Introduction

Global digitalisation has increased the risk of cybercrime, and though the growing number of older people with online access has many positive benefits for society and individuals, it has increased exposure of this demographic group to cybercriminals [1]. This is consistent with Routine Activity Theory (RAT) [2] which states that crime occurs in spaces where a likely offender converges with a suitable target (in the absence of a capable guardian). Whilst there is evidence to suggest that younger age is associated with cybercrime victimisation [3, 4], but this can plausibly be attributed to underreporting among older adults combined with greater activity online among younger demographics, which increases exposure to malicious actors [5].

Cybercrimes include hacking through technological methods, and ‘social engineering’, where a victim is tricked into disclosing information needed to access a device, network or programme such as a banking application, or into electronically transferring money. Social engineering is a broad term which includes cryptocurrency-related, phishing and romance fraud, and occurs on platforms including email and social media. It is inherently discriminatory, as attackers tailor their approach to intended victims’ vulnerabilities [6].

Risk factors that constellate in older age groups may be associated with greater susceptibility to cybercrime [7, 8]; as well as significant consequences for those who experience it. Crime victimisation in general can cause serious psychological harm to older adults in the form of anxiety, depression and even post-traumatic stress disorder (PTSD). Such harm may be exacerbated by factors such as pre-existing health conditions and social isolation [9]. Indeed, older victims of cybercrime specifically have reported having unresolved feelings of shame, depression and anxiety, as well as having lost entire life savings and emergency funds [10]. Analysis by Age UK [11] indicates that over 55s in England and Wales lost over £4m to cyber fraud between April 2018 and March 2019.

In a recent realist review, Burton et al. [8] developed a programme theory “explaining how, why and in what circumstances older adults may be at risk of becoming victims of financial cybercrime” (p.2). It proposes seven core victimisation risk factors: (i) limited cybersecurity skills or awareness, (ii) health vulnerabilities, (iii) memory loss, (iv) social isolation, (v) relative wealth, (vi) specific societal attitudes that precipitate shame or fear of loss of independence, and finally (vii) scam content developed by a motivated offender. Further to this, Cross (7) theorises that older adults who experience greater socio-economic hardships, or who are more likely to be socially isolated, for example due to bereavement, may feel more inclined to engage with fraudulent approaches that offer financial incentives.

The Crime Survey for England and Wales (CSEW) is a rich source of crime victimisation data, unaffected by issues that limit police-recorded statistics, such as unwillingness to involve police [12] and non-standardised reporting practices across forces [13]. CSEW data has been used to analyse the prevalence of crime [14], explore risk profiles [15], understand prevention techniques [16], reporting [17] and trust in the police [18]. CSEW-based research on cybercrime is limited. Furnell and Dowling [19] compared CSEW data with police statistics to offer “a portrait of the landscape”, considering the challenges involved with classifying and measuring cybercrime, and its associated costs and harms. Akdemir and Lawless [20] used CSEW data and victim interviews to test the applicability of the Lifestyle Routine Activities Theory (LRAT), an adapted form of the RAT which conceives risk of victimisation in terms of probability according to one’s overall lifestyle [21]. Similarly, Mikkola et al. [22] conducted their own international survey of participants aged between 15 and 25 in order to investigate whether RAT and the ‘general theory of crime’ [23]–which proposes that the primary cause of criminal behaviour is a lack of self-control–can be used to explain risk of different kinds of cybercrime victimisation. Among their findings were that a risk-driven lifestyle, peer pressure and young age are factors that contribute to cybercrime victimisation. None of these studies explored how frailties and comorbidities associated with old age, including cognitive, mental and physical illness or social isolation, may influence victimisation. Poppleton, Lymperopoulou, and Molina [24] conducted the only CSEW study to specifically address such vulnerabilities, yet their study looks at fraud rather than cybercrime. Drawing on data from 2017 to 2019, they used victim and incident related risk factors and level of harm caused to divide England and Wales’ general fraud victim population into nine demographic clusters, with older adults considered at particular risk.

