Cybercrime Psychology: Motivation, Cognition, and Social Engineering

4 days ago

19 min read

Author: Ukrainian Psychological Hub · Published: October 11, 2026 · Editorial Policy

Cybercrime psychology examines how people become involved in digitally mediated offending, how they interpret opportunity and consequences, how criminal networks socialize participants, and how deceptive communications exploit ordinary cognitive and social processes. Its central question is why a particular person or group uses digital systems to offend under particular circumstances. The field also studies how targets perceive credibility, how investigators interpret behavior, and how prevention changes opportunities. The same crime can involve different motives, skills, relationships, and legal elements.

Cybercrime includes offenses that depend on computers and networks and offenses already possible offline that digital tools expand in reach, speed, or concealment. A UK government cyber strategy uses this cyber-dependent versus cyber-enabled distinction. Research on cyber-dependent crimes examines offenders, targets, enabling environments, and guardians together. This is a criminological and psychological description; whether a specific action constitutes an offense depends on the law and evidence applicable to that jurisdiction.

The scale makes this an important forensic subject. The FBI reported 1,008,597 complaints and nearly $21 billion in reported losses for 2025. These are complaints and reported losses, not a count of unique offenders or a complete measure of all cybercrime. A large amount of cyber-enabled fraud in such reports tells us about harms and reporting, but it cannot establish a single psychological profile of perpetrators.

What Counts as Cybercrime in Psychology?

Cyber-dependent crime requires information and communication technology for the offense itself: unauthorized intrusion, malicious software distribution, disruption of computer services, and certain attacks on digital infrastructure are examples. Cyber-enabled crime uses networks to extend offenses such as fraud, extortion, identity theft, stalking, and illegal market activity. The distinction matters because a person writing malicious code, a person making fraudulent investment promises, and a person buying a stolen credential may occupy different positions in a network and show different decision processes.

Several adjacent concepts deserve separate treatment. Cybersecurity describes protection of systems and data. Cybervictimization concerns exposure to harm. Online incivility, trolling, and ordinary policy violations may be clinically or socially important without meeting the elements of a criminal offense. Ethical hacking, authorized security testing, academic vulnerability research, and security education are legitimate activities when the required permissions and laws are respected. Technical skill, enthusiasm for computers, or participation in gaming communities cannot establish criminal intent.

Cybercrime is a heterogeneous activity, not an offender personality type

An offense can be impulsive or carefully organized, individually conducted or distributed across specialized participants, financially driven or primarily expressive. Some participants develop tools; others rent infrastructure, solicit targets, launder proceeds, or provide customer support to illicit sellers. Studies of online illicit markets show that reputation, price, service, and trust can structure transactions in ways familiar from legitimate commerce, even though the underlying activity is illicit. See Holt's qualitative analysis of cybercrime markets.

Why Do People Engage in Cybercrime?

A useful explanation considers individual incentives, the person's previous learning, the availability of opportunities, perceived detection risk, peer expectations, organizational structure, and the consequences of participation. A review of computer-crime motives argues that narrowly punitive and deterrence-based explanations leave important motivational questions unanswered. What motivates entry may also differ from what sustains repeated participation or prompts desistance.

Financial reward, status, challenge, and ideological purposes

Money is a prominent motive in fraud, extortion, stolen-data sales, and criminal service markets, although a stated financial motive does not establish financial desperation. Other participants may pursue recognition, prestige in a technical community, excitement, intellectual challenge, revenge, a sense of mastery, or political objectives. A single operation can involve these incentives simultaneously: a technically skilled participant may value recognition while an organizer prioritizes revenue. Motive remains an inference supported by actions, contemporaneous communications, and context rather than an automatic conclusion from an attack technique.

In a small 2020 study of cyber-skilled nonoffenders and seven self-identified offenders, interviewed offenders described entertainment, peer influence, career-related aspirations, risk perceptions, moral views, and life events among their motivations. The offender sample was extremely small. These accounts illuminate possibilities and cannot estimate the prevalence of any motive among cybercriminals or identify a diagnostic characteristic. Autistic traits, also investigated in that study, should not be interpreted as evidence that autism predicts criminal cyberactivity.

