Victims of cybercrime in Europe: a review of victim surveys

Carin M. M. Reep-van den Bergh; Marianne Junger

doi:10.1186/s40163-018-0079-3

Research
Open Access
Published: 04 April 2018

Victims of cybercrime in Europe: a review of victim surveys

Crime Science volume 7, Article number: 5 (2018) Cite this article

11k Accesses
5 Citations
18 Altmetric
Metrics details

Abstract

Objectives

Review the evidence provided by victim surveys in order to provide a rough estimate of the personal crime prevalence of the main types of cybercrime.

Methods

We performed a search in databases, searched online, and contacted several Offices for National Statistics in Europe and selected surveys that provided information about individual victims of crime which were representative for a general population. Six types of cybercrime have been distinguished, namely online shopping fraud, online fraud banking/payment, other cyber fraud (such as advanced fee fraud), cyber threats/harassment, malware, and hacking. For every survey the questions on cybercrime are presented and the crime prevalence estimates are compared.

Results

Nine surveys were included. Annual crime prevalence rates ranged from 1 to 3% for online shopping fraud, from less than 1 to 2% for online banking/payment fraud. Less than 1% of the population is a victim of other types of fraud and a maximum of 3% of the population experiences some sort of online bullying such as stalking (1%) or threatening (1%). 1–6% is a victim of hacking. The estimates for being a victim of malware range from 2 to 15%. For all offences it cannot be estimated how much of the differences are due to variation in methods and questioning between the studies or real differences between countries or change over time.

Conclusions

As yet there have been very few well performed randomised sampled studies on cybercrime amongst the general population. Cybercrime prevalence (and its trend) can only be well measured if the questions are frequently updated and adequately address new aspects of cybercrime. To adequately monitor cybercrime in the future it is advisable to develop some fairly abstract main categories that are of durable validity, whilst allowing for up-to-date illustrations. Furthermore, ideally the questioning in the ongoing surveys in the different countries should be standardised and there should be a uniform categorisation of the different cyber offences. A screening question in order to permit more accurate dating is essential to reduce telescoping bias. Surveys should ask about the impact on or damage to the victims.

Background

The world is online, and this also applies to criminals. With the growth of the internet, new crimes emerged that have been labelled cybercrime (Bregant and Bregant 2014; Jang-Jaccard and Nepal 2014; Jewkes and Yar 2010; Newman 2009; Reyns et al. 2014; UNODC Intergovernmental expert group on cybercrime 2013; Wall 2007). Knowing that half of the world population nowadays is online (Internet World Stats 2017), we know that half of the world population is at risk of becoming a victim of a personal cyber offence. What we do not clearly know is what fraction of the population has actually been a victim of this type of crime.

‘Cybercrime has climbed to the top tier in the National Security Strategy of many EU states.’ (Armin et al. 2015, p. 135). Armin et al. (2015) also state that ‘Governments need reliable data on crime in order to both devise adequate policies, and allocate the correct revenues’ (Armin et al. 2015, p. 135). But at present official statistics on cybercrime suffer from important problems. Anderson et al. (2013) conclude that ‘There are over 100 different sources of data on cybercrime, yet the available statistics are still insufficient and fragmented; they suffer from under- and over-reporting, depending on who collected them, and the errors may be both intentional (e.g., vendors and security agencies playing up threats) and unintentional (e.g., response effects or sampling bias).

Cybercrime is a broad and imprecise concept (UNODC Intergovernmental expert group on cybercrime 2013). Often three broad categories of cybercrimes are distinguished (Wall 2005). First, crimes against computers imply the unauthorized access of the boundaries of computer systems such as cyber-trespassing or hacking/cracking, where the computers are the focus of the attack. Examples include computer viruses, denial-of-service attacks, and malware (malicious code). Second, crimes using computers, often referred to as ‘cyber-enabled crime’, are crimes that use Information and Communication Technology (ICT) to commit a crime, such as identity theft, phishing scams and the fraudulent use of credit cards online. Third, crimes ‘in’ computers, where criminal content is the crime. Examples of main content-related cybercrimes are pornography, threats of violence and terrorism (Wall 2007). In practice, this distinction can be imprecise: a phishing mail can be used to seduce users to click on a link to steal information, which is ICT as a modus operandi, but also installing malware, which is a computer integrity offense. At present there is no universal agreement on a classification of types of cybercrime (Gordon and Ford 2006; Reyns et al. 2014; Stol 2012).

