerabilities, memory loss, social isolation, and wealth. We also test our hypothesis that older adults who report being victims of cybercrime are more likely to report financial loss than younger adults.

MATERIALS AND METHODS

Participants and procedures

The CSEW (formerly the British Crime Survey, BCS) is an annual national crime victimisation survey carried out by the Office for National Statistics (ONS). The survey uses a multistage stratified sample and is administered via face-to-face interviews with more than 35,000 adults across England and Wales. It seeks to be representative of adults aged 16+ living in private households. Participants are randomly selected from the Royal Mail Postcode Address File. Participants are asked whether they have been a victim of crime(s) in the past 12 months, and other personal information on topics such as housing, work and health (ONS, 2023). We analysed the 2019/2020 wave of data, collected in interviews held between April 2019 and March 2020.

Measures

Outcome measures

Cybercrime is defined using the ONS classification of cyber-related fraud and computer misuse, which mimics Home Office Counting Rules (Home Office 2022) for recorded crime. Interviewers ascertained whether an offence was ‘cyber-related’ by asking the participant “thinking about the incident as a whole, was the internet, any type of online activity or internet-enabled device related to any aspect of the offence?” (ONS 2019). The dichotomous primary outcome was whether participants reported being a victim of cyber-related fraud and computer misuse at all in the last 12 months. Dichotomous secondary outcomes were: (a) whether the participant was a repeat victim of fraud and computer misuse; to determine this, participants were asked whether they were victimised more than once during the 12 months prior to interview; and (b) whether a participant who had experienced victimisation in the past year reported that they experienced financial loss as a result of that victimisation.

Exposure variables

We included sociodemographic variables; and variables that reflect four of Burton et al.’s (2022) seven risk factors: health vulnerabilities, memory loss, social isolation, and wealth. We were unable to include three risk factors – societal attitudes, scam content and cybersecurity skills or awareness – as the extent to which they are covered by CSEW data is limited.

Sociodemographic/economic variables: We included age categorised in five bands: (16-24; 25-44; 45-64; 65-74; 75 and over); gender; and self-reported ONS harmonised ethnicity, reported in five categories (Table 1). We measured area deprivation using Indices of Multiple Deprivation (IMD). This combines information from seven domains (income deprivation; employment deprivation; education, skills and training deprivation; health deprivation and disability; crime; barriers to housing and services; and living environment deprivation). The resulting scores are translated into ‘Lower-Layer Super Output Area’ (LSOA: small geographical areas of approximately 1500 residents) deciles (Department for Communities and Local Government, 2015) within the survey, which we converted into quintiles. We included tenure type, number of household members, hours spent away from home per weekday, and participant’s most recent occupation.

Health variables: All health variables were self-reported. The first, ‘status of health in general’, was answerable with: ‘Very good’; ‘Good’; ‘Fair’; ‘Poor; and ‘Very poor’. Participants were asked to self-report the “presence of physical or mental health conditions or illnesses affecting the following areas”: vision and hearing (here, grouped as ‘sensory conditions’); mobility, dexterity, stamina or breathing or fatigue (grouped as ‘physical conditions’); learning or understanding or concentrating, and memory (‘cognitive conditions’); and lastly, mental health and ‘socially or behaviourally’ (‘mental conditions’).

Analysis

All analyses were performed using Stata 17. Where participants answered ‘don’t know’ or ‘not applicable’ or refused to answer a question, the data was treated as missing. We excluded participants who stated that they had not accessed the internet in the last year. We weighted data using the calibration weighting variable developed for the original CSEW survey design, designed to make adjustments for known differences in response rates between different age and gender sub-groups (CSEW 2020), and report actual numbers and weighted percentages throughout.

We used standard summary descriptive statistics to characterise the sample (Table 1). To test the hypothesis that risk of cybercrime victimisation and repeat victimisation would be associated with age and that this would be explained by health and social variables, we first investigated univariate associations of the exposure variables with primary and secondary outcomes (Table 1). Then, in two multivariate logistic regression analyses, we conducted forward stepwise logistic regressions with victimisation and repeat victimisation as the dependent variables, in which we entered variables in the following order: (1) sociodemographic and socioeconomic measures, (2) health measures.

To test our hypothesis that cybercrime victimisation in older age was more likely to be associated with financial loss, we conducted a logistic regression with experience of financial loss as the dependent variable and age group as the independent variable. For this analysis, we restricted our sample to people who had reported any cybercrime victimisation in the past 12 months; and investigated the proportion of respondents who had, and who had not reported related financial loss. Those not answering this question were excluded.

