Con artists have been scamming victims for centuries. However, because the internet allows criminals to target many more victims, in the last 10 years we have witnessed scams on a global scale. In the UK in 2016, it was reported in the National Crime Survey that citizens are 10 times more likely to be robbed while at their computer by a criminal based overseas than to fall victim of physical theft (Office for National Statistics, 2016). In my work in the Cyber Security Centre at the University of Warwick, WMG, I have been leading inter-disciplinary projects that attempt to understand the psychology of scams and find effective methods to detect and prevent them. In particular, we have focused on mass-marketing frauds (MMFs).
Not all readers will be familiar with the term MMF; however, most would have encountered at least one of these in their lifetime. MMF is a serious, complex and organised crime. Examples include foreign lotteries and sweepstakes (in which the victim believes they have won money from a lottery and are told to pay a fee in order to release the funds); ‘419’ scams (advance-fee fraud, in which victims believe that for a small amount of money they will make a large fortune); and romance scams (taken in by a fake online dating persona, in which the victim sends the fake persona money). Some MMFs are low-value, one-off scams on large numbers of victims, whilst others involve developing a relationship (e.g romantic, business, friendship) where money is defrauded over time, again with simultaneous or sequential victims.
Victims of MMF suffer both financial losses and psychological impacts; with the latter sometimes outweighing the former, even when large sums of money are lost. One of our motivations to investigate this particular cyber crime is the severity of this psychological harm – in some cases victims have been known to commit suicide. Common reactions to being scammed include shame, guilt, embarrassment, depression, grief, anxiety and loss of trust.
Catching and prosecuting MMF criminals is difficult, for three main reasons. Firstly, the criminals often live in a different country to the victims. Secondly, the methods they use make them difficult to trace, and thirdly, prosecution is very time-consuming, owing to the large amounts of online data that need to be analysed to establish evidence.
Although disruption tactics are important, we have taken a more victim-oriented approach to protect users from MMF. Our work has involved interviewing victims of MMF to gain a greater understanding of why they believed they were tricked and persuaded to give money to fraudsters as well as to map out the anatomy of these scams.
In my work, I have argued that criminals are able to exploit the media they are communicating within to develop hyper-personal relationships with victims (especially victims of a romance scam). Communicating in online spaces can potentially isolate victims from friends and family to allow the criminal to become the dominant person in the victim’s life. A synchronous and long-distance communication in the form of emails, texts and instant messenger allows criminals to be very strategic in the stories they create and the messages they send, creating the perfect online lover. In fact, many of the victims of romance scams that I have spoken to find it difficult to delete messages and photographs sent by the criminal, even after it has been revealed to them that they have been deceived.
We have also researched the victimology of different types of scams, considering demographic as well as psychological factors. Our research is finding that different types of people are susceptible to different types of scams. Many romance scam victims, for instance, have been found to be middle-aged, educated women who score highly on psychological measures such as impulsivity, addictive disposition and trustworthiness.
One of the novel methods we are currently researching to detect and prevent MMF involves a team of computer scientists: Professor Rashid, Dr Stringhini, an expert in human-computer interaction; Professor Sasse, a criminologist; Professor Levi; and a philosopher, Professor Sorell. The work we are undertaking involves developing a proof-of-concept automated agent to identify communication with a potential scammer and hoping to do so prior to the ‘sting’ taking place. The agent will need to make decisions about the probability of a victim communicating with a scammer by drawing upon their personal data.
One of the challenges in our research is the human element. MMFs, unlike phishing or even spear phishing, are especially a challenge to detect because they typically involve communication with another person, rather than a bot – this means that scripts can vary and are more complex. Often the criminal is developing a relationship that appears authentic to the users (romantic, friendship, working relationship) over a long-period of time prior to asking for money, and they can vary the communication when a user demonstrates a lack of trust. They can also use multiple media channels to communicate with the user.
The research being undertaken in our project is drawing from psychology, media and communications, criminology and linguistics to help identify deception and persuasive communication, and evidence of the “grooming” often found in MMFs. We are also interested in identifying the online identities, other communication and online behaviours typical of scammers as well as victims. By examining socio-technical features such as the use of the same profile photographs, descriptions across multiple profiles and patterns of interaction and contact with other users (e.g. login times), we can help to spot MMF earlier.
Importantly, we will be considering the ethical and social challenges associated with detecting and preventing MMF. For example, questioning the ethics of drawing in personal data from genuine and disingenuous people to assist in decisions regarding the identity and authenticity of another user. Moreover, we are interested in considering the ethics involved in how we ought to treat victims who cross the line and knowingly become “money mules” in order to recoup their losses. Should they also be treated as criminals?
As we produce papers we will present our latest findings on the DAPM website, and we are looking for volunteers to help us with our research. If we’re successful, we hope prevent some of the most damaging and upsetting cyber crime.
Content from our partners
Related