Curiosity, experimentation, and the transition into unlawful behavior

Early exploration of technical systems can foster valuable digital expertise. In some circumstances, experimentation crosses a legal or ethical boundary when permission is absent, others' data are exposed, or systems are disrupted. A 2026 qualitative study of 22 criminal hackers described pathways involving interest in computing, self-directed learning or exposure to online peers, and evolving moral judgments about conduct. This research is informative about routes into offending in its sample; it does not imply that curiosity, gaming, self-teaching, or adolescent computer interest ordinarily lead to crime.

Social learning, reputation, and criminal networks

Social learning approaches examine how individuals encounter models of behavior, learn techniques, absorb justifications, and receive approval or reinforcement. Digital communities can lower the cost of meeting collaborators across jurisdictions and allow reputation to be built through repeated interactions. A 2026 analysis of more than 11,000 posts in an online fraud forum found that platform affordances shaped exposure to associations, norms, reinforcement, and perceived consequences. The authors' platform-specific findings should not be generalized mechanically to every forum or messaging service.

Illicit markets often have gatekeeping and governance practices because participants face the threat of fraud by one another. The trust necessary for exchange among offenders is a different construct from ethical conduct toward victims. Evidence from market-forum studies indicates that buyers and sellers coordinate through identifiable social and economic practices. This matters for investigation and prevention because networks may rely on recurring relationships, rather than merely anonymous technical transactions.

Perceived anonymity, detection risk, and situational opportunity

A person may believe that distance, pseudonyms, encrypted communications, or international boundaries reduce the likelihood of being identified. Those beliefs can influence decisions even when they are inaccurate. A 2026 survey of 123 active dark-web users examined how social networks, subcultural involvement, and criminal interests relate to perceived risks and rewards. Such a sample provides a window into perceptions among recruited participants; it cannot yield an individualized probability of offending or detection.

Opportunity matters alongside motive. Accessible targets, compromised credentials, weak authentication, vulnerable workflows, and the availability of criminal services change what an offender can attempt. Routine activity perspectives ask how motivated actors, suitable opportunities, and effective guardianship intersect. In cyber settings, an organization may reduce opportunities through resilient processes while an offender's underlying motives remain unchanged. The interdisciplinary cyber-dependent crime review develops this connection between actors, targets, and guardians.

Moral rationalization and perceived distance from harm

Neutralization refers to ways of excusing or minimizing conduct: presenting a victim as an impersonal institution, reframing theft as a harmless technical challenge, claiming everyone behaves similarly, or distancing oneself from consequences. These are possible narratives rather than universal psychological stages. A handbook review of neutralization research in cybercrime found mixed empirical support and important measurement problems. An offender's later explanation can also be strategic self-presentation, so researchers should avoid treating it as an unfiltered record of prior thinking.

How Cognition Shapes Cybercrime Decisions

Cognition is the set of processes through which people attend, interpret evidence, evaluate alternatives, learn from feedback, and represent consequences. A person engaging in cybercrime may make bounded decisions based on immediate rewards, recent social feedback, technical knowledge, and uncertainty about identification. There is no requirement that the process be fully deliberate or that every participant share an impairment in empathy, impulse control, or judgment. Psychological models remain explanations to be tested, not readouts of an individual mind.

Risk–reward judgments and feedback

Repeated successes without visible sanctions may change perceived risk, while failed transactions or enforcement events can alter expectations. When an offender operates within a specialized group, peers may provide rewards that are social rather than financial. The interaction among reward, uncertainty, skill acquisition, and organizational incentives helps explain repeated conduct better than a fixed personality label. Research designs must distinguish prospective decisions from retrospective accounts, because an arrest, financial loss, or public accusation can change how participants explain earlier acts.

Online disinhibition and psychological distance

Online disinhibition describes shifts in behavior associated with reduced social cues and mediated interaction. It is sometimes invoked in accounts of online offending because victims may be experienced as usernames, balances, or abstract institutions. A 2025 cross-sectional study found associations between toxic online disinhibition and multiple types of cyberdeviance. The study does not prove that disinhibition causes cybercrime, and its cyberdeviance measures cover behaviors with different legal statuses. The theory must be applied to specific conduct rather than used as a universal explanation.

