If just a few years ago the figures related to the presence of cyber fraud in companies were somewhere around 15-20%, numbers that were starting to represent a worrisome problem, today the figures have risen to 49% of companies that are affected internationally, according to data from the PWC audit.
One in every two companies in the world has been a victim of cyber fraud in one way or another.
This figure has led me to think about the current situation we're living through in relation to the COVID-19 pandemic and how, in a sense, it's possible that the contagion of viruses may in some way resemble this contagion that we're experiencing in the world of cyber fraud.
This has made me question a few things.
- Is it possible for cyber fraud to spread?
- Can a cyber fraudster infect another person, causing them to become an online fraudster?
- Can normal people become cyber fraudsters simply by coming into contact with someone who already is one?
- Are we really in the middle of a cyber fraud pandemic?
If these questions had an affirmative answer, then this could explain the increases we're seeing, but more importantly, it would make us realize the need to establish prevention measures to keep clear of this contagion that is apparently spreading out of control.
Thinking about it, an experiment came to mind by Dan Ariely, one of the world's greatest experts in the study of dishonesty and lies. Ariely and his team conducted an experiment at Carnegie Mellon University that I will try to explain in a simple and quick way.
The experimenters gathered a dozen students in a class to take a math test that consisted of making matrices.
Along with the sheet with the matrices, the students were given an envelope with money. Once the student finished the exercises, they handed in the matrix sheet to a teacher who was in the room, who checked the number of correct matrices and based on the number of right answers, the student got to take money from the envelope.
So far so good, no student could do anything to get more money than the amount which they deserved. Ariely changed the experimental situation and eliminated the teacher who checked the number of correct matrices. Now, when the students finished the exercise, they took the sheet to a shredder that had been installed in the classroom, indicated to the teacher the number of correct matrices, and collected their reward from the envelope.
What the students didn't know was that this shredder was manipulated in such a way that it only shredded the edges of the paper, with which it was possible to check if the students had said they had correctly solved more matrices than they really had.
Ariely and his team compared the two situations and found that, in the first situation, the students tended to correctly solve an average of 7 matrices, whereas, in the shredder situation, the average of correct matrices rose to 12.
All students said that they had solved between 3 and 5 more matrices than they had actually been able to solve. These numbers bring us to one of the first premises that Ariely tells us about in his research: that we're all a bit dishonest when the conditions so permit.
Not all of us become huge billion-dollar scammers and cheat pathologically to achieve our goals, but we are capable of sometimes acting dishonestly to illegitimately make some money. Not everyone steals money from their company, but just a few pens or some paper, that's not the same thing, right?
But Ariely gave his experiment another twist, a twist that will help us try to answer the questions he asked me or we asked ourselves at the beginning. In this new experimental situation, which in theory is similar to that of the shredder, a student, 2 minutes after starting the exam and when the rest of the classmates were still working on the second or third matrix, got up and said that he had finished.
The teacher in charge of adminstering the exam told him to take the sheet to the shredder and asks him for the number of solved matrices out loud. The student says that he has correctly solved all the twenty matrices.
The student opens the envelope and asks the teacher: "I get to take everything, right?"
The teacher replies "Yes, of course, you've solved them all correctly, you can take the entire envelope."
He does just that and the student walks out of the classroom door with his classmates staring at him in disbelief who are still struggling to solve the third matrix. We should mention now that this "super scammer" was actually an actor hired by the researchers to perform this role.
From that moment on, the students slowly passed by the shredder and collected their money from their respective envelopes. When the test (experiment) was over, the researchers counted and verified that the students had lied three times more than in the previous situation.
In other words, an average of 7 matrices in the control situation had increased to 12 in the shredder situation and to 15 in the latter situation with the super scammer. That is, the students had come to say that they solved between 5 and 8 more matrices than they were really capable of solving.
In the latter situation, in addition to the mathematical calculations, the students had carried out other types of calculation. If that first student can cheat and get away with it, then I can do the same without fear of getting caught.
The action of this super scammer and the reaction of the teacher and the students, who knew that he was a full-blown cheater, had generated the image that this was a socially acceptable thing to do and that nothing would happen by acting that way.
And nothing negative happened, what did happen is that the other students could take more money than what they rightly deserved. That is, the students had "reset" their value system of what is acceptable within moral limits.
In short, the students had been infected with fraud, the actor had managed to infect the rest of his classmates with his actions, causing them to no longer settle for just cheating "a little bit", but had led them to cheat on a "big scale".
Our learning is often vicarious, that is, it's based on the imitation of what others do. This learning doesn't only occur in motor and physical activities such as learning to play soccer, but also occurs in more cognitive aspects such as learning ethics and morals.
We often behave and adapt to an environment based on what we see others doing, and thus we mimic them and create our value system according to the group in which we live.
If we look around us right now, we'll see that on many occasions the people who we rub shoulders with in our companies, in our circle of acquaintances or in our political landscape are very similar to this "super scammer" and, unwittingly, we too end up being infected by the fraud virus.
In a way, this is what Edwin H. Sutherland discusses in his Differential Association Theory, where he explains that criminal behaviors are not innate but learned. The human being, who lives in society, is constantly interacting with other people, from whom they learn that crime has its advantages and its justifications.
This relationship with people or with a context that offers a positive vision of criminal behavior would make the subject end up internalizing these behaviors as lawful. That is, if you put a healthy apple in a basket with some rotten apples, more often than not, that healthy apple also ends up rotting.
Today, many young (and not so young) people are exposed to fraud, like that student who got an envelope full of money in just two minutes.
Many cyber frauds are presented to public opinion by the media as great feats and cyber criminals as geniuses or highly intelligent people who are able to design master plans as if they were in a Hollywood movie.
This whitewashing and admiration with which cyber frauds are sometimes presented perform that role of the teacher who seemed to be unable to see, or worse still, who consented to the cheating student's behavior.
Following Ariely's assumptions, if we can all behave dishonestly at times and to a certain extent, and if we are also exposed to being infected by big scammers, we'll very possibly end up getting a big basket of bad apples.
Therefore, we need to work on cyber fraud from aspects that are not only technical, but also cultural, educational and moral as well.
I know that the latter is very rare in a highly technological world, but it's vital to contain this unstoppable contagion and empower what we could refer to as "digital honesty".