Money might be the motivator behind the great majority of online scams, but Professor Monica Whitty at Warwick University is leading a project to unpack the psychology behind the crimes – and she says understanding humans is critical to understanding cybercrime itself.
"The number of people defrauded by mass marketing is higher than the number of people whose houses are broken into in the UK," Whitty says, speaking with Techworld. "Understanding the human element is crucial."
Whitty leads an initiative called Detecting and Preventing Mass-Marketing Fraud (DAPM) at the University of Warwick which combines psychological expertise with the data-crunching nous of computer scientists, including co-researchers from Cardiff University, Lancaster University, and UCL.
DAPM aims to isolate each of the parts that constitute a successful mass marketing scam, on both psychological and technical lines, while examining the behaviour of both the victim and the perpetrators.
Ultimately the researchers hope to develop software able to spot fraudulent behaviour within email, social media and dating websites and, at the same time, educate the public to the dangers of online fraud in a meaningful way.
"Understanding the human is so important to the success of these criminals, and being able to persuade and trick victims into sending money," Whitty says. "Something that looks, from an outsider, to be quite silly – if you understand the internet and how people behave online, and how people set up profiles that look authentic and say things that seem genuine, you can then understand the success of these scams."
The DAPM project is working to find insights into how people behave online and why this has led to them being tricked, as well as finding anomalies in communications from scammers compared to those from regular internet users. It's hoped that it will be possible to pick up subtleties in communication that might otherwise go unnoticed.
"Without the psychology of understanding why people trick and deceive they can't really do that very well, so we need to work together," Whitty says.
According to Whitty, the internet allows criminals to apply pressure on their targets in a way that's unique compared to more traditional fraud.
"You can put pressure on people to respond very quickly online, so mass marketing fraud works where people act often impulsively and so that's how they're tricked," she says. "They look at a little bit of information, they believe that's genuine and real, and they respond very quickly."
Recent figures from the Office for National Statistics show that fraud is far and away the most prevalent type of cyber crime. In 2015, the ONS included cybercrime in its annual Crime Survey for England and Wales for the first time – and despite the tendency for under-reporting in online crimes, there were 2.46 million recorded incidents in total.
Whitty notes the prevalence of a particularly insidious type of cybercrime, which has been the subject of her research for a number of years – the romance scam.
People who have lost houses will still talk about the psychological impact of losing that relationship
While most of us would like to think we are impervious to romantic advances from a total stranger, the reality is that many people are more vulnerable than they think, especially when dealing with experienced scammers. There have been countless headlines about people who were duped into sending money to fictitious love interests, but this has done little to nullify the reach of the scams.
"A romance scam is where a relationship is built with a criminal online, but the victim thinks they're an authentic person," says Whitty. "The criminal will spend a lot of time grooming that individual, and developing what seems like a trusting relationship with them."
"It may be several months, it might be a couple of weeks, but they start to ask for money," she says. "These victims are then defrauded for large amounts of money. There's a large psychological pain and hurt associated with these crimes – people who have lost houses will still talk about the psychological impact of losing that relationship, which is equally, if not more, significant."
"That's a really good example of understanding how relationships develop online: how is it that they can get so close without meeting someone physically? How is it that you develop a profile that looks authentic and communicates in a way that seems genuine, and then go on to trick so many people out of money?"
Mirroring the evolution from phishing to spearphishing, the methodology of the scammers began with a shotgun approach, but now tends to be more targeted as dating sites limit the amount of messages that can be sent daily.
Whitty explains that when the scams first became prevalent, men were more prone to be victims. But as time has gone on what became clear was that every demographic is vulnerable, to a degree.
"We were finding such a huge range of individuals," Whitty says. "We found that more educated people are more likely to be scammed – just being aware of this doesn't necessarily protect you from criminals who are very clever at tricking and grooming individuals."
Just as online trolls tend to throw social conventions out of the window, there is likely to be a disconnect when fraudsters manipulate their targets.
"To some extent there is that disinhibition effect, you can have less empathy for that person and not understand how they feel," Whitty says. "But at the same time I don't think you can blame the internet for these particular criminals, you have to very clearly blame them, because the victims tell them such deep, intimate information about themselves."
"These criminals psychologically don't have a lot of empathy, so they may be more psychopathic than ordinary people to be able to do this," she says. "The internet just enables them to be able to do this and develop trust – I don't think they do it because they don't see the pain."
"I theorise about that, and it looks to me that they're able to bracket their emotions quite separately from their victims and feel nothing for them. It takes a certain type of person to be able to do that, as with any criminal behaviour."
But Whitty hopes that the work she and her co-researchers are doing will be able to disrupt the scammers, long-term.
As well as the team's work in trying to fundamentally understand both perpetrator and victim, Whitty believes there needs to be a solid drive towards education in online behaviours.
"That means developing steps that we feel comfortable with, without terrifying individuals," she says. "If you raise anxieties too much people won't change their behaviour. You need to help them find ways that help them behave in a safer manner."
"The more research I do, the more I find people often don't have a clue as to what they ought to be doing," she says. "And they think they're doing the right thing – only to find out that, no, you've given out your identity."
"So we need to be able to communicate that better and help people change their behaviours online. Just saying ‘here's a crime, beware' doesn't necessarily protect people. We need to develop better educational programs, and that's something we're trying to do here."