Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

42
© 2021 Financial Industry Regulatory Authority, Inc. All rights reserved. 1 Cybersecurity Straight Talk Thursday, October 28 12:00 p.m. 12:45 p.m. It is crucial that small financial firms take proper cybersecurity measures to protect their clients and firm. Join FINRA staff and industry panelists as they discuss the “why” behind threat -informed effective practices applicable to small firms, and how they can fit cybersecurity into their already overloaded schedule. Moderator: David Kelley Director, Member Supervision Specialist Program, Cybersecurity Program FINRA Member Supervision Panelists: Peter Falco Director of Broker Dealer Services Financial Services Information Sharing and Analysis Center (FS-ISAC) Jennifer Szaro, CRCP ® Chief Compliance Officer XML Securities, LLC

Transcript of Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

Page 1: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

© 2021 Financial Industry Regulatory Authority, Inc. All rights reserved. 1

Cybersecurity Straight Talk Thursday, October 28 12:00 p.m. – 12:45 p.m.

It is crucial that small financial firms take proper cybersecurity measures to protect their clients and firm. Join FINRA staff and industry panelists as they discuss the “why” behind threat-informed effective practices applicable to small firms, and how they can fit cybersecurity into their already overloaded schedule. Moderator: David Kelley Director, Member Supervision Specialist Program, Cybersecurity Program FINRA Member Supervision Panelists: Peter Falco Director of Broker Dealer Services Financial Services Information Sharing and Analysis Center (FS-ISAC) Jennifer Szaro, CRCP® Chief Compliance Officer XML Securities, LLC

Page 2: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

© 2021 Financial Industry Regulatory Authority, Inc. All rights reserved. 2

Cybersecurity Straight Talk Panelist Bios: Moderator:

Dave Kelley, Director, Member Supervision Specialist Programs, is based out of FINRA’s Kansas City office. He has been with FINRA for more than 11 years and leads the specialist team dealing with cybersecurity and information technology controls. Prior to joining FINRA, he worked for more than 19 years at American Century Investments in various positions, including Chief Privacy Officer, Director of IT Audit, Director of Electronic Commerce Controls and AML Officer. He led the development of website controls, including customer application security, ethical hacking programs and application controls. Mr. Kelley is a CPA and Certified Internal Auditor, and previously held the Series 7 and 24 licenses.

Panelists: Peter Falco is the director of broker dealer services of the Financial Services Information Sharing and Analysis Center (FS-ISAC). FS-ISAC is the only global cyber intelligence sharing community solely focused on financial services. Its mission is to reduce cyber risk in the global financial system. Mr. Falco works specifically with member firms in the securities and investment industry such as broker dealers, asset managers and hedge funds. Over the past six years, Mr. Falco established the Securities Industry Risk Group (SIRG) at FS-ISAC, a forum for members in the securities industry to discuss cyber and physical threats, best practices, and compliance regarding cybersecurity. Previously, Mr. Falco spent more than a decade as Senior Vice President and Technical Officer for Roosevelt & Cross Inc., a broker dealer

based in New York City. At Roosevelt & Cross, Mr. Falco oversaw all the firm’s technology and co-authored the firm’s business continuity plan. Mr. Falco has worked in various technology management roles, including at UPS, IBM, and Prudential.

Jennifer Szaro is Chief Compliance Officer for XML Securities, LLC a fully disclosed introducing broker/dealer and its affiliated investment advisory firm, XML Financial Group. Ms. Szaro is responsible for managing both firms' compliance infrastructures. Ms. Szaro joined the securities industry in 2000. She previously worked in the technology sector where she had experience in ecommerce, website hosting and product development. As the securities industry went through significant changes with higher regulatory demands, she took on more compliance and marketing related roles. In 2011, she became a senior level executive and Chief Compliance Officer of the broker dealer, then dually registered. In addition to her current role as CCO, she is the AMLCO, and alternative FINOP. In 2012, she completed FINRA’s Certified Regulatory and Compliance Professional Program (CRCP)®. In

2018, she became a non-public FINRA Dispute Resolution Arbitrator, having qualified through the National Arbitration and Mediation Committee. In 2019, she was appointed to serve out a two-year term on the FINRA’s Small Firm Advisory Committee (SFAC), serving as the 2020 Chair. She was re-appointed to serve a three-year term through 2023. Ms. Szaro holds the following FINRA registrations; Compliance Officer (CR), Introducing Broker-Dealer Financial and Operations Principal (FI), General Securities Principal (GP), General Securities Representative (GS), Investment Company and Variable Contracts Products Representative (IR), Municipal Securities Principal (MP), Municipal Securities Representative (MR), and Operations Professional (OS). Ms. Szaro is a graduate from the University of Rhode Island with a Bachelor of Science.

Page 3: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

Cybersecurity Straight Talk

Page 4: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

2

Panelists

Copyright 2021 FINRA Small Firm Conference

o Moderator• David Kelley, Director, Member Supervision Specialist Program,

Cybersecurity Program, FINRA Member Supervision

o Panelists• Peter Falco, Director of Broker Dealer Services, Financial

Services Information Sharing and Analysis Center (FS-ISAC)

• Jennifer Szaro, CRCP®, Chief Compliance Officer, XML Securities, LLC

Page 5: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

© 2020 Financial Industry Regulatory Authority, Inc. All rights reserved. 1

Cybersecurity Straight Talk Thursday, October 28

12:00 p.m. – 12:45 p.m.

Resources:

• FINRA’s Cybersecurity Page

www.finra.org/rules-guidance/key-topics/cybersecurity

• FINRA Regulatory Notice 20-30, Imposter Registered Representative Websites, Fraudsters Using Registered Representatives Names to Establish Imposter Websites (August 2020)

Website: www.finra.org/rules-guidance/notices/20-30 PDF: www.finra.org/sites/default/files/2020-08/Regulatory-Notice-20-30.pdf

• Information Notice – 3/26/20, Cybersecurity Alert: Measures to Consider as Firms Respond to the Coronavirus Pandemic (COVID-19) (March 2020)

Website: www.finra.org/rules-guidance/notices/information-notice-032620 PDF: www.finra.org/sites/default/files/2020-03/Information-Notice-032620.pdf

• Information Notice – 4/29/19, Imposter Websites Impacting Member Firms (April 2019)

Website: www.finra.org/rules-guidance/notices/information-notice-042919 PDF: www.finra.org/sites/default/files/2019-04/Information-Notice-042919.pdf

• FS-ISAC Home Page

www.fsisac.com/

Page 6: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

Exposed to ScamsWHAT SEPARATES VICTIMS FROM NON-VICTIMS?

SEPTEMBER 2019

Page 7: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

AUTHORS

Marti DeLiema, Ph.D.Stanford Center on Longevity

Emma FletcherFederal Trade Commission1

Christine N. KiefferFINRA Foundation

Gary R. Mottola, Ph.D.FINRA Foundation

Rubens Pessanha, Ed.D., MBA, PMP, GPHR, SPHR, SHRM-SCPInternational Association of Better Business Bureaus, Inc.

Melissa “Mel” TrumpowerBBB Institute for Marketplace Trust

Exposed to ScamsWHAT SEPARATES VICTIMS FROM NON-VICTIMS?

ACKNOWLEDGMENTS

The authors would like to thank Craig Honick of Metro Tribal for his work on survey design and data collection, and Susan Arthur for her comments on earlier drafts of the paper. We would also like to thank the Better Business Bureau for access to data from their BBB Scam Tracker database and the FINRA Foundation for funding the research.

1 The views expressed herein are her own and not necessarily those of the Commission or any individual Commissioner.

Page 8: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

1

Victimization by scams and fraud depends,

in part, on two-way engagement between

the target of the scam and the fraudster.

Some individuals simply do not engage

with a scammer; others engage but at some

point recognize the deception and cease

engagement. Still others engage with the

fraud and lose money (sometimes a lot of

money). Despite the enormous personal and

financial costs of fraud victimization, little

is understood about the factors that

differentiate these three groups.

In this survey of 1,408 Americans and Canadians

who were targeted and reported a scam, nearly

half (47 percent) did not engage with the

fraudster and so were not victimized. Thirty

percent engaged but did not lose money, yet

23 percent engaged and ultimately lost money.

The type of scam and the method by which the

respondents were exposed to the offer were

highly associated with engaging and losing

money. Specifically, scams involving online

purchases correlated with the highest levels

of engagement and victimization. With regard

to modality, survey respondents who engaged

and became victims were more likely to report

being exposed to those scams on a website

or through social media than via telephone,

mail, or email. Social isolation and low levels

of financial literacy were also associated with

engaging and losing money. This research

also found that prior knowledge of scams and

fraud can reduce susceptibility.

