The scale of digital adoption the researchers documented is striking. Ninety-nine percent of respondents reported using the internet, and smartphone dependency was high across nearly every demographic group surveyed. This mirrors national trends: industry reports such as the Internet in India 2024 study by Kantar and the Internet and Mobile Association of India have tracked hundreds of millions of new users coming online, many of them through inexpensive mobile devices rather than personal computers. In a state like Tripura, where the digital economy expanded rapidly after 2020, the smartphone has become the primary, and often the only, gateway to online services. That concentration matters for security, because mobile-first users tend to encounter phishing links through messaging apps and social media rather than email, and they are less likely to have antivirus software or multi-factor authentication configured on their devices.

The study’s central finding is a familiar but stubborn one: knowing about cyber threats does not automatically translate into defending against them. Respondents showed substantial awareness of cybercrime as a general phenomenon, yet significant gaps persisted between that awareness and the actual adoption of cybersecurity best practices. Password hygiene, the recognition of phishing attempts, willingness to report incidents, and habits around sharing personal data all lagged behind what respondents claimed to know. This awareness-behaviour gap has been documented in security research for years, from the Human Aspects of Information Security Questionnaire studies of employee awareness to the Security Behavior Intentions Scale developed by Egelman and Peer. The Tripura data suggests the gap is not merely a Western workplace phenomenon but a structural feature of digital life in emerging online populations.

To quantify awareness systematically, the researchers constructed a composite Cyber Awareness Index, a descriptive score built from five indicators covering different dimensions of cyber knowledge and behaviour. The index came out at approximately 0.637, a figure the authors are careful to frame appropriately. They note that the index has weak internal consistency, with a Kuder-Richardson reliability coefficient of 0.48, meaning the five indicators do not hang together as a tightly unified measure. Rather than presenting the CAI as a validated instrument of cyber literacy, the team reports it qualitatively, as an exploratory snapshot of where the sampled population stands. This kind of methodological candour is rare and valuable: many awareness surveys present composite scores with far more confidence than their psychometrics justify.

Where the data becomes statistically robust is in the relationship between education and phishing awareness. Using Pearson’s Chi-Square analysis computed directly on respondent-level data, the researchers found a highly significant association between educational qualification and the ability to recognise phishing attacks, with a chi-square statistic of approximately 96.48 and a p-value below 0.001. In practical terms, this means the probability that such a strong pattern would arise by chance is vanishingly small. Education appears to function as a genuine protective factor, at least for the specific skill of spotting fraudulent messages designed to harvest credentials or financial information. The finding aligns with earlier work on phishing during the pandemic, including an analysis of more than 1,100 targeted phishing domains that documented how attackers exploited COVID-19 themes to lend their lures credibility.

The theoretical backbone of the study is Routine Activity Theory, the criminological framework developed by Cohen and Felson in 1979, which holds that crime occurs when a motivated offender encounters a suitable target in the absence of a capable guardian. Applied to the digital sphere, the theory predicts exactly what the pandemic produced: a massive expansion of suitable targets as hundreds of millions of people moved financial transactions, schooling and social interaction online, often without corresponding growth in guardianship, whether that means technical safeguards, institutional reporting channels or personal digital literacy. The authors argue that the post-pandemic digital expansion enlarged the attack surface for cybercriminals, with students and young people emerging as particularly exposed groups. This interpretation is consistent with national data from India’s National Crime Records Bureau, which has recorded rising cybercrime reports, and with international studies from the Netherlands documenting elevated cybercrime prevalence among citizens and small business owners during the pandemic years.

The demographic composition of the sample deserves attention when weighing the findings. The surveyed population skews toward students, government employees and highly educated respondents, groups that are both more likely to be online and more likely to understand survey questions about cybersecurity. The authors are explicit that their results are most directly generalisable to this sampled population and that extending them to the wider population of Tripura should be treated as provisional. This is an important caveat, because the true awareness gap in the general population, particularly among older, rural or less formally educated residents who were harder to reach, may well be larger than the study reports. If even a relatively digitally engaged sample shows weak adoption of protective practices, the unmeasured population is unlikely to fare better.

The methodological choices also shape what can be concluded. The survey was administered offline with a structured questionnaire across diverse demographic groups, an approach that reduces the self-selection bias inherent in online panels and reaches respondents with limited connectivity. Participation was voluntary with informed consent, and the underlying dataset has been made publicly available through the Zenodo repository, allowing other researchers to scrutinise and reuse the data. Binary logistic regression was used to identify predictors of vulnerability, complementing the descriptive statistics and the chi-square analysis. Together, these techniques allow the authors to move beyond simple percentages and ask which characteristics of respondents actually increase or decrease the odds of risky digital behaviour, a far more useful output for policymakers than headline awareness figures alone.

