By Sophie Davies | Manon Roberts | Amber Evans | Freya Smith | Alex Murray,

Fraud is now the most commonly experienced crime in the UK, making up over 40 per cent of all recorded crime. Instances of fraud have risen substantially over the last decade, from 510,403 offences recorded in the year ending 2013 to 1.16 million offences recorded in the year ending 2023, with online fraud contributing significantly to the increase (the Crime Survey for England and Wales estimates that over 60 per cent of cyber incidents take place online). Yet our understanding of online fraud in particular — its typology, scale and impact — is limited. Crest Advisory, in partnership with the Police Foundation and Birkbeck, University of London (Institute for Crime and Justice Policy Research), and with funding from the Dawes Trust, is carrying out a large research project into tackling online fraud. The first part of our project focuses on developing a better understanding of the impact of online fraud on victims and the wider public. In September 2023, Crest published findings from large-scale online surveys of the public and small and medium enterprises (SMEs) which explored public perceptions and experiences of online fraud. This report presents the findings from interviews with 20 victims and 12 focus groups (with 96 members of the public) to build on the survey findings and deepen our insight and knowledge of online fraud victimisation and its impact. It addresses a key gap as most existing studies do not distinguish between online and offline fraud victimisation, in part because many fraudulent activities combine offline and online elements. Key findings from the interviews and focus groups are set out below.

London: Crest Advisory, 2024. 36p.

By The Better Business Bureau

CRIMINALS ARE FINDING NEW METHODS WITH THE CRYPTOCURRENCY MARKET, LIKE BITCOIN AND ETHEREUM, TO STEAL FROM UNSUSPECTING INVESTORS OR VICTIMS OF COMMON SCAMS. | Cryptocurrency Scams As Bitcoin and other types of cryptocurrencies gain attention in the news for their volatility, novelty and celebrity investors, scammers are quickly discovering how to use people’s lack of knowledge about the system to rip off investors and dress up old scams. Early entrants into the market made enormous amounts of money, and later others rushed in with hopes of similar gains. The total value of all bitcoins in the world is estimated at $1.03 trillion. A single bitcoin, worth $2,000 in 2017, reached an all-time high of $67,549 in 2021. But Bitcoin is volatile, and the value can swing wildly. After hitting a high in 2021, it declined to $35,484 in early 2022. Purchasing power of a bitcoin can vary day-to-day. Nonetheless, cryptocurrency — a digital payment system that does not rely on banks to verify transactions — has now grown into a major worldwide industry. New York, Arkansas, Brazil, and Puerto Rico expressed interest in becoming attractive locations for the cryptocurrency industry. However, in the spring of 2021 China banned cryptocurrency. It was the second largest country using cryptocurrency. A virtual tug of war exists between the legitimate and fraudulent use of cryptocurrency. This study examines digital currencies and the scams that use them. It provides background on key terms and concepts, examines cryptocurrency’s susceptibility for large-scale scams, and notes the risks and provides tips for common investors and others using cryptocurrency as a payment method.

Washington, DC: BBB, 2022. 18p.

By EUROPOL and Basel Institute on Governance,

These recommendations follow the 6th Global Conference on Criminal Finances and Cryptocurrencies on 1–2 September 2022. The conference was hosted by Europol at its headquarters in The Hague, the Netherlands, together with the Basel Institute on Governance through the Joint Working Group on Criminal Finances and Cryptocurrencies.

The Recommendations are intended to highlight broad approaches and best practices. They are designed to help public and private actors stay one step ahead of those seeking to abuse crypto assets (also known as virtual assets) and services to make, hide and launder illicit money.

The main message is that as the use of crypto assets expands into practically every country and sector, so does its abuse to commit new forms of crime and launder criminal proceeds. Yet with the right tools, capacity and cooperation, the unique characteristics of blockchain-based technologies offer an unprecedented opportunity to investigate organised crime and money laundering networks and to recover stolen funds.