In a narrower and more up-to-date examination of the subject than that of Poppleton et al. [24], the current study was conceived to inform the development of tailored and targeted preventative measures for the conditions and contexts experienced by older populations which increase the likelihood of cybercrime victimisation, repeat victimisation and their consequences. There is, to our knowledge no previous study investigating the relationship between age and cybercrime risk and impacts in a national sample. We aim to explore how victimisation, repeat victimisation and financial impact are associated with age and other sociodemographic characteristics, and whether these relationships are influenced by economic and health-related factors and behaviours. We selected CSEW variables that represent four of Burton et al.’s [8] core cybercrime victimisation risk factors in older adults: health vulnerabilities, memory loss, social isolation, and wealth.

BH planned the study, analysed the data and wrote the paper. KT, AB, SM and CC contributed to the planning of the paper, the intellectual content and revised the manuscript. SM provided quantitative and survey expertise.

Materials and methods

Measures

Outcome measures.

Cybercrime is defined using the ONS classification of cyber-related fraud and computer misuse, which mimics Home Office Counting Rules [26] for recorded crime. Interviewers ascertained whether an offence was ‘cyber-related’ by asking the participant “thinking about the incident as a whole, was the internet, any type of online activity or internet-enabled device related to any aspect of the offence?” [27]. Computer misuse offences include unauthorised access with intent to commit or facilitate commission of further offences (e.g. hacking into someone’s social media account in order to obtain personal data). Examples of cyber-related fraud include romance and investment scams. Given CSEW data is collected face-to-face, any participant uncertainties should have been resolved by the interviewer. The dichotomous primary outcome was whether participants reported being a victim of cyber-related fraud and computer misuse at all in the last 12 months. Dichotomous secondary outcomes were: (a) whether the participant was a repeat victim of fraud and computer misuse. To determine this, participants were asked whether they were victimised by incidents of fraud and/or computer misuse–not necessarily the same modus operandi–more than once during the 12 months prior to interview. The reference category here was individuals who had not been victim of fraud or computer misuse at all in the past 12 months; and (b) whether a participant who had experienced any victimisation in the past year experienced financial loss as a result of that victimisation.

Exposure variables.

We included sociodemographic variables; and variables that reflect four of Burton et al.’s [8] seven risk factors: health vulnerabilities, memory loss, social isolation, and wealth. We were unable to include three risk factors–societal attitudes, scam content and cybersecurity skills or awareness–as the extent to which they are covered by CSEW variables is limited.

Sociodemographic/economic variables. We included age categorised in five bands: (16–24; 25–44; 45–64; 65–74; 75 and over); gender; and self-reported ONS harmonised ethnicity, reported in five categories (Table 1). We measured area deprivation using Indices of Multiple Deprivation (IMD). This combines information from seven domains (income deprivation; employment deprivation; education, skills and training deprivation; health deprivation and disability; crime; barriers to housing and services; and living environment deprivation). The resulting scores are translated into ‘Lower-Layer Super Output Area’ (LSOA: small geographical areas of approximately 1500 residents) deciles within the survey, which we converted into quintiles. We included tenure type, number of household members, hours spent away from home per weekday, and participant’s most recent occupation.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 1. Sociodemographic characteristics of the sample and multivariate associations with cybercrime victimisation and repeat victimisation.

https://doi.org/10.1371/journal.pone.0314380.t001

Health variables. All health variables were self-reported. The first, ‘status of health in general’, was answerable with: ‘Very good’; ‘Good’; ‘Fair’; ‘Poor; and ‘Very poor’. Participants were asked to self-report the “presence of physical or mental health conditions or illnesses affecting the following areas”: vision and hearing (here, grouped as ‘sensory conditions’); mobility, dexterity, stamina or breathing or fatigue (grouped as ‘physical conditions’); learning or understanding or concentrating, and memory (‘cognitive conditions’); and lastly, mental health and ‘socially or behaviourally’ (‘mental conditions’).

Analysis

All analyses were performed using Stata 17. Where participants answered ‘don’t know’ or ‘not applicable’ or refused to answer a question, the data was treated as missing. We excluded participants who stated that they had not accessed the internet in the last year. We weighted data using the calibration weighting variable developed for the original CSEW survey design, designed to make adjustments for known differences in response rates between different age and gender sub-groups [28], and report actual numbers and weighted percentages throughout.

