Risky Online Habits, Not Digital Exposure, Drive Cybercrime Losses and Mental Health Harm

Cybercrime is no longer a niche hazard of the digital age; it has become a routine risk woven into the everyday lives of anyone who banks, shops, socialises or works online. Yet while the technical mechanics of phishing, fraud and identity theft are studied intensively, far less attention has been paid to a deceptively simple question: why do some people fall victim while others, exposed to the same threats, do not? A new study published in Discover Social Science and Health tackles that question head-on, and its findings challenge several widely held assumptions about who is most at risk when the digital world turns hostile.

The research, led by Satu Baruri of B.R. Ambedkar College of Law at Andhra University in India, together with colleagues at Széchenyi István University in Hungary, GITAM Institute of Technology and KL Business School, set out to identify the behavioural and cognitive factors that determine whether digitally active individuals become victims of cybercrime, and what happens to their finances and mental health afterwards. Rather than treating victimisation, financial loss and psychological distress as separate problems, the team built a single integrated framework in which all three outcomes are linked, allowing them to trace how a single security lapse can cascade into both a drained bank account and a deteriorating state of mind.

To construct that framework, the researchers drew on two well-established theories from criminology and health psychology. The first is Cyber Routine Activity Theory, or CRAT, an adaptation of the classic routine activity perspective in criminology, which holds that victimisation occurs when a motivated offender encounters a suitable target in the absence of capable guardianship. In the cyber context, this means that the structure of a person’s digital life, how often they transact online, how much personal information they share, and how visible they are to strangers, shapes their exposure to motivated attackers. The second is Protection Motivation Theory, or PMT, which originated in the study of health behaviour and describes how people weigh threats against their own ability to cope with them. PMT predicts that individuals who perceive themselves as susceptible to a threat and who believe they can take effective protective action will be more likely to adopt safety behaviours.

Combining these two theoretical lenses, the study examined five potential determinants of cybercrime victimisation: digital lifestyle exposure, cybersecurity awareness, financial literacy, perceived susceptibility and risky online behaviours. Digital lifestyle exposure captures the sheer intensity of a person’s online activity, from e-commerce and digital banking to social media engagement. Cybersecurity awareness reflects knowledge of threats and protective practices, such as recognising phishing attempts or using strong authentication. Financial literacy measures a person’s understanding of financial products and risks, which might plausibly help them spot fraudulent investment schemes or unauthorised transactions. Perceived susceptibility, drawn from PMT, is the degree to which individuals believe they could personally fall prey to cyberattacks. Risky online behaviours encompass the concrete actions, clicking unverified links, reusing passwords, oversharing personal data, that create openings for attackers.

The empirical test was quantitative and rigorous. The team administered a structured questionnaire to 397 digitally active individuals and analysed the resulting data using structural equation modelling, a statistical technique that allows researchers to test networks of hypothesised relationships between observed measurements and latent constructs simultaneously. This matters because cybercrime victimisation cannot be directly observed in a survey; it must be inferred from patterns of responses. Structural equation modelling lets the researchers estimate how strongly each behavioural or cognitive factor feeds into victimisation, and how victimisation in turn propagates into financial and psychological harm, while accounting for measurement error in every variable.

The results deliver a clear and, in places, counterintuitive message. Two factors emerged as significant drivers of cybercrime victimisation: cybersecurity awareness and risky online behaviours. The first of these is reassuring in one sense, because it suggests that awareness genuinely matters, but the direction of the relationship underscores a subtlety the authors highlight: awareness and victimisation are intertwined in ways that simple awareness campaigns may not resolve. The second finding is more straightforward. People who engage in risky online behaviours are significantly more likely to be victimised, confirming that the concrete choices users make day to day, not merely the abstract level of threat in their environment, determine whether attackers succeed.

Just as telling are the factors that failed to predict victimisation. Digital lifestyle exposure, financial literacy and perceived susceptibility all showed no significant effects on whether respondents became victims. This is a striking result for anyone who assumes that heavy internet users are automatically the most vulnerable, or that people who understand finance are better at avoiding fraud. The study suggests that simply living much of one’s life online does not, by itself, determine victimisation, and that knowing how money works does not translate automatically into recognising a scam. Even perceived susceptibility, the psychological sense of being at risk, did not translate into protection. In other words, feeling vulnerable is not the same as being safe, and subjective risk perception alone does not shield users from attack.

The second half of the model examined what victimisation does to people, and here the findings are sobering. Cybercrime victimisation was found to contribute significantly to both financial loss and mental health deterioration. Moreover, the study reports a bidirectional relationship: victimisation drives financial and psychological harm, and those harms in turn feed back into the experience of victimisation. This feedback loop is perhaps the study’s most important conceptual contribution. A victim who has lost money may become more anxious and distracted, which can impair judgement and increase the likelihood of further victimisation. Psychological distress and financial strain are not merely consequences of cybercrime; within this framework they become part of the mechanism that sustains it.

The authors argue that these findings underscore the importance of behavioural practices in shaping cyber vulnerability. If risky online behaviours are the significant behavioural pathway into victimisation, then interventions that target specific behaviours, rather than general awareness messaging alone, are likely to be more effective. The study offers insights for the development of cybersecurity awareness programmes and behavioural risk mitigation strategies, suggesting that efforts to reduce cybercrime’s toll should focus on changing what people actually do online, and should recognise that the financial and psychological consequences of victimisation are deeply interconnected. Treating a victim’s financial recovery and mental health support as separate problems, the framework implies, misses the way each can aggravate the other.

The research also makes a methodological and conceptual contribution to the literature. By considering behavioural, financial and psychological outcomes within a single structural model, the study moves beyond fragmented approaches that examine cybercrime victimisation, monetary loss and mental health in isolation. The work was conducted with ethical approval from the Institutional Ethics Committee of Andhra University, with voluntary, anonymous participation and digital informed consent from all respondents, all of whom were adults. Published open access, the study arrives at a moment when digital technologies continue to spread faster than the protective habits needed to use them safely. Its central lesson is one that individuals, educators and policymakers alike can act on: the strongest predictor of cyber harm is not how much time you spend online, how much you know about finance, or even how vulnerable you feel, but what you actually do when the next suspicious link, message or offer appears on your screen.

Subject of Research: Behavioural and cognitive determinants of cybercrime victimisation and its financial and mental health consequences

Article Title: Behavioural and cognitive determinants of financial loss and mental health deterioration following cybercrime victimisation

Article References: Baruri, S., Manikyam, S., Rejeb, A., Roy, R., & Mukherjee, S. (2026). Behavioural and cognitive determinants of financial loss and mental health deterioration following cybercrime victimisation. Discover Social Science and Health. https://doi.org/10.1007/s44155-026-00468-6

Image Credits: AI Generated

DOI: 10.1007/s44155-026-00468-6

Keywords: cybercrime, cybersecurity awareness, mental health, financial loss, digital lifestyle, risky online behaviour, victimisation, structural equation modelling, routine activity theory, protection motivation theory, financial literacy, online fraud