The five recommendations cover:

1. Breaking down silos between “traditional” and “crypto”

2. Regulating broadly and make full use of existing laws 

3. Taking advantage of the blockchain to disrupt organised crime 

4. Raising crypto literacy through capacity building and clear communication 

5. Increasing public-private cooperation

EUROPOL and Basel Institute on Governance, 2022. 6p.

By Jack Nicholls; Aditya Kuppa; Nhien-An Le-Khac

Machine Learning and Deep Learning methods are widely adopted across financial domains to support trading activities, mobile banking, payments, and making customer credit decisions. These methods also play a vital role in combating financial crime, fraud, and cyberattacks. Financial crime is increasingly being committed over cyberspace, and cybercriminals are using a combination of hacking and social engineering techniques which are bypassing current financial and corporate institution security. With this comes a new umbrella term to capture the evolving landscape which is financial cybercrime. It is a combination of financial crime, hacking, and social engineering committed over cyberspace for the sole purpose of illegal economic gain. Identifying financial cybercrime-related activities is a hard problem, for example, a highly restrictive algorithm may block all suspicious activity obstructing genuine customer business. Navigating and identifying legitimate illicit transactions is not the only issue faced by financial institutions, there is a growing demand of transparency, fairness, and privacy from customers and regulators, which imposes unique constraints on the application of artificial intelligence methods to detect fraud-related activities. Traditionally, rule based systems and shallow anomaly detection methods have been applied to detect financial crime and fraud, but recent developments have seen graph based techniques and neural network models being used to tackle financial cybercrime. There is still a lack of a holistic understanding of the financial cybercrime ecosystem, relevant methods, and their drawbacks and new emerging open problems in this domain in spite of their popularity. In this survey, we aim to bridge the gap by studying the financial cybercrime ecosystem based on four axes: (a) different fraud methods adopted by criminals; (b) relevant systems, algorithms, drawbacks, constraints, and metrics used to combat each fraud type; (c) the relevant personas and stakeholders involved; (d) open and emerging problems in the financial cybercrime domain.

IEEE Access ( Volume: 9), 2021, 22p.

By David B. Hinchman,

Ransomware is a malicious software that encrypts files and leaves data and systems unusable. With ransomware attacks, hackers gain entry into a system, lock out users, and demand payment to regain access.

Homeland Security, FBI, and Secret Service help state, local, and other governments prevent or respond to ransomware attacks on systems like emergency services. Most government entities said they're satisfied with the agencies' prevention and response efforts. But many cited inconsistent communication during attacks as a problem. We recommended that the federal agencies address cited issues and follow key practices for better collaboration.

Washington, DC: U.S. Government Accountability Office, 2022. 70p.

By Mark Button · David Shepherd · Jeyong Jung

This paper explores the use of fake social media accounts for economic espionage. It focuses solely on the first step of the recruitment process, the link requests. There has been very little research on economic espionage and none on the use of fake social media profiles as a means of recruitment. The methodology is built upon an inductive approach based on a survey of 2,000 UK professionals who use social media for professional purposes to provide practical and theoretical insights into the problem drawn from a Qualtrics panel. The results illustrate that a quarter of professionals are ill-prepared for the threat of fake social media profiles for the purposes of espionage because they either do not check link requests or accept them even with risky attributes. It further finds a substantial minority are carelessly indifferent to information security and computer network security, and are so indifferent to the identities behind link requests that they auto-link with everyone. The paper also explores the homophily-heterophily orientation of professionals. It argues that homophily-orientated professionals tend to reject profiles with espionage characteristics, whilst heterophily-orientated professionals are susceptible because they embrace social difference. The practical implications are that employers need to strengthen their information security training programmes, the security services need to be more explicit in characterising the threats, and regulation is required to force the social media companies to focus on tackling the fake profle problem.