We used standard summary descriptive statistics to characterise the sample (Table 1). In line with our aim to test how risk of cybercrime victimisation and repeat victimisation might be associated with age and health and social variables, we first investigated univariate associations of the exposure variables with primary and secondary outcomes (Table 1). Then, in two multivariate logistic regression analyses, we conducted forward stepwise logistic regressions with victimisation and repeat victimisation as the dependent variables, in which we entered variables in the following order: (1) sociodemographic and socioeconomic measures, (2) health measures.

To explore the association between age group and financial loss associated with cybercrime victimisation, we conducted a logistic regression with experience of financial loss as the dependent variable and age group as the independent variable (Table 2). For this analysis, we restricted our sample to people who had reported any cybercrime victimisation in the past 12 months; and investigated the proportion of respondents who had, and who had not reported related financial loss. Those not answering this question were excluded.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 2. Financial loss summary statistics and univariate analysis.

https://doi.org/10.1371/journal.pone.0314380.t002

Results

Discussion

Cybercrime victimisation was less common with older age, as would be expected, because younger demographics continue to spend more time online, increasing their exposure to online threats [29]. In addition, older adults are more likely to engage in online guardianship behaviours such as using anti-virus software [29]. People aged 75+ were most likely to experience repeat victimisation and financial loss. It might be, given that cases experienced by older people were more serious in nature (i.e. likely to involve financial loss and repeat victimisation) that they were the tip of the iceberg, and indicative of under-disclosure of cybercrime by older people to survey interviewers. Burton et al. [8] theorise, based on existing literature, that older adults may not disclose their victimisation due to feelings of shame, embarrassment, and fear of not being taken seriously or victim blaming. This could also reflect lower awareness of scams and reporting options in a generation adopting technologies that they did not use during their working lives, and therefore greater vulnerability to further victimisation.

We found that men are more likely to experience victimisation and repeat victimisation than women. A plausible explanation is that men, who have been found to take more risks than women generally [30], may also engage in riskier behaviour or activities online, leaving them more vulnerable to malicious actors.

Black and mixed/multiple ethnicities were more likely to be cybercrime victims than participants of White ethnicity. Research on the drivers behind ethnic disparities in crime victimisation in the UK and abroad is limited. Salisbury and Upson’s crime survey analysis found that people of Black and minority ethnicity are more likely than White people to fall victim to crime in general. Future research might explore differing patterns and types of internet use, and systemic disadvantages, for example linguistic barriers to safe cyber navigation.

Our findings suggest a complex relationship with socioeconomic status, as those in professional and managerial occupations are more likely to experience cybercrime. A plausible explanation, consistent with LRAT, could be that professional and managerial occupations involve greater internet usage.

Worse cognitive, physical, mental and general health were associated with greater risk, across the ages. This relationship is likely to be bidirectional as poor health might increase the risk of cybercrime [31] and being a victim of cybercrime may worsen mental health [32].

Potential interventions to reduce under-reporting might include awareness-raising among police and financial institutions, and training and review of reporting procedures to ensure they are appropriate for all age groups. There may also be scope for incorporating cybersecurity-related assistance or education into health and social care services, and increasing multiagency collaboration and information sharing with police. Staff may benefit from education and training around victimisation indicators, cybercrime reporting process and safeguarding protocol. Given that victimisation was associated with physical and cognitive impairments; software professionals might consider how online platforms and their security features and offerings can be more inclusive.

Conclusion

Older adults may also be less able than younger adults to avoid repeat victimisation and financial loss, and may also be under-disclosing less serious victimisation (that does not involve repeat offences or financial loss) relative to younger adults in the CSEW, possibly mirroring a lower propensity to report cybercrime to the police, bank, or other authority. Future developments in platform and process design, as well as multi-agency collaboration and information sharing, should focus on empowering older adults to detect fraudulent activity before loss is incurred, and removing barriers to reporting.

Supporting information