The New Technology of Financial Crime

New Crime Commission Technology, New Victims, New Offenders, and New Strategies for Prevention and Control

Donald Rebovich, James M. Byrne, Donald Rebovich, James M. Byrne

• Publisher: Routledge
• Year: 2022
• Print ISBN: 9781032192031
• eBook ISBN: 9781000630923
• Edition: 1
• Topic: Betriebswirtschaft
• Subtopic: Informatik Allgemein

Financial crime is a trillion-dollar industry that is likely to continue to grow exponentially unless new strategies of prevention and control can be developed. This book covers a wide range of topics related to financial crime commission, victimization, prevention, and control. The chapters included in this book closely examine cyber-victimization in their investigation of online fraud schemes that have resulted in new categories of crime victims as the result of identity theft, romance fraud schemes, phishing, ransomware, and other technology-enabled online fraud strategies. This book also offers new strategies for both financial crime prevention and financial crime control designed to reduce both offending and victimization. It will be a great resource for researchers and students of Criminology, Sociology, Law, and Information Technology.

The chapters in this book were originally published in the journal Victims & Offenders.

The Dynamics of Business, Cybersecurity and Cyber-Victimization: Foregrounding the Internal Guardian in Prevention

David Buil-Gil

, Nicholas Lord

, and Emma Barrett

ABSTRACT

Private organizations suffer great losses due to cybersecurity incidents, and they invest increasing resources to prevent attacks, but little is known about the effectiveness of cybersecurity measures for prevention. Based on the framework of Routine Activity Theory, this paper analyzes the impact of companies’ online activities and cybersecurity measures on victimization. Our analysis of the UK Cybersecurity Breaches Survey shows that the most promising ways to minimize cyber-attacks and their impacts is to invest in in-house cybersecurity human resources and enhance the employees’ online self-protection by providing cybersecurity training, rather than just basic software protection and guidance about strong passwords.

Introduction

The digital space and digital systems are core operating contexts for most businesses and their associated activities, whether entering into economic relations with customers purchasing goods and services, storing and sharing data, or undertaking commercially sensitive activities that involve confidential information (Office for National Statistics, 2019). As a result, one-eighth of the UK National Gross Domestic Product depends directly on the digital economy (National Audit Office, 2019). The digital space, however, offers many new opportunities for crimes, including frauds, that may be enabled by, or dependent on, Internet-connected systems. In 2017, the UK Annual Fraud Indicator estimated that frauds were responsible for £140 billion losses for the private sector, £40 billion losses for the public sector and £6.8 billion losses for individuals (Crowe, 2017), and a report published by the National Audit Office (2017) identified that more than half of all frauds were committed online. Other cybersecurity risks, such as malware and denial of service attacks targeting businesses, have also increased in recent years (National Cyber Security Centre, 2017). Given that the private sector is a primary target of cybersecurity attacks and suffers from the greatest economic losses, private companies are investing more resources every day to prevent cybersecurity threats (EY, 2019; Levi et al., 2015), but little is known about the effectiveness of these measures to prevent cyber-attacks (e.g., Bilodeau et al., 2019; Rantala, 2008; Richards, 2009; Williams et al., 2019).

Despite the considerable financial losses suffered by businesses as a result of cybersecurity attacks, criminological research has typically focused on studying cyber-victimization among individual citizens (e.g., Holt & Bossler, 2016; Leukfeldt & Yar, 2016; Marcum et al., 2010). This is likely to be due to the lack of available and reliable sources of data to examine cybersecurity attacks on businesses. To fill this gap in literature, this article analyzes the dynamics of online business activities, cybersecurity measures, and cyber-victimization. This article aims to illuminate which cybersecurity measures are effective in preventing cybersecurity breaches and attacks, and which measures are inefficient or ineffective. Based on the theoretical framework of Routine Activity Theory (RAT; Cohen & Felson, 1979) and considering the suitability of crime targets by their value, inertia, visibility, and accessibility (“VIVA”), this paper analyzes how certain online activities and protective measures implemented by organizations affect their likelihood of falling victims to cyber-attacks. Thus, the original contribution of this paper is to show the utility of RAT for understanding businesses’ victimization by cybersecurity attacks and breaches, and more specifically to foreground the internal guardian and personal self-protection as effective ways to minimize cybersecurity attacks and their impacts. This research is concerned mainly with businesses’ victimization by cyber-dependent crimes such as computer viruses, spam, hacking, and denial of service attacks (Wall, 2007).