Summary

Page 9: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

2

Approximately one in ten U.S. adults are victims of fraud each

year (Anderson, 2013), and self-reported fraud loss complaints

to the Federal Trade Commission’s (FTC) Consumer Sentinel

Network increased by about 34 percent from 2017 to 2018

(authors’ calculations using FTC consumer complaint data).

The FTC received more than 372,000 fraud complaints with

more than $1.5 billion in direct losses in 2018, and another 1.1

million fraud complaints with no reported losses (FTC, 2019).

In 2017 and 2018, the FINRA Investor Education Foundation,

in concert with BBB Institute for Marketplace Trust and the

Stanford Center on Longevity, sponsored a study to uncover

the process of fraud victimization and understand the factors

associated with losing money. The study involved a comparison

of those exposed to a scam who lost money (victims) to those

exposed to a scam who successfully avoided losing money

(targets). The goal of the research was to better understand

the conditions under which scam targets do not become

victims in order to develop more focused and effective public

education based on those protective factors.

All participants in this two-phase study reported a fraud

to BBB Scam TrackerSM, an online fraud reporting tool of

the Better Business Bureau. The first phase of the research

comprised one-hour interviews with 18 consumers, some

of whom reported being a scam victim (monetary loss)

and others who reported being targets but not victims

(no monetary loss). In the second phase of the study, the

research team administered a 15-minute online survey to 1,408

consumers who filed a fraud tip or report through BBB Scam

Tracker (see Methodology section for more details). The survey

questions were informed by the qualitative findings from the

first phase of the research, and the survey results are the focus

of this issue brief. The survey sample skewed older, female, and

college-educated. Sample sociodemographic characteristics

are shown in Appendix A.

The most common scams that participants in the survey

reported to BBB Scam Tracker were tech support (n=225),

bogus tax collection (i.e., “the IRS scam”; n=200), phishing

(n=200), and online purchase scams (n=158).2

2 Prevalence and victimization rates reported in this brief refer only to the survey sample. They do not reflect the rates of victimization for all individuals who reported fraud to BBB Scam Tracker. This information can be found in the annual BBB Scam Tracker Risk Reports available at BBB.org/BBBScamTrackerRiskReport.

BACKGROUND

Page 10: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

3

Level of EngagementThe first step to being victimized by a scam is to engage with a

fraudster, so it is heartening to see that nearly half (47 percent) of

survey respondents rejected the offer outright (Figure 1). They hung

up the phone, closed the link, ignored the email, threw away the mailer,

deleted the friend request, or otherwise refused to comply. This refusal

to engage was the predominant response in bogus tax and other debt

collection scams, and in phishing scams where fraudsters impersonate

a trustworthy entity to mislead the target into giving them money.

However, 30 percent of respondents engaged to some degree, but

ultimately did not lose money, while 23 percent engaged with the

fraudster or offer and lost money.

FIGURE 1Engagement in the Fraudulent Offer

23%

30%

47%

Engaged and victimized

Engaged and not victimized

Did not engage

NOTE: 33 respondents could not be categorized due to their uncertainty about the incident.

FACTORS RELATED TO VICTIMIZATION

It is heartening to see that nearly half of survey respondents rejected the

scam offer outright.

Page 11: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

4

Type of ScamVictimization rates in this sample varied dramatically by scam type.

Among the fraud categories with more than 50 respondents, the highest

victimization rates were (Table 1) online purchase scams, tech support

scams, employment scams, and fake check/money order scams.3 The

victimization rates were very low for phishing and tax collection scams.

Median losses in this survey were $600, while median losses in the 2018

BBB Scam Tracker Risk Report were only $152. Those who filed BBB

Scam Tracker reports with higher loss amounts may have been more

motivated to respond to the survey to share their experience.

3 See Appendices B and C for counts of all the scam types reported and descriptions of the scam types.

4787

3264

2581

2264

SCAM TYPE % ENGAGED % LOST $ # OF REPORTS

% LOST $ % ENGAGED

SCAM TYPE % ENGAGED % LOST MONEY # OF REPORTS

Online Purchase 15747%84%

Employment 10625%81%

Tech Support 22532%64%

Fake Check / Money Order 10622%64%

Sweepstakes / Lottery / Prizes 5415%59%

Debt Collection 11212%38%

Phishing 1994%18%

Tax Collection 2003%15%

TABLE 1Engagement and Victimization Rates by Scam Type

The highest victimization

rate was online purchase scams.

Page 12: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

5

Method of ContactWhether or not a person engaged with the scam and lost money was

highly associated with the method in which they were exposed to the

offer (Table 2). Phone and email were the most common methods of

contact, but relatively few respondents reported losing money as a result

of these scams. For example, 39 percent of respondents who said they

were contacted by phone engaged with a scammer and only 11 percent

lost money. In contrast, of those contacted by email, 42 percent engaged

with the scammer and only 13 percent lost money. Of those who said

they were exposed to a scam on social media, 91 percent engaged

and 53 percent lost money. Similarly, 81 percent of respondents who

were exposed to a fraud via a website said they engaged and

50 percent lost money.

HOW THE SCAM BEGAN % ENGAGED % LOST MONEY # OF REPORTSHOW THE SCAM BEGAN % ENGAGED % LOST MONEY # OF REPORTS

Phone Call / Voice Mail 55311%39%

Website 12350%

91%

Email 34013%42%

Social Media 7053%

81%

Postal Mail 5812%40%

NOTE: We did not compute statistics for categories with less than 50 observations. Number of reports does not total 1,408 due to missing data on how the scam began.

TABLE 2Engagement and Victimization Rates by Type of Contact

81% of respondents

who were exposed to

a fraud via a website said

they engaged.

Page 13: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

6

Self-Reported Reasons for EngagingUsing a seven-point Likert scale, where “1” was strongly disagree and

“7” was strongly agree, we asked those who engaged with the scam a

series of questions to understand the factors leading to monetary loss.

As shown in Figure 2, on a range of factors that the qualitative portion

of this study suggested were related to fraud victimization, respondents

who engaged and lost money scored higher than respondents who

engaged and did not lose money. For example, the more a respondent

felt that the person/organization seemed official, the more likely they

were to lose money. Respondents were also more likely to lose money

the more they felt under time pressure, believed the opportunity would

help them get ahead financially, felt that it was "their time" and that they

deserved to be rewarded, wanted to make good on past mistakes, and/

or were intimidated by the person they were dealing with. Those who

lost money were also more likely to agree that they wanted to impress

the person they were dealing with and worried about missing out on an

opportunity. All of these differences were statistically significant at p<.01.

These findings align with common persuasion techniques that fraudsters

use to convince targets to comply (Cialdini, 2001).

“ Sounded like a

sheriff’s deputy and he was threatening me with immediate

arrest if I didn’t comply.”

“ I was caught

off guard and insufficiently

informed.”

FIGURE 2Perceptions of the Fraudster and the Scam Associated with Financial Loss

Average responses from respondents who:

DID NOT LOSE MONEY LOST MONEY

I was under time pressure.

I thought the person was nice.

I worried about missing out on an opportunity.

They seemed to know personal details about me.

I felt intimidated.

I had an opportunity to get ahead financially.

I deserved to be rewarded.

I had an opportunity to make good on past mistakes.

I wanted to please the person I was dealing with.

I felt afraid of being punished.

They seemed official.

1 2 3 4 5 6 7

Strongly Disagree Strongly Agree

1 2 3 4 5 6 7

Page 14: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

7

4 Compared to the average individual who reported fraud to BBB Scam Tracker, the survey sample skewed older. Age differences would likely be greater if the sample was representative of all reporters in the BBB Scam Tracker database.

5 Respondent scores on these three loneliness items (range=1-3) were summed for the analysis (range=3-9).

DemographicsWe found small to no difference in engagement behavior or victimization

rates by gender, ethnicity, education, or employment status, though we

did find an age-based effect. On average, those who lost money were

2-3 years younger than those who were targeted for a scam but did not

engage.4 This is consistent with published data on fraud reports to both

the FTC’s Consumer Sentinel Network and BBB Scam Tracker — older

adults report more scams in which they were targeted but not victimized

compared to younger adults who are more likely to report scams that

resulted in financial loss (BBB Institute, 2019; FTC, 2019). Further, those

who engaged and lost money were less likely to be married and more

likely to be widowed or divorced.

Respondents were more likely to be victimized if they did not have

anyone to discuss the offer with. It is noteworthy that single, divorced,

and widowed respondents were more likely to indicate that they did not

have anyone to discuss things with compared to married respondents

and those living with a partner. Those who engaged, in general, and those

who lost money expressed significantly higher feelings of loneliness.