What emerges from the study is a policy problem with clear contours. The authors call for targeted cyber literacy campaigns, strengthened institutional reporting mechanisms and evidence-based policy interventions for cybercrime prevention in Tripura and comparable regional contexts. The emphasis on targeting is significant. A single state-wide awareness campaign would likely reproduce the existing pattern, in which educated respondents absorb the message first and the most vulnerable gain the least. The education-phishing link identified in the data suggests that interventions should be calibrated to educational attainment, with simplified, vernacular, mobile-first formats for populations with less formal schooling. The weak adoption of reporting behaviour points to a second, institutional gap: victims and near-victims need accessible, low-friction channels through which incidents can be reported, both to enable response and to generate the data needed for enforcement.

The broader lesson of the Tripura study extends well beyond one Indian state. The pandemic’s digital acceleration was a global experiment in expanding the population of suitable targets faster than guardianship could grow, and the consequences are still unfolding. Research on fintech cybersecurity challenges, game-theoretic models of digital payment adoption, and evaluations of cyber awareness education on social media platforms all point in the same direction: the human layer remains the weakest link in the security chain, and closing that gap requires sustained, evidence-based investment rather than one-off awareness drives. As internet penetration in regions like north-east India continues to climb, studies of this kind, with their transparent methods, published data and honest treatment of their own limitations, provide the empirical foundation on which effective prevention can finally be built.

Subject of Research: Cybercrime awareness and digital behaviour among residents of Tripura, India, in the post-COVID-19 era

Article Title: Cybercrime awareness and digital behaviour in the post-COVID-19 era: an empirical study from Tripura, India

Article References: Deb, N., Shekhawat, S., Das, R., & Debnath, S. (2026). Cybercrime awareness and digital behaviour in the post-COVID-19 era: an empirical study from Tripura, India. SN Social Sciences, 6(10), Article 485. https://doi.org/10.1007/s43545-026-01773-2

Image Credits: AI Generated

DOI: 10.1007/s43545-026-01773-2

Keywords: cybercrime, cybersecurity awareness, phishing, Routine Activity Theory, COVID-19, digital behaviour, Tripura, India, logistic regression, Cyber Awareness Index, cyber literacy, online safety

The research, led by Satu Baruri of B.R. Ambedkar College of Law at Andhra University in India, together with colleagues at Széchenyi István University in Hungary, GITAM Institute of Technology and KL Business School, set out to identify the behavioural and cognitive factors that determine whether digitally active individuals become victims of cybercrime, and what happens to their finances and mental health afterwards. Rather than treating victimisation, financial loss and psychological distress as separate problems, the team built a single integrated framework in which all three outcomes are linked, allowing them to trace how a single security lapse can cascade into both a drained bank account and a deteriorating state of mind.

To construct that framework, the researchers drew on two well-established theories from criminology and health psychology. The first is Cyber Routine Activity Theory, or CRAT, an adaptation of the classic routine activity perspective in criminology, which holds that victimisation occurs when a motivated offender encounters a suitable target in the absence of capable guardianship. In the cyber context, this means that the structure of a person’s digital life, how often they transact online, how much personal information they share, and how visible they are to strangers, shapes their exposure to motivated attackers. The second is Protection Motivation Theory, or PMT, which originated in the study of health behaviour and describes how people weigh threats against their own ability to cope with them. PMT predicts that individuals who perceive themselves as susceptible to a threat and who believe they can take effective protective action will be more likely to adopt safety behaviours.

Combining these two theoretical lenses, the study examined five potential determinants of cybercrime victimisation: digital lifestyle exposure, cybersecurity awareness, financial literacy, perceived susceptibility and risky online behaviours. Digital lifestyle exposure captures the sheer intensity of a person’s online activity, from e-commerce and digital banking to social media engagement. Cybersecurity awareness reflects knowledge of threats and protective practices, such as recognising phishing attempts or using strong authentication. Financial literacy measures a person’s understanding of financial products and risks, which might plausibly help them spot fraudulent investment schemes or unauthorised transactions. Perceived susceptibility, drawn from PMT, is the degree to which individuals believe they could personally fall prey to cyberattacks. Risky online behaviours encompass the concrete actions, clicking unverified links, reusing passwords, oversharing personal data, that create openings for attackers.

