Assessment on awareness of cyber threats and cyber security among middle-aged and elderly population

Introduction

Digital technologies have become an inseparable part of everyday life. Smartphones, messaging applications, social media, online banking, digital payment systems, e-commerce and government e-services are now used by people of almost all age groups for communication, financial transactions, shopping and access to information. While these developments have brought convenience, speed and accessibility, they have also increased individuals' exposure to cyber threats such as phishing, online financial fraud, identity theft, social engineering and malicious applications. Cyber security is not solely a technical matter. Many cyber incidents succeed because users are deceived or pressured into acting against their own interest, for example by sharing one-time passwords (OTPs), clicking on fraudulent links or trusting callers who impersonate officials. Studies of deceptive messages have shown that the content and framing of a message, including appeals to urgency and authority, influence how recipients respond (Oliveira et al., 2017) [1] . Cyber security awareness therefore involves both knowledge of threats and the ability to adopt appropriate protective behavior, and awareness alone does not always translate into safe practice because information-based campaigns often fail to build safe habits (Bada et al., 2019) [2] . Middle-aged and elderly persons form an important group in this context. They increasingly use digital banking, payment applications and messaging services, yet they differ from younger users in prior technological experience, confidence and access to support. Research in ageing has linked older age with poorer discrimination between genuine and phishing emails (Grilli et al., 2021) [3] and greater phishing susceptibility (Pehlivanoglu et al., 2024) [4] , and has shown that education, prior awareness and cognitive and socioemotional resources influence the ability to recognise deception (Gavett et al., 2017; Ebner et al., 2020) [6,5] . At the same time, other work cautions that older adults should not be treated as a homogeneous or automatically more vulnerable group (Ross et al., 2014; Shang et al., 2022) [7,8] . Older adults often regard protective behaviour as important but hesitate to adopt it because of perceived effort, fear of making mistakes and lack of accessible guidance (Morrison et al., 2021) [9] . In India, rapid digitalisation and the widespread use of the Unified Payments Interface (UPI) have been accompanied by growing reports of cyber fraud, including impersonation calls, fake KYC and OTP messages, QR-code scams and fraudulent investment offers. The national cybercrime helpline 1930 and the National Cyber Crime Reporting Portal have been introduced to help victims report such incidents promptly, and agencies such as CERT-In conduct awareness activities. Whether ordinary users know about and use these mechanisms is, however, an empirical question. Much of the available research has been conducted in Western countries, many studies concentrate only on adults above 60 years, and relatively few examine awareness, experience of threats, safe practices and reporting knowledge together within the same population. Indian studies on the subject are limited (Sebastian et al., 2022) [10] . Middleaged adults, who are active users of digital banking and social media, have received comparatively less attention than the elderly. Therefore, the present study was undertaken with the following objectives: (i) to assess the awareness of middle-aged and elderly persons regarding cyber threats and cyber security, and (ii) to identify the cyber threats they encounter and to explore their online behaviour and safe digital practices, with a view to suggesting guidelines for safer digital participation.

Methodology

The study was exploratory and was conducted in Udaipur city, Rajasthan. With increasing digital use across age groups and feasibility of data collection. A total of 120 respondents were selected, comprising 60 middle-aged persons (40-59 years) and 60 elderly persons (60-70 years), with 30 males and 30 females in each age group. Respondents were identified through non-probability snowball sampling, in which initial respondents meeting the criteria referred to other eligible persons from their social network. Persons who actively used digital devices (smartphone, laptop, desktop, tablet or internetenabled keypad phone) for activities such as communication, online financial transactions, shopping or social media, and who were willing to participate, were included. Primary data were collected through a structured questionnaire developed in line with the objectives of the study. It had three sections: (I) socio-demographic and digital usage profile, including devices, platforms and security features used; (II) awareness and knowledge of cyber threats, cyber security practices and cybercrime reporting; and (III) behavioural practices, response to cyber fraud, awareness of government initiatives and willingness to attend awareness programmes.

Data were collected personally by the researcher through face-to-face interviews, after obtaining informed consent and assuring confidentiality and anonymity. The data were then coded, tabulated and analysed using Microsoft Excel and the Statistical Package for the Social Sciences (SPSS). Frequency and percentage were used to describe the profile, awareness and practices of the respondents. The Pearson chi-square test of association (with Fisher's exact test for 2 × 2 tables) was used to compare middle-aged and elderly respondents, and male and female respondents within each age group, at the 0.05 level of significance.