Specifically, losing money was associated with more frequent feelings

of being left out, lacking companionship, and being isolated from others

(meanvictim=4.5, meannon-victim=4.0 , p<.001).5

Financial Insecurity Prior work by Anderson (2013) and AARP (2003) has indicated that

individuals who are under financial strain might be more susceptible to

scams, especially scams that promise financial rewards or an opportunity

to get out of debt. In the present study, low household income ($50,000

and below) was significantly associated with engaging and losing money

in a scam (p<.001). In addition, those who lost money were significantly

more likely than non-victims to show signs of financial insecurity. This

included reporting that they spend more than their monthly income

(23 percent versus 17 percent; p=.017), and that they “probably could

not” or “certainly could not” come up with $2,000 if an unexpected

need arose within the next month (38 percent versus 20 percent; p<.001).

Victims were also significantly more likely to agree with the statement

“I have too much debt right now” (meanvictim=3.6 meannon-victim=3.1 out of

seven, p=.001). Levels of financial insecurity varied by scam type. For

example, respondents who reported advance fee loan, investment, and

sweepstakes/lottery/prizes scams were more likely than other reporters

to show signs of financial insecurity. It is also possible that the scams

themselves contributed to the financial insecurity of the victims.

“ I was overwhelmed

with student loan debt.”

Respondents were more likely to be victimized

if they did not have anyone

to discuss the offer with.

Page 15: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

8

Financial LiteracyParticipants were asked five questions to gauge their financial

knowledge. As seen in Figure 3, those who ended the scam attempt

immediately scored significantly higher on this five-item quiz, an average

of 3.3 correct answers out of a total of five.6 The average score of those

who engaged with the scam was 3.0, and of those who lost money

was 2.7 (p<.001).7

6 The five financial literacy quiz questions can be found at USFinancialCapability.org/quiz.php.7 Kieffer and Mottola (2017) and AARP (2007) found that higher levels of financial literacy were associated with higher

fraud victimization rates. However, these papers examined investment fraud, and it is possible that some victim characteristics vary by scam type. Investment fraud victims make up less than 2 percent of the current sample.

FIGURE 3Financial Literacy by Engagement: Mean Number of Questions Answered Correctly Out of 5

Did Not Engage

3.3 Engaged But Did Not Lose Money

3.0 Engaged And Lost

Money

2.7

Those who ended the scam attempt immediately scored significantly higher.

Page 16: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

9

Intervention By Organizations — The Role Of Structural Protections

Among those who engaged with the scam,

20 percent reported that an organization,

company, or agency intervened or tried

to intervene to stop the scam. People

described interventions by bank tellers and

employees of wire transfer services and

other financial services companies. Some

organizations train their frontline employees

to recognize the indicators of fraud (e.g.,

large cash bank withdrawals or purchases

of high-dollar value gift cards). The survey

results show that 51 percent of people who

reported a third-party intervention were able

to avoid losing money. This is a promising

finding given that these interventions

generally occur at a point when consumers

are on the cusp of sending money to a

scammer (e.g., at a store checkout counter

buying gift cards). The work of cashiers,

bank tellers, and other vigilant employees

can serve as an important last line of

defense for consumers who might

otherwise become fraud victims.

We know from previous studies that

individuals engaging with scammers are

likely to be in a heightened emotional

state that impairs their ability to respond

appropriately to misleading information

(Kircanski et al., 2018). Further, in many

cases, fraudsters have developed scripts

designed to negate intervention by third

parties, such as telling their targets not to

speak to anyone and even coaching them on

how to respond to a cashier’s or bank teller’s

questions and protests. Additional research

in this area could help businesses and others

who are well-positioned to intervene to

develop more effective training programs

and intervention techniques.

“ I called my credit

card [provider]  on another phone,

gave her the billing name and

she said, ‘Hang up.’”

“ I took the check to

the bank, they notified me [it] was fraud.”

Page 17: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

10

The survey also sought to gauge how respondents view scam

victims, in general. A large percentage of respondents believe

that victims of fraud are gullible — from a high of 43 percent

for those who did not engage to a low of 36 percent for those

who lost money (Figure 4). It is noteworthy that nearly a third

of those who lost money believe it is likely the victims’ fault for

being defrauded. When asked if scam victims lack common

sense, only 13 percent of victims believe that to be true,

compared to a third of those who did not engage.

Reporting rates for fraud and scams are low, and it is possible

that widely held negative views associated with victims

contributes to a person’s reluctance to admit that they

were scammed. This could also deter victims from seeking

assistance in dealing with the consequences of fraud, whether

financial, psychological, or emotional assistance. Earlier work

by the FINRA Foundation (2015) found that the non-financial

costs of fraud (e.g., stress, health problems) are widespread

among victims, and nearly two-thirds (65 percent) report

experiencing at least one type of non-financial cost to a

serious degree. The FINRA Foundation study also found

that 47 percent of victims blamed themselves. These findings

suggest that victim support groups could play an important

role in destigmatizing the experience and helping those who

have lost money recover from fraud.

PERCEPTION OF VICTIMS

“ Looking back, it was so obvious that it was a scam. I guess I wanted it to be true. I didn’t read the comments until it was too late. I’m so embarrassed.”

FIGURE 4How Victims Are Viewed

Did Not Engage

Engaged and Not Victimized

Engaged and Victimized

% AGREEING:

0 20 40 60 80 100

Figure 4. How victims are viewed

Lack Common

Sense

Blame the Victim

Victim Gullible

31%23%

13%

26%

43%

26%

39%

29%

36%

Page 18: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

11

“ I suspected it was a scam very early on,

but I didn’t pay attention to my

instincts.”

8 We do not have these data on victims because we logically could not ask victims what helped prevent them from being victimized.

FIGURE 5Factors Associated with Not Being Victimized

Knowledge is PowerKnowing about specific types of scams and understanding the general

tactics that scammers use can help a scam target avoid becoming a

victim. In this survey, 30 percent of respondents who did not engage

knew about the scam before they were targeted compared to 12 percent

of people who engaged but were not victimized (Figure 5). Respondents

who had heard about the scam before were significantly less likely to

lose money (9 percent versus 34 percent, p<.001). Among respondents

who did not engage with the scammer, almost half (49 percent) reported

knowing about the methods and behaviors of scammers in general

compared to only 25 percent of those who did engage but were not

victimized. Those who did not engage were also more likely to say

they had experience with scams than those who engaged but were not

victimized, 19 percent versus 11 percent, respectively. This indicates that

having prior knowledge about fraud, even generally, is particularly helpful

in avoiding victimization.

The majority of fraud targets did not report looking into the scam or the

scammer while they were being targeted. For instance, among those who

did not engage, 17 percent researched the offer and 10 percent checked

the background of the scammer. For those who engaged but were not

victimized, 26 percent researched the offer, and 16 percent checked

the background of the scammer. Last, among those who engaged but

were not victimized, by far the most common reason cited for not being

victimized was that they felt something was not right about the situation.8

PREVENTING FINANCIAL FRAUD

Engaged and Not Victimized

Did Not Engage

0 20 40 60 80 100

Figure 5Factors Associated with Not Being Victimized

25%

12%

26%

71%

11%

16%

49%

30%

17%

49%

19%

10%

Knew About Methods of Scammers

Felt Something Was Not Right

Knew About Scam Type

Had Experience with Scams

Researched the Scam/Offer

Checked Background of Scammer

Page 19: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

12

Among respondents who engaged, those who chose not to discuss the

solicitation with anyone while it was happening were significantly more

likely to lose money, as were those who did not have anyone available to

discuss it with.

“ I talked to my kids and they said they

were pretty sure it was a scam.”

In the Targets’ Own Words

Respondents who were

suspicious about the offer but

who continued to engage were

asked what would have helped

them avoid engaging altogether.

One individual stated, “…if I

had done the research before

making the purchase.” Other

suggestions were to speak with

someone prior to engaging,

use other websites to verify the

pricing of the product, check

the BBB website for complaints

about the organization, and

search for the address of the

organization on Google Maps.

One person said, “not being

distracted.” Recommendations

also included looking for clues

that the offer is fake, such

as misspelled words in the

message or a spoofed

email address.

“ Take some time to

evaluate rather than proceeding quickly.”

Page 20: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

13

Where do victims and non-victims learn about fraud?We asked respondents what they believed would be a good source

of information on fraud and scams, and where they have actually

received such information. While nearly half (48 percent) believed

websites would be a good source of information, few actually reported

obtaining information about fraud and scams from websites (Figure 6).