Although there is no universal conceptualisation of the different forms of cybercrime, we first describe briefly a number of major forms of cybercrime that have been measured by some victim surveys.

Online shopping fraud

Online shopping is characterized by the inability to inspect merchandise before purchase, and/or a lack of direct contact between the parties involved in the sale (Moons 2013; van Wilsem 2013a). Accordingly, consumers are at higher risk of fraud than in face-to-face transactions. When ordering merchandise online, the item may not be delivered, the item may not work or it might not be the same item as in the online photo. Merchants also risk fraudulent purchases if customers are using stolen credit cards (Enisa 2010; Moons 2013; van Wilsem 2013a).

Online banking fraud and payment

Online banking fraud occurs when the fraudster gains access to, and transfers funds from, an individual’s online bank account. In some cases, an individual may be duped by a criminal into making a fraudulent money transfer themselves (FFA 2016). Online banking fraud can start with a phishing mail that directs users to a fraudulent website where he has to fill in login information or that installs malware on a computer which then steals login information (Brody et al. 2007; Milletary and Center 2005).

Other cyber fraud

This comprises for instance advanced fee fraud and identity fraud (Enisa 2010). The scam typically involves promising the victim a significant share of a large sum of money, in return for a small up-front payment, which the fraudster requires in order to obtain the large sum (Enisa 2010).

Identity theft is the deliberate use of someone else’s identity, usually as a method to gain a financial advantage or obtain credit and other benefits in the other person’s name and to the other person’s disadvantage or loss (Enisa 2010; Harrell and Langton 2013; Tuli and Juneja 2015). Identity theft occurs when someone uses another’s personal identifying information, like their name, identifying number, or credit card number, without their permission, to commit fraud or other crimes. The person whose identity has been used may suffer adverse financial and/or emotional consequences if they are held responsible for the perpetrator’s actions (ITRC 2014).

Cyber threats/bullying

Cyberbullying is bullying that takes place using electronic technology (Kowalski et al. 2014; Nansel et al. 2003; Wachs et al. 2017). Children who are being cyberbullied are often bullied in person as well (Wachs et al. 2017). Additionally, kids who are cyberbullied have a harder time getting away from the behaviour. Cyberbullying is different from traditional bullying is a number of ways. First, cyberbullying can happen 24 h a day, 7 days a week. Second, cyberbullying messages and images are often posted anonymously and they can be distributed quickly to a very wide audience. Third, deleting inappropriate or harassing messages, texts, and pictures is extremely difficult after they have been posted or sent (Stopbullying.gov 2017).

Malware

Malware (short for malicious software), is an umbrella term used to refer to a variety of forms of hostile or intrusive software, (1) including computer viruses, worms, Trojan horses, ransomware, spyware, adware, scareware, and other malicious programs. It can take the form of executable code, scripts, active content, and other software (Aycock 2006).

Hacking or computer intrusion

A security hacker is someone who seeks to breach defences and exploit weaknesses in a computer system or network in order to get into the system. Hackers may be motivated by a multitude of reasons, such as profit, protest, information gathering, challenge, recreation, or to evaluate system weaknesses to assist in formulating defences against potential hackers (Bachmann 2010; Conteh and Royer 2016).