Role specialization and diffusion of responsibility

Large-scale cyber-enabled schemes can divide work among recruiters, infrastructure providers, technical operators, impersonators, money movers, and supervisors. Role specialization can make the downstream damage less visible to any single participant and create dependence on peers or employers. These observations invite hypotheses about responsibility and normalization. They never establish that an individual lacked knowledge, formed criminal intent, or qualified for a legal defense; those matters depend on specific evidence and applicable legal standards.

What Is Social Engineering in Cybercrime?

Social engineering refers to attempts to influence a person into disclosing information, authorizing a transaction, installing software, or changing a protective behavior by manipulating communication and context. It works through familiar human processes—trust, attention, perceived obligation, urgency, and contextual assumptions. The core psychological issue is how an apparently meaningful communication is interpreted and acted upon in a particular environment. Social engineering is wider than phishing, and not every persuasive interaction is fraudulent.

The systematic review of cognition in social-engineering research analyzed 169 empirical articles and 735 hypotheses. It concluded that experimental designs only partly reproduce real attacks and often fail to capture recipient context and the range of actual pretexts. Therefore claims such as 'one emotion makes someone click' or 'one personality trait identifies a susceptible employee' outrun the evidence. The influence attempt is situational and relational.

Authority cues and impersonation

Attack messages may appear to come from a supervisor, customer support agent, bank, government office, or known coworker. Authority cues can change which action seems appropriate, especially within environments where employees routinely respond to requests from more senior roles. The decisive issue is whether the claimed identity and request have been independently verified. Research on deception susceptibility therefore intersects with organizational procedures, not merely with a target's personal confidence or intelligence.

Urgency, fear, scarcity, and reward framing

A threat of account suspension, a purported payment deadline, an urgent payroll change, or an unexpected reward may steer attention toward rapid action. Emotional salience and time pressure can reduce opportunities to inspect details, but the magnitude of these effects varies by context and task. No single emotional trigger is universally successful, and careful readers can still be deceived by highly credible, well-timed messages.

Familiarity, personalization, and social obligations

Messages can incorporate accurate names, job titles, previous correspondence, or details gathered from public profiles. The presence of true background information may make a false instruction appear credible. This is relevant to spear phishing and business-email compromise, where the attack often exploits a normal work relationship or an expected transaction. A technical warning that ignores genuine workflow constraints may fail because the recipient must still perform an apparently legitimate job.

Cognitive load and routine action

Busy environments require users to triage messages under incomplete information. People develop efficient heuristics—for example, recognizing a familiar sender or acting on a routine invoice. Such shortcuts are useful most of the time and may be exploited when a malicious message resembles ordinary work. A 2024 study of mobile-message phishing examined routine activities and heuristic versus systematic processing in a particular younger sample. Its associations do not justify labeling a particular demographic as intrinsically gullible.

Why an apparently intelligent person can be deceived

Phishing vulnerability is neither a diagnosis nor a stable measure of intelligence. It reflects the interaction of the message, its timing, the recipient's role and experience, existing procedures, the available verification path, and the credibility of a particular pretext. NIST's Phish Scale User Guide explicitly accounts for email cues and the recipient's context when interpreting simulated-phishing difficulty. This is a better approach than judging people by raw click rates alone.

What Does the Research Say About Phishing Susceptibility?

A 2026 systematic literature review by Spicer and Nurse screened 4,402 records and included 54 studies on phishing susceptibility and organizational controls. The review distinguishes factors with stronger agreement from contested, thin, or null evidence. This approach is essential because many widely circulated 'human vulnerability' claims arise from narrow experiments or campaigns whose findings may not transfer to another organization, culture, medium, or type of phishing.

Phishing simulations usually capture an observable response to a selected message, such as opening, clicking, reporting, or entering test information. These outcomes measure performance in a designed exercise; they do not directly measure criminal victimization, decision competence, or overall cybersecurity skill. People may behave differently when confronted with a real financial threat, mobile notification, urgent interpersonal message, or high-consequence workplace request. Experimental realism and ecological validity therefore need explicit review.

A false positive in a phishing detection process occurs when benign material is treated as malicious, potentially interfering with legitimate work. A false negative occurs when a malicious communication is missed. Human performance must be evaluated in relation to the base rate and consequence of each error. An employee who clicks in a difficult simulated campaign is not thereby proven careless; equally, a training score is not proof that a real account cannot be compromised.

Are AI-Generated Messages Changing Social Engineering?