It is noteworthy that 42 percent of respondents believed that a public

service announcement (PSA) on TV or radio would be helpful, but few

respondents (15 percent) noted this as an actual source of information

where they previously learned about fraud, likely because PSAs about

scams are not very common. News stories were, by far, the most popular

answer. Conversely, while respondents did not believe word of mouth

is a particularly good source of information about scams, more than

40 percent of respondents said they had obtained information about

frauds in this way. Educational brochures and in-person meetings/

seminars were infrequently mentioned as good or actual sources of

information about scams and fraud. However, they may have an indirect

effect on reducing fraud by fueling the communication of information

on frauds by word of mouth. While it is beyond the scope of this study

to determine the actual effectiveness of sources of information, these

findings suggest that the news media has an important role to play in

making consumers aware of scams.

FIGURE 6Sources of Information About Scams What would be a good source to learn about scams?

Where do you learn about scams?

Figure 6. Sources of Info

0

20

40

60

80

100

TV/RADIO PUBLIC SERVICE ANNOUNCEMENT

EDUCATIONAL BROCHURE

NEWS STORY

WEBSITE SOCIAL MEDIA

WORD OF MOUTH

IN-PERSON MEETING/SEMINAR

55%

22%

15% 16%

41%

3% 4%

64%

48%

42%

27%22%

13%

7%

News stories were, by far,

the most popular answer.

Page 21: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

14

The path to victimization begins with engagement, and there

are a number of factors that increase the likelihood of both

engaging with a fraudulent offer and losing money.

The manner in which consumers are contacted plays a significant role in whether or not they engage and become victims. Because those contacted via digital

means (social media and website) appear from this

study to have high engagement and victimization rates,

consumers should be particularly careful when sending

money based on a digital message or ad.

The perception that a fraudster is “official” is highly associated with victimization. As titles and designations

are easily faked, consumers should independently verify

the identity of anyone who claims to be an authority

and asks for money or information (e.g., call the

agency directly to confirm, or use an online tool

such as FINRA BrokerCheck).

Financial insecurity appears to increase the likelihood of

victimization, as do low levels of financial literacy.

More than half of people who reported a third-party intervention were able to avoid losing money. This is

a promising finding and speaks to the potential of this

approach to reduce fraud victimization given these

interventions generally occur at a point when consumers

are on the cusp of sending money to a scammer.

In terms of protective factors, knowledge is power. Prior knowledge about fraud, even generally, is

particularly helpful in avoiding victimization.

Before complying with a solicitation, consumers should consult with those around them to verify the legitimacy

of the offer or the threat. This strategy is helpful because

it harnesses collective knowledge about scams and

persuasion tactics from friends, family, neighbors, and

whoever else is present at the time of the solicitation.

These people might encourage the target to pause

and take time to assess the situation.

IMPLICATIONS

In terms of protective factors, knowledge is power.

Page 22: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

15

Incorporating these protective behaviors into routine interactions with

sellers and other agents of influence could help consumers avoid fraud,

but knowing about common scams and the tactics of persuasion ahead

of time is potentially even more effective at preventing fraud than doing

research in the moment. “Trusting your gut” when you sense something

might be wrong with a situation can also serve as a protective factor.

However, if your instincts are leading you in the opposite direction and

telling you to engage, “trusting your gut” could lead to victimization.

Therefore, a wise strategy is to pause, talk it over with others, and

do some research before sending any money or sharing personally

identifiable information.

Further, given the generally negative perception of victims, support

groups can help individuals who have experienced fraud cope with the

social and emotional consequences. And the news media can play a role

in spreading awareness of how to spot, avoid, and report scams. The

media can also help send an empowering message, and perhaps change

the negative stigma associated with victimization, by giving people who

have experienced a scam the opportunity to help others by sharing

their story.

Knowing about common scams and persuasion tactics ahead of time is potentially even more effective at preventing fraud than doing research in the moment.

Page 23: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

16

More than 90,000 individuals who submitted a fraud report

to BBB Scam Tracker between 2015 and 2018 were invited

by email to participate in a 15-minute survey seeking to

understand why people are targeted for scams, with the

goal to craft better interventions for safeguarding people

against them. The survey was fielded in August 2018, and

we received 1,408 eligible responses.9 Before entering the

survey, participants read an online consent form and agreed to

participate. The study was reviewed and approved by Sterling

IRB. No personally identifying information was collected.

Respondents who initially submitted a fraud report to BBB

Scam Tracker on behalf of someone else, meaning that they

were not the targets of the solicitation, were discontinued

from the survey.

While the sample size is large enough to detect statistically

significant differences between groups, we caution that this

does not mean that the findings are representative of the

broader population of fraud targets and victims. As a result of

response bias, which is common to many surveys, those who

responded might differ from individuals who did not submit a

fraud report to BBB Scam Tracker and those who do not recall

or acknowledge losing money in a scam at all. Future studies

should compare these findings with findings using samples of

independently identified victims.

Prior to fielding the survey, 18 individuals recounted their

experience with scam attempts during in-depth interviews

(conducted in person or online via video). These first-hand

accounts, video-recorded either in the subjects’ homes,

at locations near their homes, or online, vividly chronicled

the persuasion tactics scammers used; revealed situational

characteristics of the scam encounters; and surfaced

the personal knowledge, beliefs, and values of the scam

targets themselves, all potential factors in the outcome

of scam attempts.

METHODOLOGY

9 Responses were dropped if the respondent did not complete the survey or if they did not answer a data integrity check question correctly.

Page 24: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

17

Marti DeLiema, Ph.D., is an assistant professor of research at the University of Minnesota, Twin Cities, in the

School of Social Work. Her research focuses on identifying the correlates of financial fraud in the US and the

factors related to elder financial victimization. Dr. DeLiema received her Ph.D. in gerontology from the

USC Davis School of Gerontology and completed a postdoc at the Stanford Center on Longevity.

Emma Fletcher joined the Federal Trade Commission’s Bureau of Consumer Protection in 2017 as a Presidential

Management Fellow. She previously served in the Division of Consumer and Business Education and currently

serves in the Division of Consumer Response and Operations, focusing on projects at the intersection of data

analysis and consumer education. Ms. Fletcher has authored several of the FTC’s Consumer Protection Data

Spotlight publications, exploring trends seen in reports to the FTC’s Consumer Sentinel Network. She previously

worked as the director of scam and fraud initiatives at the Better Business Bureau. Ms. Fletcher received her

B.S. in psychology from James Madison University and holds a master’s degree in public administration from

George Mason University.

Christine N. Kieffer is senior director of the FINRA Investor Education Foundation with 20 years of financial

and investor education experience. She manages national, state, and grassroots partnerships, and develops

tools and programs for law enforcement, victim advocates, and consumers to advance investor protection and

fraud prevention initiatives. Her role includes directing research, primarily related to financial fraud. Ms. Kieffer also

oversees financial readiness programs for military families and other underserved audiences. Ms. Kieffer received

her B.S. from Vanderbilt University with double majors in economics and mathematics.

Gary R. Mottola, Ph.D., is the research director for the FINRA Investor Education Foundation and a social

psychologist with more than 25 years of research experience. In his role at the FINRA Foundation, he oversees

and conducts research projects aimed at better understanding financial capability in America, protecting

investors from financial fraud, and improving financial disclosure statements. Dr. Mottola received his B.A. from

the University at Albany, M.A. from Brooklyn College, and Ph.D. from the University of Delaware. He was a visiting

scholar at Wharton in 2006 and is an adjunct professor of statistics in Villanova University’s MBA program.

Rubens Pessanha, Ed.D., MBA, PMP, GPHR, SPHR, SHRM-SCP, senior director of research & development at the

International Association of Better Business Bureaus, has more than 20 years of global experience in marketing,

strategic organizational development, project management, and market research. He has presented at conferences

in North America, Asia, Europe, Africa, and South America. A production engineer with an MBA, he completed his

doctorate at George Washington University. He is the co-author of the BBB Scam Tracker Risk Report (2016 and

2017), Scams and Your Small Business (2018), Cracking the Invulnerability Illusion (2016), The State of Cybersecurity

(2017 and 2018), the BBB Trust Sentiment Index (2017), 5 Gestures of Trust (2018) and the BBB Industry Research

Series - Airlines (2018). As a hobby, Dr. Pessanha teaches project management, business ethics, strategy and

marketing for graduate and undergraduate students.