Security Journal (2025) 38:30

By Michael Skidmore and Beth Aikenhead

This study aims to improve our understanding of the most serious fraud offences perpetrated in the UK, specifically the diversity of methods for committing these crimes, the characteristics and pathways of offenders involved and where applicable, how the groups or networks of offenders operate. This is an exploratory study which used qualitative data taken from the documents compiled by police practitioners in 25 separate criminal investigations. The cases included in this analysis do not constitute a representative sample of frauds in England and Wales during this period. The selection of cases reflects the choices made by the research team to incorporate a diversity of methods, offenders and settings to capture the breadth of fraud. Furthermore, the sampling frame is the product of practitioner choices over which crimes to assign investigation by specialist teams; these are a limited resource and due to the challenges of international investigation, will likely prioritise offending that has a footprint in the UK. Furthermore, in focusing on frauds that were perpetrated (at least in part) from within England and Wales it does not represent fraud offending that emanates from other countries. The specific fraud cases were serious for different reasons; high financial losses (£100,000 or more), high volume offending (50 or more known victims) and high victim impact (assessed by the victim and/or police practitioner). These dimensions of harm reflect those used in practitioner assessments for deciding which frauds are high harm and a priority for intervention. Only three cases satisfied all three harm criteria, all of which involved the mis-selling of investments. Twelve cases satisfied only one criterion and those linked to each dimension of harm were associated with different methods and victims; all cases that fulfilled the high financial loss criterion had defrauded businesses, and two out of three that fulfilled the high-volume criterion involved taking advance payment from consumers In five cases the scale of victimisation and impact was hidden, but they were included because they involved high-risk offenders suspected of being engaged in serious and complex offending. There was considerable diversity in the methods for perpetrating serious fraud and this study borrows from a typology of acquisitive crime developed in a previous study (Naylor, 2002). This model provided a good fit for distinguishing serious frauds on the basis of two overarching models of offending, and this delineation simultaneously revealed distinctions in the situational context, victim and offender profiles: • Commercial frauds: perpetrated from within a legitimate or pseudo-legitimate business setting and included the sale of investments or the mis-selling of products or services online or face-to-face, and nearly all had victimised individual members of the public. • Predatory frauds: involved theft by impersonating legitimate individuals or organisations, mostly by offenders operating from outside of a business setting and without the pretence of a legitimate commercial exchange. The victim profile was more varied, and over half had victimised businesses (for example, payment diversion fraud). There was divergence in the types of fraud offence encompassed by each category of fraud.

London: Police Foundation 2023. 39p.

By Eurojust and Europol

This report is a collaborative effort between Eurojust and Europol that addresses persistent and emerging challenges in cybercrime and investigations involving digital evidence. Key challenges include management of massive volumes of data, legal uncertainties following the invalidation of the Data Retention Directive, and technologies that create barriers to accessing data.

Just like in the previous edition, this 2024 review identifies and categorises challenges from both the law enforcement and judicial perspectives. However, this report includes a second part focusing on legislative tools that could alleviate those challenges and their practical application.