RESULTS

Sample Description

Of the 36,913 participants in the survey, we excluded 738 who did not complete the primary outcome; and 1106 who reported that they had not used a computer in the past year (603 (54.52%) aged 75+, 292 (26.40%) aged 65-75, and 211 (34.99%) aged 16-64). The total analytic sample was therefore 35,069. Table 1 shows sample sociodemographic characteristics. Victimisation was reported by 2564 (7.31%) participants and repeat victimisation by 455 (1.30%) participants. 659 (25.70%) participants reporting victimisation answered the question regarding whether they had experienced financial loss as a result of their cybercrime victimisation, of whom 268 (40.51%) answered that they had experienced financial loss.

Univariate Analyses

Associations with age

Risk of cybercrime victimisation reduced with age, being highest among people aged 16-24 and lowest in people aged 75+. By contrast, repeat victimisation was reported most frequently by people aged 75+, though this difference relative to the youngest age group was not statistically significant (Table 1). As hypothesised, older adults were significantly more likely than participants aged 16-24 to report financial loss as a result of their victimisation: OR 4.25, p=0.04 for 75+’s; OR 1.20, p=0.660 for 65-74’s.

Associations with other sociodemographic/economic exposures

Considering other exposures (Table 1), cybercrime victimisation was associated with: being male or from a Black or mixed/multiple ethnic group; living in less deprived areas; living in larger households; spending more time away from home; living in private rented rather than owned accommodation; and those who reported their most recent occupation as managerial/professional. Repeat victimisation was associated with: being male; being from a mixed/multiple and other ethnic group; and living in social rented rather than owned accommodation. Cybercrime victimisation and repeat victimisation were associated with poor general health, and presence of physical, mental and cognitive conditions/illnesses.

Multivariate Analysis

In fully adjusted multivariate models (Table 1), 16–24-year-olds remained at most risk of victimisation. Victimisation and repeat victimisation were associated with: Black and mixed ethnicity; male gender; greater time spent away from home; managerial/professional occupation; living in rented accommodation; and having poor general health and mental and physical conditions. There was also evidence to indicate that older age predicted repeat victimisation in the final adjusted model, although this did not quite reach significance at the 95% confidence interval.

TABLE 1 Sociodemographic characteristics of the sample and univariate (uni) and multivariate (multi) associations with cybercrime victimisation and repeat victimisation

DISCUSSION

Contrary to our hypothesis, reporting any cybercrime victimisation was less common with advancing age, though people aged 75+ were most likely to report repeat victimisation and financial loss. As hypothesised, worse cognitive, physical, mental and general health were associated with greater risk, across the ages.

There are several possible explanations for our findings. It might be, given that cases reported by older people were more serious in nature - likely to involve financial loss and repeat victimisation, that they were the “tip of the iceberg”. This may be indicative of significant under-reporting of cybercrime by older people in this survey. (Burton et al. 2022) theorise based on existing literature that older adults may not disclose their victimisation due to feelings of shame, embarrassment, and fear of not being taken seriously or victim blaming.

Our findings could also indicate that despite a high prevalence of vulnerability factors, mitigating contexts reduce risk of cybercrime in older population. One is time spent online. Whitty (Whitty 2019) found that “younger people were more likely to engage in routine activities that potentially expose them to cyber-frauds and older people were more likely to engage in online guardianship behaviours”. Cybercriminals have greater opportunity to target people who are online more. Older people still use the internet least, but as there are many benefits to internet use, reducing access is not a solution to decreasing risk. The significant increased engagement of older populations in online worlds suggests that identifying and strengthening other mitigating factors in this demographic group is critical.

A second likely mitigating factor is guardianship; self-initiated strategies such as using antivirus software, and support of family and friends where possible, might decrease risk. A survey by (Branley-Bell et al. 2022) found old age to be associated with cybersecurity behaviours such as generating secure passwords and regularly updating devices. Younger users, however, were more likely to secure their devices by, for example, locking the screen.

Living in private rented accommodation, and living in larger households, is associated with greater risk. This may in part explain our finding that age is negatively correlated with victimisation; older people are most likely to be owner occupiers (ONS 2020) and living either alone or with their partner, and thus living in more stable residential contexts with less exposure to cybercrime. (Garg and Camp 2015) theorise that high residential mobility hampers guardianship in the form of social ties with neighbours. Staying safe online may be easier without frequent moves of accommodation.