Melissa “Mel” Trumpower is executive director of the BBB Institute for Marketplace Trust, the educational

foundation of the Better Business Bureau. In addition to overseeing BBB Institute, Ms. Trumpower manages the

BBB Scam Tracker program and is co-author of the BBB Scam Tracker Risk Report (2017 and 2018) and Scams and

Your Small Business (2018). Ms. Trumpower has more than 25 years of nonprofit leadership experience, working

with a wide range of nonprofit organizations and trade associations, including Good360, the National Wildlife

Federation, IFES, and the National Endowment for Democracy. Ms. Trumpower has a B.S. from Cornell University

and a M.A. from Johns Hopkins University.

AUTHORS

Page 25: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

18

AARP (2003). Off the Hook: Reducing Participation in Telemarketing Fraud. AARP

Consumer Education: Washington, DC. Retrieved from https://assets.aarp.org/rgcenter/consume/d17812_fraud.pdf

AARP (2007). Stolen Futures: An AARP Washington Survey of Investors and

Victims of Investment Fraud. Washington, DC: AARP.

Anderson, K. B. (2013). Consumer Fraud in the United States, 2011: The Third

FTC Survey. Federal Trade Commission, Washington, DC. Retrieved from

https://www.ftc.gov/sites/default/files/documents/reports/consumer-fraud-united-states-2011-third-ftc-survey/130419fraudsurvey_0.pdf

BBB Institute for Marketplace Trust (BBB Institute) (2019). Tech-Savvy

Scammers Work to Con More Victims: Scam Tracker Risk Report (2018).

https://www.bbb.org/bbbscamtrackerriskreport

Cialdini, R. B. (2001). Influence: Science and Practice (4th ed.). Boston:

Allyn and Bacon.

Federal Trade Commission (FTC) (2019). Consumer Sentinel Network data

visualizations as of March 31, 2019. Washington, DC. Retrieved from

https://public.tableau.com/profile/federal.trade.commission#!/

FINRA Investor Education Foundation (2015). Non-Traditional Costs of Financial

Fraud: A Report of Survey Findings. Applied Research and Consulting.

Retrieved from https://www.saveandinvest.org/file/document/ non-traditional-costs-financial-fraud-survey-findings

Kieffer, C. and Mottola, G. (2017). Understanding and Combating Investment

Fraud. In O. Mitchell, P. Hammond, and S. Utkus (eds.), Financial Decision

Making and Retirement Security in an Aging World. Oxford: Oxford University

Press, pp. 185-212.

Kircanski, K., Notthoff, N., DeLiema, M., Samanez-Larkin, G. R., Shadel, D., Mottola,

G., and Gotlib, I. H. (2018). Emotional arousal may increase susceptibility to

fraud in older and younger adults. Psychology and Aging, 33(2), 325–337.

Rotter, J. B. (1966). Generalized expectancies for internal versus external

control of reinforcement. Psychological Monographs: General and Applied,

80(1), 1–28.

REFERENCES

Page 26: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

19

APPENDIX A

APPENDIX B

Sample Characteristics

SOCIODEMOGRAPHIC CHARACTERISTIC STATISTIC

Average Age 56

Female 66%

Household Income > $50,000 55%

College Degree 73%

Non-Hispanic White 80%

Married 54%

Unemployed 3%

Scam Types Reported

SCAM TYPE NUMBER OF REPORTS

Tech Support 225

Tax Collection 200

Phishing 199

Online Purchase 157

Other10 127

Debt Collection 112

Employment 106

Fake Check/Money Order 106

Sweepstakes/Lottery/Prizes 54

Government Grant 36

Advance Fee Loan 32

Travel/Vacations 31

Investment 23

10 Respondents were asked to select the type of scam they reported to BBB Scam Tracker. In order to reduce the cognitive burden of completing the survey, scam categories that were not well-represented in BBB Scam Tracker were not presented to the respondents. As a result, fewer than half of BBB Scam Tracker’s scam categories were presented to respondents. If the respondent did not see their scam, they had the option of choosing “Other” and specifying the scam in writing. As expected, the “Other” category made up less than 10 percent of the total responses. For a list and description of all scams reported to BBB Scam Tracker, see Tech-Savvy Scammers Work to Con More Victims: BBB Scam Tracker Risk Report (2018).

Page 27: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

20

APPENDIX C

ADVANCE FEE LOAN

In this scam, a loan is guaranteed but once the victim pays upfront charges such as taxes or a “processing fee,” the loan never materializes.

DEBT COLLECTION In this scam, phony debt collectors harass their targets, trying to get them to pay debts they don’t owe.

EMPLOYMENT

Targets are led to believe they are applying or have just been hired for a promising new job while they have, in fact, given personal information or money to scammers for “training” or “equipment.” In another variation, the target may be “overpaid” with a fake check and asked to pay back the difference.

FAKE CHECK/ MONEY ORDER

In this scam, the victim deposits a phony check and then returns a portion by wire transfer to the scammer. The stories vary, but the victim is often told they are refunding an “accidental” overpayment. Scammers count on the fact that banks make funds available within days of a deposit, but can take weeks to detect a fake check.

GOVERNMENT GRANT

In this scam, individuals are enticed by promises of free, guaranteed government grants. The only catch is a “processing fee.” Other fees follow, but the promised grant never materializes.

INVESTMENTThese scams take many forms, but all prey on the desire to make money without much risk or initial funding. “Investors” are lured with false information and promises of large returns with little or no risk.

ONLINE PURCHASE

These scams involve purchases and sales, often on eBay, Craigslist, Kijiji or other direct seller-to-buyer sites. Scammers may pretend to purchase an item only to send a bogus check and ask for a refund of the “accidental” overpayment. In other cases, the scammer will simply never deliver the goods.

PHISHINGScammers send communications that impersonate a trustworthy entity, such as a bank or mortgage company, intended to mislead the recipient into providing personal information or passwords.

SWEEPSTAKES/LOTTERY/PRIZES

This scam fools victims into thinking they have won a prize or lottery jackpot, but need to pay upfront fees to receive the winnings, which never materialize. Sometimes this con involves a fake check and a request to return a portion of the funds to cover fees.

TAX COLLECTIONIn this scam, imposters pose as government tax collection agents and use threats of immediate arrest or other scare tactics to convince their targets to pay, often requesting that the target load money onto gift cards as payment.

TECH SUPPORT

Tech support scams start with a call or pop-up warning that alerts the target to a computer bug or other problem. Scammers pose as tech support employees of well-known computer companies and hassle victims into paying for “support.” If the victim allows remote access, malware may be installed.

TRAVEL/ VACATIONS

Scammers post listings for properties that either are not for rent, do not exist, or are significantly different than pictured. In another variation, scammers claim to specialize in timeshare resales and promise they have buyers ready to purchase.

Scam Type Descriptions

Page 28: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

ABOUT THE STANFORD CENTER ON LONGEVITY

Longer lives are, at once, among the most remarkable achievements in all of human history, and the greatest challenges of the 21st century. Whereas most discussions about aging societies are premised on the assumption that older people are frail and infirm, our premise is that problems of older people demand solutions so that the substantial increase in life expectancy can ultimately benefit individuals and societies. The mission of the Stanford Center on Longevity is to accelerate and implement scientific discoveries, technological advances, behavioral practices, and social norms so that century long lives are healthy and rewarding.

Longevity.Stanford.edu

ABOUT THE FINRA INVESTOR EDUCATION FOUNDATION

Established in 2003 by the Financial Industry Regulatory Authority, the FINRA Investor Education Foundation empowers underserved Americans with the knowledge, skills and tools to make sound financial decisions throughout life. The Foundation accomplishes this mission through educational programs and research that help consumers achieve their financial goals and that protect them in a complex and dynamic world.

FINRAFoundation.org

ABOUT THE BBB INSTITUTE FOR MARKETPLACE TRUST

The BBB Institute for Marketplace Trust (BBB Institute) is the educational foundation of the Better Business Bureau. BBB Institute works with local, independent BBBs across North America to deliver educational programs that foster a trusted marketplace by empowering consumers to take control of their purchasing decisions and avoid scams, helping businesses deliver excellent service with integrity and become integral stakeholders in their communities, and publishing research that provides critical insights for the average consumer.