At present reliable statistics about victims of cybercrime are rare (Cliff and Desilets 2014; Leukfeldt 2017; Lynch 2006), although crime statistics are important for policymakers. A commission of the UK government (Smith 2006) listed several reasons why a nation needs crime statistics at a national level:

1.
to provide reliable quantitative measurements of criminal activity and trends that enable the parliament to fulfil its democratic function of holding the government of the day accountable for this aspect of the state of the nation;
2.
to keep the public, media, academics and relevant special interest groups informed about the state of crime in the country and to provide (access to) data that inform wider debate and non-governmental research agendas;
3.
to inform relevant aspects of short-term resource allocation, both within government and also for external related bodies—e.g. for policing and victim support;
4.
to inform performance management and accountability at the national level of agencies such as the police;
5.
to provide an evidence base for longer-term government strategic and policy developments.
6.
We would add the importance in applying pressure on the designers and operators of ICT systems, software applications, etc. to design and manage their products in such a way as to reduce opportunities and provocations for crime; and in providing reliable and valid data which can be used in time series analysis and impact evaluations of preventive efforts.

The two main sources of statistics about victim prevalence are self-report victim surveys and police registrations. The present study focuses on victim surveys. Victim surveys have been of increasing importance for crime statistics since their development in the nineteen-seventies (Hough et al. 2007; Rand 2007). They have profoundly affected knowledge and theories about crime (Cantor and Lynch 2000; Hough and Maxfield 2007). Victim surveys provide information on the amount of crime and on the trends in crime, independent of the reporting behaviour of victims and recording practices by the police, and this was the main motive for developing them (Cantor and Lynch 2000; Hough et al. 2007; Lynch 2014; Rand 2007). Police recorded figures cannot assess historical changes as the willingness to report a crime by the victims and the methods of recording by the police differ over time (Lynch 2014; Wittebrood and Junger 2002). Victim surveys have been important to the study of crime in other ways as well: they led to the creation of new ways of classifying crimes, they were important in the research into opportunity and routine activities approaches (Cohen and Felson 1979; Wortley and Mazerolle 2008), they provided new information on contact crimes and they provided information on the consequences of becoming a victim (Cantor and Lynch 2000; Gottfredson 1986; Lynch 2014). Finally, victim surveys are the best method for international comparisons of crime rates (Aebi et al. 2002; Dijk 2007; Messner and Zimmerman 2014).

Of course victim surveys also have their limitations.

1.
Because becoming a victim of crime is relatively rare, large samples are needed and this makes victim surveys labour intensive and relatively expensive (Maxfield et al. 2007; Rand 2007).
2.
This cost aspect is exacerbated by the fact that response rates have been declining, whether they are conducted face-to-face, by telephone or online (Maxfield et al. 2007; Rand 2007).
3.
Sampling frames can be a problem. Most surveys focus on ‘households’, and, accordingly, they miss certain categories of people, e.g., the homeless and people in institutions. In some countries these categories became an increasing part of the population, for instance in the UK (Maxfield et al. 2007).
4.
In previous research, several methodological choices and survey characteristics have been shown to be related to the estimates of crime prevalence (Addington 2008; Eckberg 2015; Powers 2015; Schneider 1981; Skogan 1986; Tourangeau and McNeeley 2003):
- The wording of the questions is important. The wording has to be clear and easily understood, and not open to different interpretations. The questions should measure very precisely what the survey wants to know. A very important aspect in these is the correct dating of the offences. In order to prevent telescoping bias a survey should include a kind of ‘screening’ question that asks about crime prevalence in a longer period, preceding the actual question that asks about the period of investigation. Victims can tell their story even if the crime happened outside the required timeframe. Recent research showed that the exclusion of such a screening question led to high telescoping (Reep 2013a, 2014). Telescoping results in an overestimation of crime prevalence.
- It has been proven that the mode(s) that have been chosen to collect the data influence the results (Schouten et al. 2013). Interviewer-guided questionnaires can go into more detail and interviewers can clarify questions if needed. However, victims might be reluctant to share their story with an interviewer as well, since they may feel ashamed or the perpetrator might be close by. Self-administered questionnaires are cheaper and allow access to more respondents, but there is little control of how questions are interpreted.
5.
Another important topic is any possible self-selection bias. It is likely that people that have affinity to the subject of a questionnaire, for instance because they have been a victim of crime, respond to a victim study more readily than those who have not. An over-representation of victims in a victim survey will result in an overestimation of crime prevalence, unless this is corrected for by weighting the data. Recent research (Reep 2014) showed that victims of online shopping fraud who reported the offence to the police responded more often to the victim survey than those who have not been a victim. This was not the case for victims of other computer crime (in this case mainly hacking) (Reep 2014). Other research showed that victims of cybercrime participate earlier during the fieldwork (faster or need less reminders) than those who were not victims (Reep 2013b). An intensive reminding process that results in a higher response rate will reduce the self-selection bias and increase the validity of the estimates.
6.
The types of the crimes included in most victim surveys is limited. Surveys should be suitably brief in order to keep people willing to respond. This however results in a limitation to the detail in questioning about the crimes.
7.
Finally, with the increasing digitalization, the nature of crime has been changing and cybercrime has been included only recently in a number of national victim surveys (Armin et al. 2016; Kanich et al. 2011; Maxfield et al. 2007). Victim surveys necessarily tend to be stable over time. The nature of cybercrime however has been rapidly evolving. There has not been much experience on how to formulate questions for the most common types of cybercrime(s). This makes it hard to get accurate figures that are comparable over time and over countries.