We found that men are more likely to report victimisation and repeat victimisation than women. A plausible explanation is that men, who have been found to take more risks than women generally (Hudgens and Fatkin 1985), may also engage in riskier behaviour or activities online, leaving them more vulnerable to malicious actors.

Black and mixed/multiple ethnicities were more likely to be cybercrime victims than participants of White ethnicity. Research on the drivers behind ethnic disparities in crime victimisation in the UK and abroad is limited. Salisbury and Upson’s (2004) crime survey analysis found that people of Black and minority ethnicity are more likely than White people to fall victim to crime in general. Green (2011, p. 100) attributed this to differences in age structure, socio-economic characteristics, and characteristics of the areas where respondents live. Future research might explore differing patterns and types of internet use, and systemic disadvantages, for example linguistic barriers to safe cyber navigation.

Our findings suggest a complex relationship with socioeconomic status, as those in professional and managerial occupations are more likely to experience cybercrime, as are those who are unemployed. A plausible explanation, consistent with LRAT, could be that professional and managerial occupations involve greater internet usage, whilst people who are unemployed are more vulnerable because they have fewer resources to protect themselves from crime.

Poor general and mental health were associated with cybercrime victimisation. This relationship is likely to be bidirectional as poor health might increase the risk of cybercrime (Abdelhamid 2020) and being a victim of cybercrime may worsen mental health (Rhoads 2023). There may be scope for incorporating cybersecurity-related assistance or education into health and social care services, as well as improved multiagency collaboration and information sharing with police. Given that victimisation was associated with physical and cognitive impairments; software professionals might consider how online platforms and their security features and offerings can be made more inclusive.

Limitations

We compared financial impact of cybercrime, but due to low responses to the survey questions asking about emotional and physical impacts, could not study these. Our research data were collected before the pandemic, and habits, behaviours and threats may have changed significantly as a result of the pandemic.

Conclusion

Older people may be under-reporting less serious victimisation (that does not involve repeat offences or financial loss) relative to younger adults in surveys, possibly mirroring a lower propensity to report cybercrime to the police, bank, or other authority. Older adults may also be less able than younger adults to avoid repeat victimisation and financial loss. Future developments in platform and process design, as well as multi-agency collaboration and information sharing, should focus on empowering older adults to detect fraudulent activity before loss is incurred, and removing barriers to reporting.

REFERENCES

Abdelhamid, M. (2020). The Role of Health Concerns in Phishing Susceptibility: Survey Design Study. Journal of Medical Internet Research, 22(5), e18394. https://doi.org/10.2196/18394

Age UK. (2020, June 29). Uncovering the true impact of cybercrime across the UK. https://www.ageuk.org.uk/discover/2020/06/cybercrime-uk/

Bradford, B., Sargeant, E., Murphy, K., & Jackson, J. (2017). A Leap of Faith? Trust in the Police Among Immigrants in England and Wales. The British Journal of Criminology, 57(2), 381–401. https://doi.org/10.1093/bjc/azv126

Branley-Bell, D., Coventry, L., Dixon, M., Joinson, A., & Briggs, P. (2022). Exploring Age and Gender Differences in ICT Cybersecurity Behaviour. Human Behavior and Emerging Technologies, 2022, e2693080. https://doi.org/10.1155/2022/2693080

Burton, A., Cooper, C., Dar, A., Mathews, L., & Tripathi, K. (2022). Exploring how, why and in what contexts older adults are at risk of financial cybercrime victimisation: A realist review. Experimental Gerontology, 159, 111678. https://doi.org/10.1016/j.exger.2021.111678

Cohen, L. E., & Felson, M. (1979). Social Change and Crime Rate Trends: A Routine Activity Approach. American Sociological Review, 44(4), 588–608. https://doi.org/10.2307/2094589

Cooper, K., & Obolenskaya, P. (2021). Hidden victims: The gendered data gap of violent crime. The British Journal of Criminology, 61(4), 905–925. https://doi.org/10.1093/bjc/azaa100

Cross, C. (2021). Theorising the impact of COVID-19 on the fraud victimisation of older persons. The Journal of Adult Protection, 23(2), 98–109. https://doi.org/10.1108/JAP-08-2020-0035

ONS. (2020). Crime Survey for England and Wales: Technical Report 2019/20. Kantar. Available at: https://www.ons.gov.uk/peoplepopulationandcommunity/crimeandjustice/methodologies/crimeandjusticemethodology