BBBMarketplaceTrust.org

Page 30: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

Understanding the drivers of chronic fraud victimization and identifying key intervention strategies

MARCH 2021

Addressing the Challenge of Chronic Fraud Victimization

Page 31: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

2

Thank you to the numerous individuals who contributed time and expertise in support of this study:

RON ACIERNO, PhDDirector, Trauma and Resilience CenterVice Chair for Veterans Affairs and Professor and Louis Faillace Chair, Department of PsychiatryUniversity of Texas Health Sciences Center, Houston

C. STEVEN BAKER International Investigations SpecialistBetter Business Bureau

DEBBIE DEEM FAST Coordinator, Retired FBI Victim SpecialistFAST (Financial Abuse Specialist Team) of Ventura County

MARTI DELIEMA, PhD Assistant Research ProfessorUniversity of Minnesota School of Social Work

APRIL DEVAKLKENAERE, SBWCP, CFCI White Collar Crime ParalegalWaukesha County (WI) District Attorney’s Office

S. DUKE HAN Director, Neuropsychology Division in Family MedicineProfessor of Family Medicine, Neurology, Psychology, and Gerontology Keck School of Medicine of the University of Southern California

KRISTY HOLTFRETER Professor, Criminology and Criminal Justice Arizona State University

NAOMI KARP Consulting Research ScholarStanford Center on Longevity

DAVE NEIL KIRKMAN Retired Special Deputy Attorney General, Elder Fraud Unit(Former Employer) North Carolina Attorney General’s OfficeFraud Volunteer, AARP North Carolina

ANNA MILLS Victim Advocate Specialist Independent Contractor

LINDSAY NAKAMURA Licensed Marriage and Family TherapistCoalition for Family Harmony

HECTOR ORTIZ Senior Policy Analyst Consumer Financial Protection Bureau

DR. LOUISE A. STANGER, LCSW, CDWF, CIP, CSAT-1CEO and FounderAll About Interventions

Page 32: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

3

THE CALL TO ACTIONFinancial scams and fraud are an ongoing and rapidly escalating problem. Approximately one-in-ten U.S. adults are victims of fraud each year, losing billions of dollars annually to criminals through a variety of scams, including natural disaster scams, fake charities, fake prize promotions, and government impostor scams, such as Social Security and Medicare scams.

Researchers and advocates have sought tirelessly to understand the dynamics of financial fraud victimization, helping victims and potential targets feel more informed, equipping them to confidently navigate the fraud landscape, and empowering them to stay one step ahead of scammers. However, while intervention strategies have generally remained the same, fraud tactics continue to evolve in sophistication. New thinking is needed on how to best support the individuals and families repeatedly targeted and victimized by financial frauds and scams. The drivers behind chronic fraud victimization have remained a mystery.

In 2020, the FINRA Investor Education Foundation and the AARP Fraud Watch Network engaged Heart+Mind Strategies, a strategic consultancy, to deploy a four-phased study of chronic fraud victimization to uncover evidence-based concepts for effective interventions. The study included a literature review, interviews with subject matter experts, fraud victims and families of victims, and two expert roundtables. For a detailed explanation of the methodology, see page 12.

This report focuses on the problem of chronic fraud victimization and applies the Fogg Behavior Model to help illuminate and address the factors that contribute to victimization. Using this model, in conjunction with detailed interviews with victims and families of victims, we identified points of intervention that could serve to disrupt the cycle of chronic victimization.

THE PROBLEMSAVVY AND SKILLED SCAMMERS Scam tactics and strategies constantly shift and evolve. However, extensive research shows that scammers persistently use certain persuasion tactics to lure and sustain their victims.i In addition to building “trust” and a long term “relationship,” an astute scammer works diligently to:

• Create a heightened emotional state (e.g., playing upon fear, need, excitement, urgency)

• Make a personal connection to identify the emotional trigger of the victim

• Instill fear/make threats

• Build a notion of scarcity

• Entrench themselves into the victims’ personal life and history

• Expose the victim to positive emotional stimuli/hope (e.g., winning a prize, finding love) that engender compliance

These techniques, along with the confluence of technology advancements that have enabled the immediate transfer of funds and telecommunications, which has dramatically reduced the cost of international communication, play a fundamental role in why fraud may be more rampant than ever before.

Page 33: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

4

THE ONE-OFF VICTIMSavvy scamming techniques explain only one piece of the puzzle; deeply understanding the victim’s own reality is another critical piece.

While it is true that anyone can be a victim of fraud, it is also the case that the majority of individuals are likely to detect the fraud or scam attempt and, most of the time, avoid victimization.ii Researchers have discovered, however, that certain situations—such as being faced with a powerful sales pitch while experiencing heightened emotionsiii—can create “vulnerable” moments that may make people more susceptible to scams. When a victim is in a heightened emotional state, they are no longer thinking rationally, but, rather, reacting emotionally.

CHRONIC VICTIMS OF FRAUD

While these factors illuminate some of the drivers of victimization by any single fraud attempt, we wanted to explore more deeply the additional drivers that may lead to chronic victimization. What causes a one-time or even two-time victim to continue down a similar path, yet again? Can it simply be explained by masterful fraud techniques and continual retargeting? Or is something more foundational at play?

Hypotheses Associated with Chronic Fraud Victimization

Coming out of our expert interviews, initial workshop, and in-depth literature review, we posited that chronic fraud victims experienced the presence of specific and often more exacerbated situational factors, making repeat victimization more likely. As such, we developed the hypothesis that chronic fraud victimization is a consequence of chronic susceptibility due to certain situational factors.

We developed the following supporting hypotheses:

• Chronic fraud victimization appears to be highly entrenched in the hope that the scam will ultimately work out in the victim’s favor, and if it does not, there remains the recurring hope that the next “opportunity” that presents itself will succeed.

• Many victims are in a place where they trust the con more than they do their own family.

• The deeper into the scam a fraud target is, the more challenging it is for the target to escape the scam before becoming a victim.

• Chronic victims often are unaware they are involved in a fraud and, thus, labeling a victim as a victim—much less a chronic victim—may not be consistent with how they have experienced the fraud or view themselves.

• The victim refusing to admit or recognize they are involved in a scam can be a major barrier to successful intervention.

• Unlike addicts, whose experiences we originally hypothesized might be similar to that of chronic victimization, chronic victims are unlikely to be aware of their behaviors and the outcomes of their behaviors; yet, like addicts, some may be driven to fulfill outstanding needs as well as by dysfunctional situational factors.

THE PROBLEM (continued)

Page 34: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

5

Given the impact of potential situational factors on a victim’s behavior, the Fogg Behavior Modeliv provides an excellent platform through which to better understand not only which factors may make a victim susceptible, but how these factors might interplay with other elements of behavior.

The Fogg Behavior Model proposes that every behavior (or action) includes a prompt (or trigger), a motivation (or need), and an ability. According to BJ Fogg, behavior (B) happens when motivation (M), ability (A), and a prompt (P) come together at the same moment (“B=MAP at the same time”).

FOGG BEHAVIOR MODELBehaviorModel.org

B=MAP at the same moment

Prompts succeed here

High

Low

Hard to do Easy to do

Prompts fail here

Ability

Mot

ivat

ion

Action Line

@2007 BJ Fogg Contact BJ Fogg for permissions

SITUATIONALFACTOR

Dysfunction that disrupts judgment

and derails good intentions

TRIGGERA catalyst that

elicits an emotional response

MOTIVATIONA persistent core need or

value that drives behavior

ABILITYThe ability to

access funds and respond to

perpetrators’ asks

FOGG BEHAVIOR MODEL

MODEL FOR UNDERSTANDING CHRONIC FRAUD VICTIMIZATION

Based on our research and the resulting belief that dysfunctional situational factors may increase susceptibility to fraud, we adapted the model to include situational factors, which we believe are a key element in repeated fraud victimization, despite a victim’s prior negative experience with scams.

Page 35: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

6

THE ROLE OF SITUATIONAL FACTORSThe in-depth interviews with victims and family members of victims supported our core hypothesis about the salient role of situational factors among chronic fraud victims, along with many of the findings from our earlier research:

“ I was married to a girl that cheated on me and left me for an old man. I lost my wife and my daughter…It’s taken me a while to get over.”

– Kevin (victim of online romance scams)

“ I know my grandmother had died maybe three years ago, like two and a half or three years ago, and she lived in an assisted living close to my mother. So my mother was her person that made sure she was doing okay and took care of her, and she could live alone and do everything, but my mom would do a lot for her also. And I think that was probably a big loss, obviously.” – Jennifer (daughter of victim of lottery scams)

“ He’s an extrovert, loves people, loves people contact, and he’s sort of isolated in his senior years here at home.”

– Anne (wife of victim of sweepstakes scams)

There is an apparent need for some type of fulfillment, which is the outcome of various situational factors. For romance scam victims, the fulfillment was likely companionship, exacerbated by feeling rejected or unattached. For sweepstakes scam victims, the fulfillment was a financial windfall to remedy a void of resources and having to do without. While many scammers play upon a victim’s need to feel special, for real estate scam victims, the fulfillment was feeling a sense of status associated with wealth when they might otherwise move through the world feeling invisible and overlooked.