Generative systems can help produce fluent text, adapt language, imitate styles, and scale variations of a persuasive message. Voice imitation and synthetic media may complicate identity verification in certain contexts. The FBI's 2025 Internet Crime Report announcement identifies artificial-intelligence-related complaints among costly cyber-enabled schemes. That administrative finding establishes reported harm, not the independent causal effect of AI on susceptibility or a universal increase in attack success.

The most defensible psychological inference is that trust signals can become less reliable when plausible speech, documents, or media are easy to synthesize. Organizations consequently need verification processes that do not rely solely on familiarity of tone or appearance. The evidence for the relative effectiveness of particular AI-enabled techniques continues to change and should be assessed separately from longstanding findings on phishing and impersonation.

Who Commits Cybercrime? Individual Differences and Myths

There is no clinically validated 'cybercriminal personality' covering hackers, fraud operators, money launderers, insiders, and online extortionists. Findings from arrested offenders, convicted persons, self-selected forums, university samples, and simulated phishing studies describe different populations. They vary in gender, age, geography, technical expertise, incentives, selection into research, and exposure to detection. Any attempt to classify a named person from interests, hobbies, social isolation, or a psychological test must confront these population differences.

Terms such as psychopathy, narcissism, antisocial traits, and impulsivity may appear in discussions of offending. A personality trait is a psychological construct; a clinical diagnosis requires formal criteria and assessment; a legal determination addresses a different question. Neither traits nor diagnoses establish authorship of an intrusion or predict individual offending with certainty. Autism, ADHD, depression, and other conditions should not be used as informal offender profiles. Cybercrime research must respect the fundamental difference between correlation and a legally supported conclusion about conduct.

Gender, age, culture, and geography

Many empirical samples overrepresent the populations accessible to researchers or justice systems. A prevalence pattern among prosecuted offenders may reflect policing priorities, detection opportunities, local laws, economic access, and reporting practices as well as underlying conduct. The ability to use technology and the ability to access particular illicit markets differ across settings. Studies should specify their sampling frame rather than transport an association from one jurisdiction or platform to an individual in another.

How Cybercrime Develops, Escalates, and Sometimes Stops

Pathways into cyber-dependent offending can include early technical experimentation, contact with deviant peers, the discovery of illicit opportunities, and reinforcement from successful acts. A 2024 systematic narrative review synthesized 86 eligible documents and emphasized how little robust longitudinal evidence exists about entry and desistance. The review describes recurring themes, not an inevitable sequence. Similar early experiences also lead to entirely lawful education, employment, open-source development, and defensive research.

Desistance means reduced or discontinued involvement in offending. Plausible supports include stable lawful opportunities to use technical skills, credible boundaries concerning authorization, disengagement from illicit peers, and the removal of situational incentives. These are prevention and rehabilitation hypotheses whose effectiveness requires outcome evaluation. A person leaving an illicit group may need different support from someone convicted of coercive financial fraud, and juvenile responses should consider development, proportionality, and jurisdiction-specific law.

What Can Forensic Psychology Infer from Cybercrime Evidence?

Forensic investigators may assemble digital logs, devices, records of transactions, accounts, communications, witness statements, financial flows, and contextual timelines. Psychology contributes questions about decision-making, deception, organizational roles, memory, and interpretation, while technical specialists assess the provenance and integrity of digital evidence. Neither psychological inference nor technical artifacts alone automatically establish the identity, knowledge, or legal state of mind of a particular accused person.

A behavioral observation is a documented action, statement, or pattern. A motive is a proposed explanation. A risk factor is an association under stated conditions. A forensic opinion is an expert's conclusion within the limits of a referral question, methods, and relevant legal standard. A criminal conviction is a legal finding. These categories should remain separate in expert reports and public explanations. The APA Specialty Guidelines for Forensic Psychology place emphasis on competence, impartiality, appropriate methods, and transparency about limitations.

Attribution, deception, and the limits of behavioral profiling

Shared attack tools, copied wording, reused infrastructure, and false online identities make attribution difficult. An apparent style or behavioral signature can generate hypotheses for investigation, but it is not a validated psychological fingerprint. A repeated tactic may reflect tool availability or shared training rather than a stable offender characteristic. This boundary parallels the wider evidence review of offender profiling, where accuracy and operational value require careful empirical demonstration; see Fox and Farrington's review.