The present study’s goal is to present the prevalence of cybercrime in Europe. To that end our aim was to select victim surveys of general populations that measured cybercrime. Accordingly, we provide a qualitative and quantitative comparison of how cybercrime has been measured in Europe and give an overview of the main prevalence rates.

Methods

Study selection and inclusion criteria

To select relevant victim studies for the present review the following set of inclusion criteria have been used.

First, the methodology of the study had to be clearly described, and insight in the questionnaire had to be given so that the results could be properly evaluated.

Second, the survey had to be based on a large statistically random selection of (people living in) private households, in order to produce results representative for a country.

Third, a weighting procedure had to be performed in order to produce representative results.

Fourth, the study needed to present crime prevalence rates over a clearly defined period so that annual crime prevalence rates could be calculated.

Fifth, figures had to represent the period since 2010. This year was chosen for practical reasons and to increase the likelihood that surveys would provide figures over the same time period that would allow comparisons of trends, as most surveys were of relatively recent date.

As the use of the internet has grown in the last 20 years this will influence the prevalence rates for cybercrime. For example, ten years ago online shopping was less common than it is today which results in less victims of online shopping fraud.

Sixth, at least one specific type of cybercrime is explicitly measured, not ‘cybercrime’ as a global concept.

We already knew about the existence of three surveys that have measured aspects of cybercrime in the Netherlands and about the crime survey for England and Wales. To find other victim surveys we first searched through library databases of Twente University^{Footnote 1} and in Scopus. The following search keywords were used: ‘victimization’ and ‘cybercrime’ and ‘survey’. This provided 35 hits. None of these however could be considered to be a crime survey on representative samples in Europe and did fit our criteria on adequate measurement layout above.^{Footnote 2}

In a next step we searched with internet search engines to find surveys. This resulted in a few articles about the prevalence of cybercrime, only one of which fulfilled our inclusion criteria. We knew that large population surveys are generally executed by governmental institutes that usually publish only on the governmental websites in their own language.

This led to us searching for grey literature. We contacted statistical institutes (hereafter ‘institutes’) which were known to have executed victim surveys and asked them directly what they have measured in the field of cybercrime. We contacted institutes in Sweden, Germany, Luxembourg, France, Norway, Belgium, Austria, Latvia, Portugal, Finland and Poland. Some institutes did not conduct victim surveys at all anymore, some did not include cybercrime and some provided extra figures for this survey. From other European countries, to the best of our knowledge, we knew that there were no population victim surveys. It is possible that we overlooked some surveys.

Classifying cybercrime and estimating its prevalence

There is no existing clear classification, stable over time that captures all possible old, new and possible future types of cybercrime. In this survey the following six types of cybercrime are distinguished. These types of cybercrime are operationalised by the questions as they were presented to the respondents.