The remainder of this paper is organized as follows. Section 2 examines the role of businesses’ online activities and cybersecurity measures for cybercrime prevention. Section 3 applies the notions of guardianship and the VIVA to business victimization by cybersecurity attacks. Section 4 introduces the data and methods used. Section 5 presents the results of our models. Finally, section 6 discusses the results and presents conclusions and implications.

Businesses online activities, cybersecurity and cyber-victimization

Few empirical studies have analyzed cybercrimes suffered by organizations. In this section we summarize the results of the main research analyzing the impact of organizations’ cybersecurity measures and online activities on cybercrime victimization.

Rantala (2008) analyzed data from the 2005 US National Computer Security Survey and found that 67% of the 7,818 participant companies had suffered at least one cybersecurity incident in the previous year. The most common cybercrimes suffered by organizations were spyware, adware, phishing, and spoofing. Richards (2009) conducted a survey of 4,000 businesses in Australia and found that the most common types of cybercrime suffered by organizations were virus and malware infections, and the most prevalent impact of cybercrime on businesses was the corruption of hardware or software. Moreover, Richards (2009) showed that only 8% of victims reported cybersecurity incidents to the police, which highlights the value of survey data and the limitations of relying on police-recorded incidents for cybercrime research (Kemp et al., 2020). HISCOX (2018) surveyed 4,103 professionals responsible for the cybersecurity of UK small businesses and found that 30% had suffered cybersecurity breaches in the previous year. Incidents had an average direct cost of £25,700 (e.g., ransom paid, hardware replaced). Bilodeau et al. (2019) analyzed a survey of 10,794 businesses in Canada and found that 21% of organizations were impacted by cybersecurity incidents at least once in the last 12 months (mainly scam, online fraud, phishing and computer viruses). Williams et al. (2019) surveyed 751 businesses in the UK in order to analyze insider cybercrime victimization and found that less than 10% of organizations reported experiencing insider cyber-victimization.

The prevalence of cybercrimes, however, varies across business sectors and sizes, and certain cybersecurity measures appear to have better results for cybercrime prevention than others. For example, Rantala (2008) found that telecommunication businesses, computer system design companies and manufacturers of durable goods have a higher prevalence of cyber-victimization, whereas administrative support, finance, and food service businesses suffer from greatest economic losses. Forestry, fishing, hunting, and agriculture businesses had the lowest victimization rates. Bilodeau et al. (2019) show that banking institutions, universities, and pipeline transportation companies suffer more cyber-attacks than other business sectors. Large companies tend to report the largest expenditures on cybersecurity, but these are also more likely to be targeted by cybercriminals and suffer the greatest financial losses (...

Table of contents

• Cover
• Half Title Page
• Title Page
• Copyright Page
• Table of Contents
• Citation Information
• Notes on Contributors
• Introduction
• 1 The Dynamics of Business, Cybersecurity and Cyber-Victimization: Foregrounding the Internal Guardian in Prevention
• 2 Phishing Evolves: Analyzing the Enduring Cybercrime
• 3 Online Fraud Victimization in China: A Case Study of Baidu Tieba
• 4 Interrelationship between Bitcoin, Ransomware, and Terrorist Activities: Criminal Opportunity Assessment via Cyber-Routine Activities Theoretical Framework
• 5 The Use of Military Profiles in Romance Fraud Schemes
• 6 The Distillation of National Crime Data into A Plan for Elderly Fraud Prevention: A Quantitative and Qualitative Analysis of U.S. Postal Inspection Service Cases of Fraud against the Elderly
• 7 Organized Crime as Financial Crime: The Nature of Organized Crime as Reflected in Prosecutions and Research
• 8 Preventing Identity Theft: Perspectives on Technological Solutions from Industry Insiders
• 9 Forecasting Identity Theft Victims: Analyzing Characteristics and Preventive Actions through Machine Learning Approaches
• 10 The Identification of a Model Victim for Social Engineering: A Qualitative Analysis
• Index