Europol, 2025. 18p

By Emily Ferrguson and Emma Schroeder

Following decades of cyclical insecurity in Myanmar, conflict reached a new level following a coup d’etat in 2021 during which Myanmar’s military, the Tatmadaw, deposed the democratically elected National League for Democracy government. Meanwhile, criminal syndicates, entrenched primarily in Special Economic Zones (SEZs) like Shwe Kokko within Myanmar’s Karen state, have expanded and evolved their criminal operations throughout this evolving conflict. The Tatmadaw forces have intertwined themselves in complicated and carefully balanced alliances to support the ongoing conflict, including with the Karen State Border Guard Force (BGF) . As the Tatmadaw and BGF look to sustain themselves and outlast each other, they have found allies of convenience and alternative funding sources in the criminal groups operating in Karen state. In the last two years, organized criminal groups in Myanmar have expanded their activities to include forms of profitable cybercrime and increased their partnership with the BGF , which enables their operations in return for a cut of the illicit profits. Since roughly 2020, criminal syndicates across Cambodia, Myanmar, Laos, and Thailand have largely lured individuals with fake offers of employment at resorts or casinos operating as criminal fronts where they are detained, beaten, and forced to scam, steal from, and defraud people over the  internet The tactics—kidnap-to-scam operations—evolved in response to the pandemic and to the Myanmar civil war, allowing criminal groups to build on existing networks and capabilities. These operations do not require significant upfront investment or technical expertise, but what they do need is time—time that can be stolen from victims trapped in the region’s already developed human trafficking network. The profits that these syndicates reap from victims around the globe add fuel to the ongoing civil war in Myanmar and threaten the stability of Southeast Asia. These groups entrench themselves and their illicit activities into the local environment by bribing, partnering with, or otherwise paying off a key local faction within the Myanmar civil war, creating an interconnectedness between regional instability and profit-generating cybercrime. What is unfolding in Myanmar challenges conventional interpretations of cybercrime and the tacit separation of criminal activities in cyberspace from armed conflict. The criminal syndicates, and their BGF partners, adapted to the instability in Myanmar so effectively that each is financially and even existentially motivated to perpetuate this instability. This paper explores the connectivity between cybercriminal activities and violence, instability, and armed conflict in a vulnerable region, exploring how cybercrime has become an effective vehicle through which nonstate actors can fund and perpetuate conflict. The following section examines the key precipitating conditions of this case, traces the use of cyber scams to create significant financial losses for victims across the world, sow instability across Southeast Asia, exacerbate the violence in Myanmar, and, finally, considers the risks that this model could be adopted and evolved elsewhere. This paper concludes with implications for the policy and research communities, highlighting the ways in which conflict can move, unbounded, between the cyber and physical domains as combatants and opportunists alike follow clear incentives to marry strategic and financial gain.

Washington, DC: Digital Forensic Research Lab (DFRLab) at the Atlantic Council, 2023. 16p.

By Samantha B. Larkin

Niki Hutchinson, at twenty-four years of age, decided it was time to start dating. She thought she connected with a guy named Hao on Hinge, a dating website. The two started messaging and formed a bond after Hao told Niki he was born in the same town in China from which she was adopted. After learning she recently lost her mom, Hao offered to help Niki make money with her inheritance and told her he knew how to invest in cryptocurrency. While Niki was initially skeptical, Hao eventually instructed Niki on how to make wire transfers from her bank account to Crypto.com, an exchange platform. Through illustrated screenshots and text messaging, Hao described to Niki exactly how to use the platform. From there, Hao convinced Niki to transfer her crypto assets to another website. On the second platform, Niki saw profits in her account and decided to keep investing. She even convinced her father to invest in cryptocurrency too. But when Niki went to withdraw her virtual funds, she was informed that she needed to pay the tax bill with a new transfer of capital to release her earnings. The realization then set in that Niki and her dad lost over $390,000 to scammers. The scam Niki encountered is called “pig butchering.” Pig butchering is a billion-dollar industry of loss, draining American bank accounts, according to official government publications. Scammers abroad invented the term, referring to the concept of “fattening a pig before the slaughter,” where the goal is to nourish trust and confidence in a virtual relationship before conning the victim out of their money and slaughtering their savings. Cryptocurrency is the signature of the scheme. According to complaints received by the Federal Bureau of Investigation’s (FBI) Internet Crime Complaint Center (IC3), the typical targets in crypto-investment scams are individuals between the ages of thirty and forty-nine. Aiming at young professionals with disposable income, these scammers vet their targets to ensure a level of sophistication with technology and susceptibility to emotional manipulation. Scammers then coach their targets into virtual exchanges on false websites, where the victims are manipulated into believing they are making a profit. Their investments increase over time, typically until the victim attempts to cash out their illusory gains, and then the scam reaches its final stage: the victim is informed they need to pay exorbitant taxes or fees with fresh crypto transfers in order to release their funds. In reality, their assets were already gone. (continued)

Roger Williams University Law Review, Volume 30, Issue 1 (2025) Winter 2025, 47p.