While these dynamics might be applicable for one-off victims, chronic fraud victims experience more intense emotional swings, as the temporary feelings of fulfillment are replaced with lingering feelings of despair once the scam is exposed. This makes the original void much deeper, resulting in heightened vulnerability to future scams.

Quotes from Interviews:

The model informed our pathway into interviews with chronic fraud victims and families of victims. We leveraged both the model and our early hypotheses seeking to better understand:

1. In what ways are the triggers, motivators, and drivers of ability the same and different between single-instance fraud and chronic fraud victimization?

2. In what ways does situational context influence repeat engagement in fraudulent situations?

3. When and how are interventions the most effective and best received, and who is best suited to facilitate them?

Our research with chronic victims sought to understand the person in life—what a typical day looked like for them, how others might describe them, their personal ecosystem, and what the “story” of their life looks like—in order to add context to who they are as humans, beyond exclusively as victims of fraud. Within this context, we examined their fraud history, looking for situational factors, triggers, motivations, and abilities to identify how each of these factors may have changed or evolved over time. Ultimately, we wanted to better understand the problematic behavior of repeated interactions with financial fraud and scams through the lens of the victims themselves.

FINDINGS FROM INTERVIEWS OF VICTIMS AND FAMILIES

Page 36: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

7

FINDINGS FROM INTERVIEWS OF VICTIMS AND FAMILIES (continued)

The likelihood of cognitive decline among older populations is a key, dysfunctional situational factor that should not be underestimated. Although not applicable to all victims and family members interviewed, some warning signs of cognitive decline seem apparent through behaviors such as consistently pushing away loved ones, doubling down on secrecy, and refusing to entertain alternate explanations of the situation, even after investing (and losing) enormous sums of money. This can become a critical driver of friction within the family, with adult children grieving the loss of the parent they knew, before they have actually passed.

“ My mom’s elderly, she’s 88 years old, and I manage her two investment portfolios in two different places, and because at this point, she might not make some good decisions.”

– Jeff (son of victim of investment frauds)

“ She’s had this battle in her little community for a long time. She walks her dog and she gets mad that she thinks people are driving too fast. So, she just screams at them like a crazy person, and it’s just been a battle for years.” – Jennifer (daughter of victim of lottery scams)

“ I just noticed not too long ago, I had to have everything lined up. Everything has to be in perfect order. The chairs have to be right around the table. If I have a thing in the middle of the table, it has to be centered exactly. I’ll line up things. I’ll be sitting here with my phone and my cigarettes, and I’ll find myself, I’ll be listening to TV, but I’ll be lining everything up.”

– Anita (victim of sweepstakes scams)

Quotes from Interviews:

These victims are not obviously impulsive, but their need for fulfillment may cause them to take more risks. They may pride themselves on their thoughtfulness, deliberation, and consideration of the risks. However, they may also feel as though they have played by traditional rules all their lives and have not found the fulfillment they seek or believe they deserve. They may be willing to take a calculated risk because going off script may be what finally changes the game.

• Chris (an investment scam victim) has been a custodian for nearly 30 years, invested in himself and his work, but still lives in a modest home in Iowa with his adult son. He is living paycheck to paycheck. Chris felt confident he was doing the right thing, as he had met his scammers in person prior to investing.

• Anne’s husband (a sweepstakes scam victim) has been a very successful patent-owning scientist but never experienced the riches that he may have expected to come from it.

• Joyce (an online romance scam victim) has been open and kind and given her all to various relationships but is petrified of growing old alone (she has no kids).

“ I think what they do is they try to build a relationship with you so that you will believe them, I do believe that. When they’re asking me for money, and then they’re going to invest, yeah, I become a friend. [X] Properties did a little better job at that. I feel like I connected with them. Like I said, they flew me to New York, I met them. They were real friendly at that point, and were telling me what they were doing, so that seemed legit.”

– Chris (victim of investment scams)

“ The longer this went on, the more committed he became to showing us why all of us were wrong, that he really had won, and that his dreams for the money, that is educational funds for all the grandchildren, large sums for the charities he had supported throughout his life, and freeing me from worrying about money for the rest of my life. That they really were going to come true.”

– Anne (wife of victim of sweepstakes scams)

“ They’re always sending you cards. They send you these love cards through the Internet and they play a song and how much they love you and you get that all the time, all their texts, all the time. And they want to know everything about you. And you know, I was proud to tell him I own a three-flat. I was proud to tell him that I own a store. And then, like I said, you want to protect them because they say, “Well, I don’t want to meet your family and they know I borrowed money from you, that’s a real embarrassment.” You buy into this. You just buy into whatever they tell you. I’m sorry I did, but I did.”

– Joyce (victim of online romance scams)

Page 37: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

8

Victim Characteristics:• Feeling depressed

• Experiencing a lack of a sense of purpose

• Feeling unseen

• Feeling lonely

• Experiencing physical/mental health changes/ degradation

• Having a need to atone for past wrongs

• Feeling impulsive, difficulty controlling obsessions

• Overly trusting of others (credulity)

• Lacking knowledge of scams

• Experiencing a history of abuse

Cognitive Biases:• Outcome bias: judging a decision based on

its outcome

• Confirmation bias: listening to information that confirms the preconceptions

• Availability heuristic: overestimating the importance of information that is available

• Anchoring heuristic: relying more heavily on the first piece of information offered

• Blind-spot bias: failing to recognize one’s own biases

SITUATIONAL FACTORS

Situational factors include the dysfunctional factors or contexts that disrupt and derail good judgment and intentions. We discovered three types of situational factors at play in chronic victimization:

Circumstantially Driven Dynamics:• Experiencing isolation and loneliness

• Experiencing the loss of spouse

• Experiencing life stressors

• Experiencing mobility issues/reliance on others

• Experiencing financial insecurity

The interview insights, along with our in-depth review of fraud literature and input from experts in the fields of psychology, addiction, and trauma, helped to illuminate elements of the model, which culminated in the following:

The perceived or real absence of a system that can hold the scammer accountable, or meaningfully aid a victim or their family to recover money or even dignity, perpetuates a sense of helplessness, shame, and emptiness of what the victim was striving to fulfill in the first place. This creates a cycle of bitterness, estrangement, and depression that is difficult to overcome.

• Victims and families may feel alone in the ordeal. They want support groups. They want to know they are not the only ones anxious to make sense of the violation and sense of injustice.

• There is a fundamental disconnect between the current fraud prevention messaging and the frame of reference chronic fraud victims have when being seduced into a scam. In the early stages of the scam, they are winners, not losers. Over time, they are manipulated into rationalizing that they are safe, further distancing themselves from the mere idea that anything they’ve heard about the flags of fraud is at all relevant.

• Because many victims keep the scam private – and they do so not out of their own concern, but rather because they want to surprise their loved ones, at least initially – family members rarely have an opportunity to intervene. Once families are made aware, it is often too late. Families’ disbelief and confusion about what has happened almost instantly turns adversarial, which can typically and permanently limit communication and joint resolution.

FINDINGS FROM INTERVIEWS OF VICTIMS AND FAMILIES (continued)

APPLICATION OF THE MODEL ELEMENTS

Page 38: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

9

Breaking the cycle of chronic fraud victimization may be accomplished by addressing and disrupting one or more of the four elements of the model: situational factor, trigger, motivation, and ability.

Given the persistence of chronic susceptibility in repeat victims, we believe one of the most effective ways to tackle chronic fraud may be to tackle chronic susceptibility. While addressing susceptibility, most apparently by addressing dysfunctional situational factors, is likely the best way to stop fraudulent engagement, it is also the most variant and challenging factor. Managing other factors, like triggers and abilities—which often occur once exposure and engagement has begun—is a much more scalable way to mitigate the success of attempted fraud.

This research study identified an initial set of opportunities within each domain of the model to begin to disempower scammers and empower victims.

Motivations are the underlying need, or needs, the fraud target is looking to fulfill, often a direct result of the situational factors.

