Understanding the Cybersecurity Knowledge And Cybercrime Experiences of Older Adults Using a Learning Game

The purpose of this case study was two-fold. First, it was intended to evaluate the effectiveness of teaching internet safety to older adults through a fun, internet-based learning game. Second, it was carried out to understand the experience of internet fraud on older adults so that fraud prevention techniques can be refined and tailored to the online threats they face. Five adults over 60 who were previously online fraud victims participated in this study, which was carried out over three phases. First, participants played a learning game that assessed their understanding of key cybersecurity topics, provided lessons explaining the risks, and offered advice on internet safety. The game employed a Play Aloud method to gain a rich understanding of participants’ gameplay experiences. Overall, participants made safe decisions 76% of the time. From the gameplay dialogue, five lessons emerged: (a) Identification of threats is not sufficient, (b) Understand how to use device safety features, (c) The importance of identifying legitimate alerts, (d) Depth of understanding is impactful, and (e) Pay attention to detail. Next, participants completed a survey to measure their opinions of the game and the value of the lessons they learned. Results of the 5-point Likert-scale questions revealed that participants had a positive experience playing the game (M = 4.90, SD = 0.30), viewed the game highly favorably (M = 4.85, SD = 0.36), and the lessons would impact their future internet use (M = 4.55, SD = 0.59). Finally, individual interviews were conducted on participants’ experiences of online fraud. The data revealed four phases of a cyberattack experience: (a) the initial attack, (b) the realization, (c) mitigating the damage, and (d) the lingering effects. Recommendations for improving the game include adding lessons on social media discernment and investigating large-impact fraud cases. Limitations of this study included the relative homogeneity of the participant cohort and the relatively low severity of the cybercrimes experienced by participants. Further research could include recruiting participants who have experienced fraud resulting in high monetary loss and validating the four phases of cybercrime experience identified in this study.