Interpreting self-report and recovered messages

An admission, a boast in an online forum, or a retrospective interview is evidence that needs contextual evaluation. Participants can exaggerate competence, conceal associates, perform an identity for status, or rationalize conduct after the fact. Conversely, ironic or fictional online statements may be misread as literal intent. Investigators should examine consistency, corroboration, temporal sequence, and alternative explanations rather than infer a psychological state from a single phrase.

Risk assessment and future conduct

Cybercrime-related risk assessment may consider past conduct, relevant opportunities, current access, behavior, and protective conditions. Many instruments created for general violence or recidivism populations have not been validated specifically for cyber-dependent offending. An instrument's reported discrimination, calibration, sensitivity, specificity, false-positive rate, and false-negative rate must be established for the population and decision context in which it is used. A score cannot establish guilt or provide a precise personal forecast without evidence.

Base rates are particularly important. When the behavior under consideration is rare, even a test with apparently useful accuracy can produce many false alarms. A study reporting an area under the ROC curve does not by itself show that predicted probabilities are calibrated or that a threshold is fair across groups. Legal and organizational decisions require evaluation of errors, consequences, and procedural safeguards, not a mechanically applied score.

Cybercrime, Mental Health, and Criminal Responsibility

Clinical questions may arise in a particular case, but psychiatric diagnosis and criminal responsibility are separate matters. A diagnosis does not explain a cyber offense or determine legal culpability. Relevant psycholegal questions may include a person's understanding, functional abilities, intent as defined by law, capacity to assist counsel, and the reliability of available evidence. The legal rules and procedural tests vary across jurisdictions. Any clinical assessment must examine the actual referral question using qualified methods and appropriate collateral information.

The psychology of cybercrime should therefore avoid a familiar error: converting technical unusualness, social isolation, an unconventional interest, or disputed behavior into an assumed disorder. Conversely, involvement in illegal technical activities does not establish the absence of clinically significant needs. Mental health and legal responsibility deserve independent, evidence-based examination.

The Role of Law: Authorization, Intent, and Jurisdiction

A psychological account asks about motives, beliefs, cognition, opportunities, and behavior. Criminal law asks whether the prosecution has proved each applicable element of a charged offense under the governing rules. Questions of authorization, knowledge, intent, causation, jurisdiction, admissibility, and defenses depend on statutes and judicial interpretation. A person may perceive an act as harmless experimentation while a jurisdiction's law treats it as unlawful; the reverse can occur when public narratives exaggerate what the law actually prohibits.

A transnational operation may involve different victims, servers, financial institutions, and accused persons across several jurisdictions. These complexities limit the value of sweeping claims such as 'hacking is always illegal' or 'anonymity establishes guilty intent.' Forensic psychological conclusions should identify the legal question posed by the referring court or attorney, explain what evidence bears on it, and distinguish psychological findings from the ultimate legal determination.

How to Prevent Cybercrime Using Behavioral Evidence

Design safer choices into workflows

A security program works better when it makes the safe action practical in the moment. Verification of payment changes through a known independent channel, approval separation for sensitive transactions, accessible reporting, appropriate permissions, timely updates, and phishing-resistant multifactor authentication can reduce exploitable opportunities. NIST's phishing guidance recommends training, reporting, multifactor authentication, and keeping technology up to date. These protections target system design and behavior together.

Measure training without blaming recipients

Use simulated-phishing results to examine message difficulty and organizational process, not to shame employees. Provide a simple way to report suspicious communications; track reporting and help-seeking alongside click rates; test whether controls prevent damaging downstream actions. The NIST Phish Scale can help interpret why one simulated message was harder than another. Training quality is demonstrated by improved behavior and safer organizational outcomes, not merely attendance or the number of slides viewed.

Support lawful technical participation

Educational settings and employers can teach permissions, disclosure norms, consequences of harmful acts, secure research procedures, and pathways into legitimate cybersecurity work. Legal opportunities to develop expertise can be meaningful for technically interested youth. The existence of such opportunities does not establish that any specific intervention prevents crime; evaluation should track behavior and longer-term outcomes, use comparable groups when feasible, and avoid stigmatizing the population being served.