• Need to be acknowledged

• Need to be cared about

• Need to be approved of/understood

• Need to be helpful

• Need to be loved

• Need to be needed

• Need to be in control

• Need to be important

• Need to leave a legacy

• Need to protect the family

MOTIVATIONS

Barriers to ability• Inaccessible money

• Inaccessible to the fraudster

• Others’ intervention

• Confusion

• Skepticism, distrust

• Worry about social judgment

Drivers of ability• Access to funds

• Need for money

• Abundance of time

• Trust

• Cognitive impairment

• Denial

• Changed neural pathways

• Prioritization of near-term goals over long term

Ability is the capacity of the victim to act on or follow through with a scam, often revolving around the ability to access funds. These include both drivers and barriers to a victim’s ability.ABILITY

Triggers kick start the fraud engagement, play upon the situational factors, and elicit an emotional response from the victim. TRIGGERS

• Urgent call for help/aid

• Imminent danger of family member/friend/home

• Romantic seduction

• Financial insecurity

• Building trust

• Promising of a windfall

• Establishing a sense of scarcity

• Preying upon the desire to do good

DISRUPTING THE CYCLE: OPPORTUNITIES FOR INTERVENTION

APPLICATION OF THE MODEL ELEMENTS (continued)

Page 39: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

10

The critical role that families can play in preventing chronic fraud victimization should not be overlooked. Opportunities for families to support and empower victims and help prevent further victimization exist at each stage of the model. This includes informing families of warning signs and the dynamics surrounding victim behavior and offering supportive resources after a scam has occurred.

Address and diagnose the dysfunctional contexts of a victim’s lifeSituational factors remain the largest and most challenging behavioral and contextual element of the fraud cycle. Addressing these factors head on—for example, by partnering with campaigns such as the “Campaign to End Loneliness” in the United Kingdom, efforts that address other key vulnerabilities, or mental health institutions and counselors—is challenging yet critical.

DISRUPTING THE CYCLE: OPPORTUNITIES FOR INTERVENTION (continued)

SITUATIONAL FACTOR Dysfunction that disrupts judgment and derails good intentions

Interrupt a triggerWhile situational factors set the stage for engagement, the trigger elicits the emotional response and activates the victim/scammer relationship. Fraud education is an effective tool, yet many victims or would-be victims do not consider themselves as such, and as a result, do not seek out fraud prevention education or information, and are not receptive to victim-focused messaging. Instead, creating more organic, in-the-moment education, awareness-building, and intervention opportunities, particularly education that occurs at the grassroots level, in the fabric of their daily life, could be more effective. For instance, partnering with people such as clergy, counselors, and bartenders, or locations such as hair salons and churches, is needed to provide the right message and tools to potential or repeat victims.

TRIGGER A catalyst that elicits an emotional response

Create a buffer between the trigger and the ability & stop the abilityDelay the window between a victim’s trigger and his or her ability to act on the fraudulent prompt or set up a buffer window once the behavior has begun. In many cases this means sending or giving money. Some of the most effective intervention points could be at the locations where the financial transactions occur.

ABILITY The ability to access funds and respond to perpetrators’ asks

Support the needs at playLike situational factors, needs should be addressed and supported in a way that provides the victim a greater sense of fulfillment outside of the fraud dynamic. These interventions likely center on counseling measures or support group centers. Also, identifying ways to support the maintenance and growth of Villages across the country could play a pivotal role.v

MOTIVATION A persistent core need or value that drives behavior

Page 40: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

11

While insights around scam tactics and one-off fraud victimization are well documented, this work provides a model for understanding the phenomenon of chronic fraud victimization: one or more persistent situational factors that facilitate chronic vulnerability combined with a trigger, motivation, and an ability to engage with the scammer. This behavior model, built on the Fogg Behavior Model, provides a new lens through which to identify key intervention strategies that could disrupt the cycle at one or more points along the path of chronic victimization.

Preventing chronic fraud victimization is an especially challenging task in the absence of interventions and individualized support. Responding once engagement with the fraud is activated, however, is possible, and a critical way to mitigate chronic victimization and its devastating impact.

Better understanding of the domains of situational factors, triggers, motivations, and ability, which are highly individualized and vast, will require further attention from researchers, clinicians, and policymakers.

CONCLUSION

i Deevy, M., Lucich, S., & Beals, M. (2012). Scams, schemes and swindles: A review of consumer financial fraud research. Financial Fraud Research Center. https://longevity.stanford.edu/wp-content/uploads/2017/01/Scams-Schemes-Swindles-FINAL-On-Website.pdf. i iDeLiema, M., Fletcher, E., Kieffer, C., Mottola, G., Pessanha, R., & Trumpower, M. (2019). Exposed to scams: What separates victims from non-victims? Stanford Center on Longevity, FINRA Investor Education Foundation, & BBB Institute for Marketplace Trust. https://www.bbb.org/globalassets/local-bbbs/council-113/media/financial-fraud/pdf/ScamTrackerIssueBrief-ExposedToScams-09.12.19.pdf.iii Kircanski, K., Notthoff, N., DeLiema, M., Samanez-Larkin, G. R., Shadel, D., Mottola, G., Carstensen, L. L., & Gotlib, I. H. (2018). Emotional arousal may increase susceptibility to fraud in older and younger adults. Psychology and Aging, 33(2), 325–337.

ivFogg Behavior Model, www.behaviormodel.org, Fogg, BJ.v Villages are volunteer-driven nonprofits with the aim of helping older neighbors age in place. Services (transportation, light work around the house, etc.) and social connections are the key offerings (see VtVnetwork.org).

ENDNOTES

Page 41: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

12

The research and consulting program designed by Heart+Mind was robust, collecting inputs from the comprehensive body of literature on fraud, experts’ opinions from both the fields of fraud and other analogous fields, and interviews with chronic victims themselves. The program included:

PHASE 1: Identifying and converging existing research, analogous fields and cases (e.g. addiction), and early hypotheses around chronic fraud to reframe ways of thinking about chronic fraud, identifying key gaps through which to understand chronic fraud victimization, and set the stage for further exploration and intervention strategies.

• In-depth interviews with AARP & FINRA Foundation internal experts

• Literature review

• 5 interviews with fraud and addictive behavior specialists

PHASE 2:Convening fraud experts and experts in related fields, e.g. addiction and trauma, in a virtual workshop forum to further explore early hypotheses around chronic fraud victimization, modify and augment thinking, and seek inspiration from other fields around potential novel intervention strategies.

• 13 experts in attendance in a 2-hour long virtual Illumination Lab session, a platform that allows for real-time collaboration, unbiased inputs, and rapid synthesis of ideas.

PHASE 3:Conducting interviews among chronic fraud victims and family members of other fraud victims to better understand drivers of chronic fraud victimization and the key levers through which to develop novel intervention strategies

• 8 virtual in-depth interviews with victims or family/friends of other fraud victims

• Applications of behavioral science, means-end theory laddering, and systems thinking

PHASE 4:Reconvening the same experts in a virtual workshop to leverage primary research insights and explore territories for novel intervention strategies.

• 12 experts in a 2-hour long virtual Illumination Lab work session

METHODOLOGY

Page 42: Cybersecurity Straight Talk Thursday, October 28 12:00 p.m ...

13

AARP is the nation’s largest nonprofit, nonpartisan organization dedicated to empowering people 50 and older to choose how they live as they age. With a nationwide presence and nearly 38 million members, AARP strengthens communities and advocates for what matters most to families: health security, financial stability and personal fulfillment. AARP also produces the nation’s largest circulation publications: AARP The Magazine and AARP Bulletin. To learn more, visit aarp.org, aarp.org/espanol or follow @AARP, @AARPenEspanol and @AARPadvocates, @AliadosAdelante on social media.

The AARP Fraud Watch Network is a free resource for all. We equip consumers with up-to-date knowledge to spot and avoid scams, and connect those targeted by scams with our fraud helpline specialists, who provide support and guidance on what to do next. We also advocate at the federal, state, and local levels to enact policy changes that protect consumers and enforce laws. Learn more at aarp.org/fraudwatchnetwork.

ABOUT AARP

ABOUT FINRA AND THE FINRA FOUNDATIONFINRA, the Financial Industry Regulatory Authority, is an independent, not-for-profit organization with a public mission: to protect America’s investors by making sure the securities industry operates fairly and honestly. Overseen by the U.S. Securities and Exchange Commission, FINRA writes rules, examines for and enforces compliance with FINRA rules and federal securities laws, registers broker-dealer personnel and offers them education and training, and informs the investing public.

The mission of the FINRA Investor Education Foundation is to empower underserved Americans with the knowledge, skills, and tools necessary for financial success throughout life. Through a combination of research and educational programming, the FINRA Foundation helps Americans build financial stability, invest for life goals, and guard against fraud and financial exploitation. Learn more at finrafoundation.org or follow @FINRAFoundation on social media.

ABOUT HEART+MIND STRATEGIESHeart+Mind Strategies is a research-based consultancy headquartered in Reston, VA. They deploy teams of researchers working with strategic planners to unpack how humans make decisions in order to strengthen their client’s ability to motivate and persuade the hearts and minds of the people that matter most to their success.