The empirical test was quantitative and rigorous. The team administered a structured questionnaire to 397 digitally active individuals and analysed the resulting data using structural equation modelling, a statistical technique that allows researchers to test networks of hypothesised relationships between observed measurements and latent constructs simultaneously. This matters because cybercrime victimisation cannot be directly observed in a survey; it must be inferred from patterns of responses. Structural equation modelling lets the researchers estimate how strongly each behavioural or cognitive factor feeds into victimisation, and how victimisation in turn propagates into financial and psychological harm, while accounting for measurement error in every variable.

The results deliver a clear and, in places, counterintuitive message. Two factors emerged as significant drivers of cybercrime victimisation: cybersecurity awareness and risky online behaviours. The first of these is reassuring in one sense, because it suggests that awareness genuinely matters, but the direction of the relationship underscores a subtlety the authors highlight: awareness and victimisation are intertwined in ways that simple awareness campaigns may not resolve. The second finding is more straightforward. People who engage in risky online behaviours are significantly more likely to be victimised, confirming that the concrete choices users make day to day, not merely the abstract level of threat in their environment, determine whether attackers succeed.

Just as telling are the factors that failed to predict victimisation. Digital lifestyle exposure, financial literacy and perceived susceptibility all showed no significant effects on whether respondents became victims. This is a striking result for anyone who assumes that heavy internet users are automatically the most vulnerable, or that people who understand finance are better at avoiding fraud. The study suggests that simply living much of one’s life online does not, by itself, determine victimisation, and that knowing how money works does not translate automatically into recognising a scam. Even perceived susceptibility, the psychological sense of being at risk, did not translate into protection. In other words, feeling vulnerable is not the same as being safe, and subjective risk perception alone does not shield users from attack.

The second half of the model examined what victimisation does to people, and here the findings are sobering. Cybercrime victimisation was found to contribute significantly to both financial loss and mental health deterioration. Moreover, the study reports a bidirectional relationship: victimisation drives financial and psychological harm, and those harms in turn feed back into the experience of victimisation. This feedback loop is perhaps the study’s most important conceptual contribution. A victim who has lost money may become more anxious and distracted, which can impair judgement and increase the likelihood of further victimisation. Psychological distress and financial strain are not merely consequences of cybercrime; within this framework they become part of the mechanism that sustains it.

The authors argue that these findings underscore the importance of behavioural practices in shaping cyber vulnerability. If risky online behaviours are the significant behavioural pathway into victimisation, then interventions that target specific behaviours, rather than general awareness messaging alone, are likely to be more effective. The study offers insights for the development of cybersecurity awareness programmes and behavioural risk mitigation strategies, suggesting that efforts to reduce cybercrime’s toll should focus on changing what people actually do online, and should recognise that the financial and psychological consequences of victimisation are deeply interconnected. Treating a victim’s financial recovery and mental health support as separate problems, the framework implies, misses the way each can aggravate the other.

The research also makes a methodological and conceptual contribution to the literature. By considering behavioural, financial and psychological outcomes within a single structural model, the study moves beyond fragmented approaches that examine cybercrime victimisation, monetary loss and mental health in isolation. The work was conducted with ethical approval from the Institutional Ethics Committee of Andhra University, with voluntary, anonymous participation and digital informed consent from all respondents, all of whom were adults. Published open access, the study arrives at a moment when digital technologies continue to spread faster than the protective habits needed to use them safely. Its central lesson is one that individuals, educators and policymakers alike can act on: the strongest predictor of cyber harm is not how much time you spend online, how much you know about finance, or even how vulnerable you feel, but what you actually do when the next suspicious link, message or offer appears on your screen.

Subject of Research: Behavioural and cognitive determinants of cybercrime victimisation and its financial and mental health consequences

Article Title: Behavioural and cognitive determinants of financial loss and mental health deterioration following cybercrime victimisation

Article References: Baruri, S., Manikyam, S., Rejeb, A., Roy, R., & Mukherjee, S. (2026). Behavioural and cognitive determinants of financial loss and mental health deterioration following cybercrime victimisation. Discover Social Science and Health. https://doi.org/10.1007/s44155-026-00468-6

Image Credits: AI Generated

DOI: 10.1007/s44155-026-00468-6

Keywords: cybercrime, cybersecurity awareness, mental health, financial loss, digital lifestyle, risky online behaviour, victimisation, structural equation modelling, routine activity theory, protection motivation theory, financial literacy, online fraud