Garg, V., & Camp, L. J. (2015). Why cybercrime? ACM SIGCAS Computers and Society, 45(2), 20–28. https://doi.org/10.1145/2809957.2809962

Home Office. (2022). Home Office Counting Rules for Recorded Crime. https://www.gov.uk/government/publications/counting-rules-for-recorded-crime

Hudgens, G. A., & Fatkin, L. T. (1985). Sex differences in risk taking: Repeated sessions on a computer-simulated task. The Journal of Psychology: Interdisciplinary and Applied, 119, 197–206. https://doi.org/10.1080/00223980.1985.10542887

Johnson, S., & Nikolovska, M. (2022). The effect of COVID-19 restrictions on routine activities and online crime. SocArXiv. https://doi.org/10.31235/osf.io/ze49b

Lin, T., Capecci, D. E., Ellis, D. M., Rocha, H. A., Dommaraju, S., Oliveira, D. S., & Ebner, N. C. (2019). Susceptibility to Spear-Phishing Emails: Effects of Internet User Demographics and Email Content. ACM Transactions on Computer-Human Interaction, 26(5), 1–28. https://doi.org/10.1145/3336141

Myers, W., & Lantz, B. (2020). Reporting Racist Hate Crime Victimization to the Police in the United States and the United Kingdom: A Cross-National Comparison. The British Journal of Criminology, 60(4), 1034–1055. https://doi.org/10.1093/bjc/azaa008

ONS. (2018). Domestic abuse: Findings from the Crime Survey for England and Wales. https://www.ons.gov.uk/peoplepopulationandcommunity/crimeandjustice/articles/domesticabusefindingsfromthecrimesurveyforenglandandwales/yearendingmarch2018#:~:text=The%20year%20ending%20March%202018%20CSEW%20estimated%20that%2021.0%25%20of,abuse%20by%20a%20family%20member.

ONS. (2019). Crime Survey for England and Wales 2019 to 2020: Adult Questionnaire. Kantar. https://www.ons.gov.uk/peoplepopulationandcommunity/crimeandjustice/methodologies/crimeandjusticemethodology#questionnaires

ONS. (2020). Living longer: Changes in housing tenure over time. https://www.ons.gov.uk/peoplepopulationandcommunity/birthsdeathsandmarriages/ageing/articles/livinglonger/changesinhousingtenureovertime

Peltier, T. R. (2006). Social Engineering: Concepts and Solutions. Information Systems Security, 15(5), 13–21.

Rhoads, J. (2023). Psychological Effects of Cybercrime on Minorities: Short-Term and Long-Term Impacts. Journal of Empirical Social Science Studies, 7(1), Article 1.

Ross, M., Grossmann, I., & Schryer, E. (2014). Contrary to Psychological and Popular Opinion, There Is No Compelling Evidence That Older Adults Are Disproportionately Victimized by Consumer Fraud. Perspectives on Psychological Science, 9(4), 427–442. https://doi.org/10.1177/1745691614535935

Tilley, N., & Tseloni, A. (2016). Choosing and Using Statistical Sources in Criminology: What Can the Crime Survey for England and Wales Tell Us? Legal Information Management, 16(2), 78–90. https://doi.org/10.1017/S1472669616000219

Tripathi, K., Robertson, S., & Cooper, C. (2019). A brief report on older people’s experience of cybercrime victimization in Mumbai, India. Journal of Elder Abuse & Neglect, 31(4–5), 437–447. https://doi.org/10.1080/08946566.2019.1674231

Tseloni, A., Thompson, R., Grove, L., Tilley, N., & Farrell, G. (2017). The effectiveness of burglary security devices. Security Journal, 30(2), 646–664. https://doi.org/10.1057/sj.2014.30

van de Weijer, S. G. A., Leukfeldt, R., & Bernasco, W. (2019). Determinants of reporting cybercrime: A comparison between identity theft, consumer fraud, and hacking. European Journal of Criminology, 16(4), 486–508. https://doi.org/10.1177/1477370818773610

Van Dijk, J. (2015). The case for survey-based comparative measures of crime. European Journal of Criminology, 12(4), 437–456. https://doi.org/10.1177/1477370815585446

Whitty, M. T. (2019). Predicting susceptibility to cyber-fraud victimhood. Journal of Financial Crime, 26(1), 277–292. https://doi.org/10.1108/JFC-10-2017-0095