Internet-based fraud and other deceptive schemes (collectively called "scams") are today's most pervasive digital safety threats. Although scams can victimize anyone, specific vulnerable or "at-risk" populations may face a disproportionately higher risk of harm. Prior research on scams has primarily examined these groups in isolation, and there is little consolidated understanding of why different populations are more susceptible to scams or how to design inclusive protections.

This thesis addresses this gap through three main contributions. First, it synthesizes existing knowledge by systematically reviewing 145 papers that present original findings on how internet scams affect various demographic and at-risk groups. The review analyzes the methods used in these studies, the risk factors that increase vulnerability, and the defensive measures proposed to protect these groups. It finds that factors tied to personal circumstances, such as underserved accessibility needs and resource constraints, appear to shape vulnerability to scams, though this evidence is largely qualitative. Studies of general demographic trends are often conflicting and uninformative about underlying causes. It argues for research that moves beyond demographic profiling toward a deeper understanding of contextual risk factors. These risk factors offer a lens for interpreting the empirical studies that follow.

Second, this thesis presents a series of empirical studies, particularly focused on two at-risk populations: LGBTQ+ users and minor teenagers. For LGBTQ+ users, a survey examines privacy practices among closeted individuals on online dating services, revealing how marginalization can result in vulnerability to extortion. For teenagers, two studies examine scam exposure and responses: a qualitative analysis of Reddit discussions about cryptocurrency in teenage communities, and an experimental comparison of teens’ and adults' susceptibility to scams that offer free digital goods on YouTube. These studies emphasize how teenagers' resource constraints and distinct interests may increase their exposure to fraud. Complementing these group-specific studies, a large-scale thematic analysis of 1,525 posts from scam-focused Reddit communities identifies common support-seeking behaviors, scam recognition strategies, and emotional coping mechanisms.

Third, the thesis develops and evaluates a novel warning system for instant messaging scams. This system leverages generative AI to detect potential fraud and deliver context-sensitive advice to help users make safer decisions. The system design was developed through a qualitative interview study and three online experiments. These studies found that participants had a positive sentiment towards GAI explanations in warnings, and identified a design that promoted safer decisions in hypothetical scenarios. This design was evaluated in a first-of-its-kind field experiment, which found that both the GAI-generated and a baseline warning were associated with reduced clicking on simulated scam messages relative to no warning.

Ultimately, this thesis advances understanding of scam victimization and offers solutions to improve digital safety for everyone, especially underserved populations. By centering their perspectives, we can raise the baseline of protection for all users.

429 pages

Thesis Committee:
Lorrie Faith Cranor (Chair)
Nicholas Christin
Julie Downs
Michelle Mazurek (University of Maryland)

Nicolas Christin, Head, Software and Societal Systems Department
Martial Hebert, Dean, School of Computer Science

Return to: SCS Technical Report Collection
School of Computer Science

This page maintained by reports@cs.cmu.edu