Online shopping fraud All questions mention that online shopping fraud refers to fraud as a result of buying or selling goods online. Only the Swedish questionnaire is different. In the Swedish study the question runs: ‘cheated out of money or other valuables’ online. If this occurred by the use of ‘bank card or a bank account’ this was classified as ‘online banking fraud’, otherwise, it was considered to be ‘online purchase fraud’.
Online fraud banking/payment All questions on online fraud banking/payment refer to money disappearing from bank accounts. However, the CSEW (United Kingdom) does not explicitly mention this description but asks whether the respondent noticed that ‘personal information or account details (had) been used to obtain money, or buy goods or services without your permission or knowledge’(Office for National Statistics (ONS) 2015, p. 26) which is less explicit.
Other cyber fraud (such as advanced fee fraud and other identity frauds) Fraud is a very broad category(National Fraud and Cyber Reporting Centre 2016). The CSEW (United Kingdom) asks questions about identity theft (for instance: the use of a victim’s personal details to make an application, e.g. for a mortgage), fake investments, or sending money to someone ‘who turned out to be not who they said they were?’. A similar approach was used in the ODW (The Netherlands).
Cyber threats/harassment Most questions refer to receiving threatening messages. However, the ODW (The Netherlands) asks about stalking with the explicit reference to ‘repeated harassment’.
Malware All questions on malware explicitly mention having a ‘virus on your computer’, with the exception of the WISIND (Germany) question, which is more general and asks if one’s devices have ‘been infected with malicious software’.
Hacking The questions on hacking are formulated in several ways. In the CSEW (United Kingdom) it consists of ‘stolen information from your device’. The VM (The Netherlands) asks if ‘someone—with malicious intent—broke into or logged on a computer, e-mail account, website or profile site?’, The ODW (The Netherlands) asks about altering web-content, stealing or altering data on a device, breaking into your email account. Surveys specifically exclude answers in the case hacking was the modus operandi for financial fraud or cyber threats/harassment. Thereby, in principle, they avoid possible double counts with other types of fraud. Similarly, surveys ask about incidents that ‘were not mentioned previously’, also to avoid double counts.

Ideally there should be an indication about the severity for every offence type, for example a division into whether or not the incidents resulted in any harm or loss or distress. This review provides information if the surveys include any such measurements, but do not break down the figures in amount of harm.

The estimates in this review on the prevalences are given for all categories of cybercrime. The published estimates are presented in Additional file 2: Appendix S2. If the survey only provides estimates for the online population, the estimates are adjusted to cover the whole population by multiplying the estimate with the fraction that uses the internet. If the study period exceeds 12 months, the prevalence is adjusted to cover only 12 months. And if only total figures for a crime type are published with the fraction that is cyber related, the cyber related estimate is calculated. The resulting prevalences are presented in 6 figures, one for each crime category. All prevalences relate to the total non-institutionalized population.

Given that this study is based solely on secondary data, we did not need the approval of an ethical committee.

Results

The institutes in Norway, Belgium, Austria, Latvia, Portugal, Finland and Poland did not have usable information for us. The following nine surveys meet our strict inclusion criteria and are included in this review:

1.
NTU—Nationella trygghetsundersökningen, conducted by The Swedish National Council for Crime Prevention (Brå) (Brå 2016).
2.
CSEW—Crime Survey for England and Wales, conducted by the Office for National Statistics (Office for National Statistics (ONS) 2017).
3.
VM—Veiligheidsmonitor, conducted by Statistics Netherlands (CBS 2017; Statistics Netherlands 2013, 2017).
4.
ODW—(on)veiligheid in de digitale wereld, a one-off (Domenie et al. 2013) (ODW is not an official abbreviation).
5.
ITN—ICT gebruik van huishoudens en personen, a one-off (CBS 2015; Eurostat 2016) (ITN is not an official abbreviation).
6.
WISIND Projects, a one off (Rieckmann and Kraus 2015).
7.
DV—Der Deutsche Viktimisierungssurvey, conducted by the Max-Planck-Instituts für ausländisches und Internationales Strafrecht (Birkel et al. 2014) (DV is not an official abbreviation).
8.
CVS—Cadre de Vie et Sécurité, conducted by the Institut National de la Statistique et des Études Économiques (INSEE) in France (ADISP 2015).
9.
ES—Enquête sur la Sécurité 2013, conducted by the National Institute for statistics and economic studies of the Grand Duchy of Luxembourg (STATEC 2015) (ES is not an official abbreviation).