Respond to suspected offenses proportionately

When an incident occurs, preserve reliable records, involve technical incident responders, and seek appropriate legal guidance. Avoid using informal personality assessments or public speculation as substitutes for evidence. For people targeted by a scam, clear instructions and rapid access to support are more useful than blame. The FBI's IC3 reporting resource provides a U.S. reporting channel; reporting routes elsewhere depend on country and type of incident.

What the Evidence Can and Cannot Establish

The strongest knowledge base combines interdisciplinary reviews, peer-reviewed field observation, empirical studies of offenders or forums, controlled experiments, and professional guidance. Each source answers a different question. Forum observations reveal particular communities but cannot enumerate all offenders. Self-report studies reveal stated motives but face social-desirability and recall limitations. Laboratory deception studies can isolate influences but may lack realistic consequences. Administrative complaint figures show reported incidents and losses but do not measure the true prevalence of crime.

Research also faces missing comparison groups, jurisdictional differences, inconsistent definitions, changing technologies, nonrepresentative recruitment, and insufficient long-term follow-up. A finding about phishing recipients should not automatically be transplanted to perpetrators of malware offenses. An association observed in one online marketplace should not become a universal theory of cybercriminal personality. Scientific honesty here requires precision about the population, outcome, mechanism, and level of evidence.

Common Myths About Cybercrime Psychology

Myth: Hackers share one personality profile. Evidence instead documents heterogeneous pathways, incentives, and network roles. Myth: High intelligence or technical expertise causes offending. These characteristics also support lawful careers and ethical security research. Myth: People targeted by scams must be unintelligent. The message, timing, trust context, and organizational workflow shape susceptibility. Myth: An anonymous account proves intent or authorship. Technical and behavioral attribution require corroboration.

Myth: Mental illness explains cybercrime. Diagnosis and criminal offending are separate constructs, and a person's clinical condition cannot be inferred from a digital offense. Myth: A phishing-test click rate measures an employee's character. It measures a response to a specific simulated communication under selected conditions. Myth: A cybercrime risk score identifies who will offend. Predictive performance depends on the instrument, its validation population, base rates, calibration, and decision threshold.

Frequently Asked Questions

What is cybercrime psychology?

It is the study of psychological and social processes related to digital offending, including motivation, learning, judgment, deception, interaction with targets, and forensic interpretation. Its applications include prevention, investigation, correctional work, and evaluation of evidence in legal settings.

What motivates cybercriminals?

Research identifies multiple possible incentives, including money, recognition, challenge, curiosity, retaliation, ideology, and peer reinforcement. The relative importance of each depends on the offense, person, environment, and stage of participation. No single motive characterizes all perpetrators.

What is the difference between hacking and social engineering?

Hacking is an imprecise everyday word that may describe authorized security work or unauthorized technical intrusion. Social engineering is an influence attempt directed at human decision-making, often to obtain access, money, or information. Some cybercrime campaigns combine technical exploits and deceptive communications.

Why do people fall for phishing attacks?

Deceptive messages can resemble legitimate work or personal communications, exploit existing trust, and arrive during high-demand moments. The evidence points to interactions between message features and recipient context rather than a fixed personal flaw. Training and resilient workflows can reduce harms.

Does anonymity make people commit cybercrime?

Perceived anonymity may affect expectations of detection, accountability, and social consequences for some participants. It is one potential contextual factor. It neither causes crime by itself nor proves what a particular user intended.

Can a psychologist determine who committed a cyberattack?

Psychologists may evaluate relevant behavior, statements, and decision processes within their competence, but attribution requires technical, documentary, contextual, and often legal evidence. A psychological profile or behavioral impression is insufficient to establish identity or guilt.

Can cybercrime be predicted from personality tests?

There is no validated universal personality test that reliably identifies future cyberoffenders. Risk statements should specify their target behavior, population, time horizon, assessment setting, measurement validity, calibration, false positives, and implications for fairness.

Is cybercrime linked to autism or other mental disorders?

A clinical diagnosis is not a cybercrime predictor or a substitute for evidence of conduct. Certain studies explore traits or small selected groups, but those findings do not support claims that autistic people or people with other conditions are inherently prone to cyberoffending.

What makes social engineering different from ordinary persuasion?

Social engineering in cybersecurity involves attempts to manipulate a person into security-relevant actions such as disclosing credentials or authorizing unauthorized transfers. Ordinary persuasion covers a much wider field. Classification requires examination of the conduct, the deception, and the applicable legal context.

