After the Pandemic Moved Life Online, a New Survey Reveals Who Is Most Exposed to Cybercrime

When the COVID-19 pandemic pushed work, education, banking and social life onto screens, it did more than change daily routines. It quietly rewired the relationship between ordinary people and digital risk. A new empirical study from Tripura, a state in India’s north-eastern region, offers one of the most granular pictures yet of how that shift has played out at the level of individual households, students and government employees. The research, published in SN Social Sciences, surveyed 1,280 residents between 2022 and 2024 and measured not only how much they use the internet, but how well they understand the threats that come with it and whether that understanding translates into protective action.

The scale of digital adoption the researchers documented is striking. Ninety-nine percent of respondents reported using the internet, and smartphone dependency was high across nearly every demographic group surveyed. This mirrors national trends: industry reports such as the Internet in India 2024 study by Kantar and the Internet and Mobile Association of India have tracked hundreds of millions of new users coming online, many of them through inexpensive mobile devices rather than personal computers. In a state like Tripura, where the digital economy expanded rapidly after 2020, the smartphone has become the primary, and often the only, gateway to online services. That concentration matters for security, because mobile-first users tend to encounter phishing links through messaging apps and social media rather than email, and they are less likely to have antivirus software or multi-factor authentication configured on their devices.

The study’s central finding is a familiar but stubborn one: knowing about cyber threats does not automatically translate into defending against them. Respondents showed substantial awareness of cybercrime as a general phenomenon, yet significant gaps persisted between that awareness and the actual adoption of cybersecurity best practices. Password hygiene, the recognition of phishing attempts, willingness to report incidents, and habits around sharing personal data all lagged behind what respondents claimed to know. This awareness-behaviour gap has been documented in security research for years, from the Human Aspects of Information Security Questionnaire studies of employee awareness to the Security Behavior Intentions Scale developed by Egelman and Peer. The Tripura data suggests the gap is not merely a Western workplace phenomenon but a structural feature of digital life in emerging online populations.

To quantify awareness systematically, the researchers constructed a composite Cyber Awareness Index, a descriptive score built from five indicators covering different dimensions of cyber knowledge and behaviour. The index came out at approximately 0.637, a figure the authors are careful to frame appropriately. They note that the index has weak internal consistency, with a Kuder-Richardson reliability coefficient of 0.48, meaning the five indicators do not hang together as a tightly unified measure. Rather than presenting the CAI as a validated instrument of cyber literacy, the team reports it qualitatively, as an exploratory snapshot of where the sampled population stands. This kind of methodological candour is rare and valuable: many awareness surveys present composite scores with far more confidence than their psychometrics justify.

Where the data becomes statistically robust is in the relationship between education and phishing awareness. Using Pearson’s Chi-Square analysis computed directly on respondent-level data, the researchers found a highly significant association between educational qualification and the ability to recognise phishing attacks, with a chi-square statistic of approximately 96.48 and a p-value below 0.001. In practical terms, this means the probability that such a strong pattern would arise by chance is vanishingly small. Education appears to function as a genuine protective factor, at least for the specific skill of spotting fraudulent messages designed to harvest credentials or financial information. The finding aligns with earlier work on phishing during the pandemic, including an analysis of more than 1,100 targeted phishing domains that documented how attackers exploited COVID-19 themes to lend their lures credibility.

The theoretical backbone of the study is Routine Activity Theory, the criminological framework developed by Cohen and Felson in 1979, which holds that crime occurs when a motivated offender encounters a suitable target in the absence of a capable guardian. Applied to the digital sphere, the theory predicts exactly what the pandemic produced: a massive expansion of suitable targets as hundreds of millions of people moved financial transactions, schooling and social interaction online, often without corresponding growth in guardianship, whether that means technical safeguards, institutional reporting channels or personal digital literacy. The authors argue that the post-pandemic digital expansion enlarged the attack surface for cybercriminals, with students and young people emerging as particularly exposed groups. This interpretation is consistent with national data from India’s National Crime Records Bureau, which has recorded rising cybercrime reports, and with international studies from the Netherlands documenting elevated cybercrime prevalence among citizens and small business owners during the pandemic years.

The demographic composition of the sample deserves attention when weighing the findings. The surveyed population skews toward students, government employees and highly educated respondents, groups that are both more likely to be online and more likely to understand survey questions about cybersecurity. The authors are explicit that their results are most directly generalisable to this sampled population and that extending them to the wider population of Tripura should be treated as provisional. This is an important caveat, because the true awareness gap in the general population, particularly among older, rural or less formally educated residents who were harder to reach, may well be larger than the study reports. If even a relatively digitally engaged sample shows weak adoption of protective practices, the unmeasured population is unlikely to fare better.

The methodological choices also shape what can be concluded. The survey was administered offline with a structured questionnaire across diverse demographic groups, an approach that reduces the self-selection bias inherent in online panels and reaches respondents with limited connectivity. Participation was voluntary with informed consent, and the underlying dataset has been made publicly available through the Zenodo repository, allowing other researchers to scrutinise and reuse the data. Binary logistic regression was used to identify predictors of vulnerability, complementing the descriptive statistics and the chi-square analysis. Together, these techniques allow the authors to move beyond simple percentages and ask which characteristics of respondents actually increase or decrease the odds of risky digital behaviour, a far more useful output for policymakers than headline awareness figures alone.

What emerges from the study is a policy problem with clear contours. The authors call for targeted cyber literacy campaigns, strengthened institutional reporting mechanisms and evidence-based policy interventions for cybercrime prevention in Tripura and comparable regional contexts. The emphasis on targeting is significant. A single state-wide awareness campaign would likely reproduce the existing pattern, in which educated respondents absorb the message first and the most vulnerable gain the least. The education-phishing link identified in the data suggests that interventions should be calibrated to educational attainment, with simplified, vernacular, mobile-first formats for populations with less formal schooling. The weak adoption of reporting behaviour points to a second, institutional gap: victims and near-victims need accessible, low-friction channels through which incidents can be reported, both to enable response and to generate the data needed for enforcement.

The broader lesson of the Tripura study extends well beyond one Indian state. The pandemic’s digital acceleration was a global experiment in expanding the population of suitable targets faster than guardianship could grow, and the consequences are still unfolding. Research on fintech cybersecurity challenges, game-theoretic models of digital payment adoption, and evaluations of cyber awareness education on social media platforms all point in the same direction: the human layer remains the weakest link in the security chain, and closing that gap requires sustained, evidence-based investment rather than one-off awareness drives. As internet penetration in regions like north-east India continues to climb, studies of this kind, with their transparent methods, published data and honest treatment of their own limitations, provide the empirical foundation on which effective prevention can finally be built.

Subject of Research: Cybercrime awareness and digital behaviour among residents of Tripura, India, in the post-COVID-19 era

Article Title: Cybercrime awareness and digital behaviour in the post-COVID-19 era: an empirical study from Tripura, India

Article References: Deb, N., Shekhawat, S., Das, R., & Debnath, S. (2026). Cybercrime awareness and digital behaviour in the post-COVID-19 era: an empirical study from Tripura, India. SN Social Sciences, 6(10), Article 485. https://doi.org/10.1007/s43545-026-01773-2

Image Credits: AI Generated

DOI: 10.1007/s43545-026-01773-2

Keywords: cybercrime, cybersecurity awareness, phishing, Routine Activity Theory, COVID-19, digital behaviour, Tripura, India, logistic regression, Cyber Awareness Index, cyber literacy, online safety