By Deanna Davy

The transnational organized crime (TOC) landscape in Southeast Asia has evolved dramatically in recent years. Trafficking in persons for the purpose of forced criminality to commit online scams and financial fraud, particularly occurring in Special Economic Zones (SEZs) and other areas of Cambodia, Lao People’s Democratic Republic (PDR), and Myanmar, as well as other destination countries (including Malaysia, and the Philippines), has emerged as a new and growing trend. Trafficking in persons for forced criminality has been driven by organized crime groups in the region, which operate in a remarkably open way. Their illicit activities are linked to various legal and illegal entertainment establishments, such as casinos, hotels, and registered companies (businesses), which operate from compound-like buildings where victims are harbored and forced to commit, or be complicit in, cyber-enabled crimes. This phenomenon of trafficking for forced criminality has recently become prominent in Southeast Asia, though it had already been identified in many parts of the world. The United Nations Office on Drugs and Crime (UNODC) 2022 Global Report on Trafficking in Persons1 has indicated a considerable increase in the identification of trafficking in persons for the purpose of committing criminal offences, currently reaching 10.2% of all reported trafficking cases globally. Trafficking for forced criminality (or for exploitation in criminal activities) can be understood as trafficking in persons for the purpose of exploitation of victims through forcing or otherwise compelling them to commit criminal acts for economic or other gains of traffickers or exploiters. While not included in the definition of the UN Protocol to Prevent, Suppress and Punish Trafficking in Persons (Trafficking in Persons Protocol) explicitly, exploitation in criminal activities has been incorporated into the trafficking definition of many countries around the world. In the Southeast Asia region, currently only Malaysia has incorporated this form of exploitation into domestic legislation. Nevertheless, the intent of traffickers, the methods.

United Nations Office on Drugs and Crime (UNODC), 2023. 50p.

By: Yasmin Afina and Sarah Grand-Clément

Data plays a critical role in the training, testing and use of artificial intelligence (AI), including in the military domain. Research and development for AI-enabled military solutions is proceeding at breakneck speed, and the important role data plays in shaping these technologies has implications and, at times, raises concerns. These issues are increasingly subject to scrutiny and range from difficulty in finding or creating training and testing data relevant to the military domain, to (harmful) biases in training data sets, as well as their susceptibility to cyberattacks and interference (for example, data poisoning). Yet pathways and governance solutions to address these issues remain scarce and very much underexplored.

This paper aims to fill this gap by first providing a comprehensive overview on data issues surrounding the development, deployment and use of AI. It then explores data governance practices from civilian applications to identify lessons for military applications, as well as highlight any limitations to such an approach. The paper concludes with an overview of possible policy and governance approaches to data practices surrounding military AI to foster the responsible development, testing, deployment and use of AI in the military domain.

CIGI Papers No. 308 — October 2024

By: US Election Assistance Commission

The security of voting systems is essential to a trustworthy election. Every state and local jurisdiction utilizes common-sense procedures and tools to safeguard the voting process. Common best practices include using locks, tamper-evident seals, security cameras, system testing before and after elections, audits, and physical and cybersecurity access controls. This guide outlines some of the many best practices local election officials follow to secure voting systems through an election cycle. It's important to note this is a broad list of common security measures and procedures to protect the integrity of an election. The types of security measures may vary based on the voting systems in use in state and local jurisdictions.

United States. Election Assistance Commission, Oct 2024

By Jonathan Lusthaus

Human Element in Cybercrime: The book emphasizes the human aspect of cybercrime, using the story of Roman Seleznev to illustrate how cyber criminals operate within specific social settings.

Industrialization of Cybercrime: Cybercrime has evolved from individual hackers to a sophisticated, profit-driven industry with specialized roles and professionalization.

Trust and Cooperation: Despite the anonymity and inherent distrust among cybercriminals, they have developed ways to cooperate and build trust, often through online forums and referrals.

Research and Methodology: The book is based on extensive field research over seven years, including 238 interviews, to provide a detailed overview of the cybercrime industry.

Harvard University Press, 2018, 289 pages