How should organizations use simulated phishing tests?

Interpret results using message difficulty, recipient context, reporting behavior, and system controls. Combine training with verified processes, accessible reporting, and technical safeguards. A single test result should not be treated as an employee's permanent susceptibility score.

References

American Psychological Association. (2013). Specialty Guidelines for Forensic Psychology. APA.

Botchkovar, E., Antonaccio, O., Ballou, A., & Maimon, D. (2026). Crime and calculation: The decision-making of dark web actors. Social Science Computer Review. https://doi.org/10.1177/08944393261441299.

Brewer, R., Fox, S., & Miller, C. (2019). Applying the techniques of neutralization to the study of cybercrime. In The Palgrave Handbook of International Cybercrime and Cyberdeviance. https://doi.org/10.1007/978-3-319-90307-1_22-1.

Burda, P., Allodi, L., & Zannone, N. (2024). Cognition in social engineering empirical research: A systematic literature review. ACM Transactions on Computer-Human Interaction, 31(2), Article 19. https://doi.org/10.1145/3635149.

Dawkins, S., & Jacobs, J. (2023). NIST Phish Scale User Guide (NIST Technical Note 2276). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.TN.2276.

Federal Bureau of Investigation. (2026). Cryptocurrency and AI scams bilk Americans of billions: FBI releases annual internet crime complaint report. FBI.

Fox, B. H., & Farrington, D. P. (2018). What have we learned from offender profiling? A systematic review and meta-analysis. Psychological Bulletin. https://doi.org/10.1037/bul0000170.

Gan, C. L., Lee, Y. Y., & Liew, T. W. (2024). Fishing for phishy messages: Predicting phishing susceptibility through the lens of cyber-routine activities theory and heuristic-systematic model. Humanities and Social Sciences Communications. https://doi.org/10.1057/s41599-024-04083-1.

Holt, T. J. (2013). Examining the forces shaping cybercrime markets online. Social Science Computer Review. https://doi.org/10.1177/0894439312452998.

Holt, T. J., & Lampke, E. (2010). Exploring stolen data markets online: Products and market forces. Criminal Justice Studies. https://doi.org/10.1080/14786011003634415.

Leukfeldt, E. R., & Bekkers, L. M. J. (2026). From curiosity to crime: Exploring pathways into criminal hacking. Computers in Human Behavior, 181, 108996. https://doi.org/10.1016/j.chb.2026.108996.

Loggen, J., Moneva, A., & Leukfeldt, R. (2024). Pathways into, desistance from, and risk factors related to cyber-dependent crime: A systematic narrative review. Victims & Offenders. https://doi.org/10.1080/15564886.2024.2370295.

Maimon, D., & Louderback, E. R. (2019). Cyber-dependent crimes: An interdisciplinary review. Annual Review of Criminology, 2, 191–216. https://doi.org/10.1146/annurev-criminol-032317-092057.

National Institute of Standards and Technology. (2025). Phishing. NIST.

Neufeld, D. (2023). Computer crime motives: Do we have it right? Sociology Compass, 17(4), e13077. https://doi.org/10.1111/soc4.13077.

Payne, K., Maras, K. L., Russell, A. J., Brosnan, M. J., & Mills, R. (2020). Self-reported motivations for engaging or declining to engage in cyber-dependent offending and the role of autistic traits. Research in Developmental Disabilities, 104, 103681. https://doi.org/10.1016/j.ridd.2020.103681.

Schmitt, H. S., Sindermann, C., & Montag, C. (2025). Toxic disinhibition makes a versatile rulebreaker in cyberspace: Mapping online deviance with exploratory graph analysis and structural equation modeling. Acta Psychologica, 260, 105542. https://doi.org/10.1016/j.actpsy.2025.105542.

Spicer, M., & Nurse, J. R. C. (2026). What makes people susceptible to phishing attacks: A systematic literature review and future research agenda. Computers & Security. https://doi.org/10.1016/j.cose.2026.105096.

United Kingdom Government. (2022). National Cyber Strategy 2022. GOV.UK.

Wang, F., & Dickinson, T. (2026). Affordances, dread, and online fraud: Exploring and advancing social learning theory in online contexts. Criminology. https://doi.org/10.1111/1745-9125.70042.

Psychological Encyclopedia