Police must become more involved in reimbursing money to victims of cybercrime in Scotland, according to University of Strathclyde research.
The study also recommends that, as a priority, Police Scotland should make clear to communities that it can be relied upon in cases of economic cybercrime.
Researchers surveyed 380 victims, including detailed interviews with 10 of them, and discovered a lack of faith in police which deterred many from reporting cybercrime. While there were 8,630 cases 2019-20, only 6.6 % of people who experienced bank detail theft, 2.1% of victims who received a scam email and 1.8 % of those affected by a phone call scam reported the incidents to the police. Some resolved the situation themselves by reporting it to their bank but many of these people assumed that banks would report the crime themselves after having reimbursed them.
Many of those interviewed were reluctant to report because they blamed themselves for the incidents. The researchers suggest that this could be a consequence of a ‘responsibilisation’ approach by Governments, in which citizens are given advice only on protecting themselves from cybercrime and often feel that responsibility for prevention lies solely with them, rather than jointly with the state.
The study concludes that, for police to improve relations with victims of cybercrime, it should work to raise awareness and reduce the stigma associated with being a victim, alongside a “deeper and more strategic alliance” with banks to reimburse lost funds.
The research has been published in the Journal of Economic Criminology.
Dr Juraj Sikra, a Research Assistant in Strathclyde’s Department of Computer and Information Sciences, and the lead author of the paper, said: “Solutions for cybersecurity largely rest on the shoulders of the civilian population and the private companies that supply the solutions, and citizens often don't have the knowledge of what is suitable.
A vulnerable person is more susceptible to cybercrime and they might stop engaging with the cyber domain entirely, because they don't feel safe. While there are limited resources, there needs to be emphasis on understanding that people who commit crime are very creative and we’re all susceptible to being victims of this.
“Police could form a more strategic alliance with banks at local level and assume more responsibility in awareness-raising campaigns. Dealing with this crime can increase the reporting of other crimes if it increases trust towards the police but cybercrime can be effectively mitigated only in a society that is socially interconnected, as it thrives where there is social isolation.
“Fighting cybercrime also presents new opportunities for international collaboration amid an increasingly fragmented geopolitical landscape. Countries which may not see eye to eye on political matters can be brought to collaborate on supranational issues affecting vulnerable populations.”
Due diligence
One of the victims the researchers spoke to was looking to buy a used car online. Despite practising extensive due diligence to verify an advertisement, the vehicle never arrived after he transferred £5240. He said the police “said absolutely nothing that was helpful,” except to direct him to the Action Fraud reporting centre. Furthermore, he claimed the Fraud Department in Scotland did not want to record the incident as a fraud, because they believed it technically happened in England.
In another case, the victim received a phone call, purporting to be from HMRC, alleging she had an outstanding debt. She called HMRC, which confirmed it had not called her, but she subsequently also received a letter claiming to be from the agency. She was advised to report the incident to the Fraud Squad, which in turn advised her to hand the letter as evidence to her local police; however, she ultimately did not do so, as she found the police station to be “unmanned” with no one on the desk.
Dr Sikra produced the research with his departmental colleagues, Dr Karen Renaud and Dr Daniel Thomas.