As the estimates probably rely more on the methods of data collection than on the country we choose not to refer to the surveys by name of the country in which they are conducted. In this review the surveys are referred to by their abbreviation as given above.

Main characteristics per survey

The main design features of each selected study are presented in Table 1. All surveys are based on a large random selection of (residents in) private households. Most surveys are led by an interviewer, 4 by telephone and two face-to-face. Three surveys, all of them from The Netherlands, use a mixed mode design in which one of the modes is online. The response rates of the NTU and CSEW are very high, but we do not know exactly how this is measured, for instance, we do not know if framing errors such as ‘wrong address’ are excluded as being non-response. The response rates of the WISIND and DV are relatively low which implies that these surveys might suffer from selection bias. Most surveys only include the population of around 15 years and older. The NTU was the first that included any questions on a cyber component to the offence in the questionnaire, in 2006. Finally, the reference period in all surveys was 12 months, with the exception of the WISIND survey (Rieckmann and Kraus 2015) where it is 30 months.

Table 1 Survey characteristics

Full size table

Table 2 shows for each study the cyber offences that are covered. As we think it is important to include information on harm of any kind with statistics on cybercrime, this table also shows whether or not the study addresses any loss involved with the incident; financial, time or emotional. Only ODW, which was a one-off, asked questions about all seven types of cybercrime. Only the VM has included many types for a few years in a row. Most studies only ask about one or two cyber offences. Nearly all studies ask something about the loss or harm that was incurred by the crime. Most surveys measure the financial loss, only the ES survey also measured the emotional impact of every crime.

Table 2 Types of cybercrime that are covered in the questionnaires

Full size table

Additional file 1: Appendix S1 presents an overview of the questions by survey and type of cybercrime, questions in native languages have been translated into English. The crime prevalence estimates are based on these questions. As the measures on loss or harm are very diverse, only the questions where the respondent is asked if he or she is a victim of crime are presented. The NTU, the VM and the CVS have measured cybercrime for a few years now and kept the questions unchanged. The CSEW is conducted face-to-face and uses a very intensive approach. This makes it difficult to make a detailed analysis of the questioning. In addition some open questions are used to categorise offences. This is why the questions as provided in Additional file 1: Appendix S1 do not cover exactly all questions/information that are used to classify someone as a victim of the type of offence concerned.

As mentioned before the measurement of (cyber) offences closely depends on the wording of the questions. As shown in Additional file 1: Appendix S1, for online shopping fraud, banking fraud and malware most surveys use similar wording, however they are not exactly the same.

A correct dating of the incident is also important for a precise estimate of the prevalence in the reference period. The former mentioned screening question that covers crime prevalence over a long period is included by ODW, DV, ES and the CVS. The surveys that have been carried out repeatedly over a few years have kept the wording of the questions identical which normally gives a greater chance of providing correct trends.

The prevalence estimates as published or provided in the available reports or by respective researchers are presented in Additional file 2: Appendix S2. Some studies only presented figures for the online population, some covered a longer time frame and others only present the percentages of the overall crimes that are cyber related (see notes under Additional file 2: Appendix S2). Confidence intervals were only provided by the VM, ODW, DV and the ES. Additional file 3: Appendix S3 presents the figures as published/provided after adjustment for comparability (see method section) and so represent the estimated 12 months prevalence for the total non-institutionalised population. These figures are presented in Figs. 1, 2, 3, 4, 5 and 6 and in text below.