Result and Discussion

Socio-demographic profile of respondents

The sample was equally divided by design between middle-aged and elderly respondents and between males and females. Table 1 shows that graduates formed the largest educational group (50.8%), followed by senior secondary (35.0%) and postgraduate (10.8%) respondents, and that no respondent was illiterate or had only primary education. Middle-aged respondents were significantly better educated than elderly respondents (63.3% graduates and 15.0% postgraduates versus 38.3% and 6.7%), while 48.3% of elderly respondents had studied only up to senior secondary level (χ 2 = 15.707, p = 0.001). The uppermiddle income group was the largest (56.7%), but a higher proportion of elderly respondents belonged to the higher income group (35.0% versus 11.7%; χ 2 = 9.284, p = 0.010), which may reflect pensions and accumulated assets. Occupation also differed significantly by age group (χ 2 = 29.958, p < 0.001): 38.3% of middle-aged respondents were in government service, whereas 28.3% of elderly respondents were retired and 30.0% were homemakers. Most respondents (78.3%) lived in urban areas and 17.5% in semi-urban areas, with no rural respondents, and family type (nuclear 36.7%, extended 35.8%, joint 27.5%) and area of residence did not differ significantly between the age groups (p > 0.05). The sample was thus largely urban and educated, which should be kept in mind while interpreting the awareness levels reported below, since education and prior awareness have been found to help people recognise phishing (Gavett et al., 2017) [6] .

Digital exposure and security of devices

Table 2 shows that smartphones were used by all 120 respondents, and messaging (93.3%) and digital payment platforms (95.8%) were the most widely used, so both groups are routinely exposed to payment and OTP-related fraud. Computers were used by 51.7% of middle-aged respondents but by none of the elderly, who relied more on keypad phones (40.0% versus 20.0%). Middle-aged respondents had longer experience of digital devices (more than 10 years: 20.0% versus 8.3%; χ 2 = 11.482, p = 0.009), whereas only elderly respondents (11.7%) had used devices for just 1-3 years. Almost all middle-aged respondents (98.3%) managed their devices themselves, compared with 75.0% of the elderly, who depended more on relatives (71.7% versus 50.0%); no respondent reported having no source of help. Dependence on others can be a risk when passwords or OTPs are shared with the person helping. Social media use was also higher among middle-aged respondents (71.7% versus 51.7%). Although 81.7% of respondents in both age groups considered their devices safe, the adoption of security features was limited. Password/PIN lock (80.0% versus 40.0%), two-factor authentication (55.0% versus 28.3%), privacy settings on apps (43.3% versus 21.7%) and regular software updates (35.0% versus 18.3%) were used significantly more by middle-aged respondents; the difference for software updates was marginal on Fisher's exact test (p = 0.062). Antivirus software was used by only 8.3% of respondents, with no age difference, and 18.3% of elderly respondents used no security feature at all (6.7% of middle-aged; p = 0.053). The gap between perceived safety and the safeguards actually in use suggests that confidence in device safety may not rest on protective measures, a pattern consistent with the observation that older adults' attitudes to protective behaviour are shaped by perceived effort and confidence rather than by knowledge alone (Morrison et al., 2021) [9] .

Awareness of cyber threats

Table 3 shows that familiarity with the terms themselves was low: only 38.3% of respondents had heard of "cyber threats" (48.3% were not sure) and 50.0% had heard of "cyber security", with no significant difference between the age groups. Yet 97.5% had experienced some form of cyber threat, and phone calls were by far the most common channel (82.5%), reported more by middle-aged respondents (96.7% versus 68.3%; χ 2 = 16.681, p < 0.001), followed by messaging apps (53.3%) and SMS (48.3%). Respondents therefore seem to recognise fraud through experience rather than through technical terminology. The predominance of phone calls also indicates that voice-based approaches, in which urgency and false authority can be applied directly, are an important route for fraud, in line with evidence that persuasive framing influences responses to deceptive messages (Oliveira et al., 2017) [1] .

Knowledge of specific threats was highest for phishing (81.7% [3,4] , although the similar levels for several threats show that the elderly are not uniformly less aware (Ross et al., 2014; Shang et al., 2022) [7,8] .

Knowledge of safe practices, reporting and government initiatives

As shown in Table 4, the best-known practices were not sharing passwords (66.7%) and creating strong passwords (65.8%), and middleaged respondents knew both significantly better than the elderly (88.3% versus 45.0% and 85.0% versus 46.7%). Technical safeguards were poorly known in both groups, with no significant age difference: avoiding suspicious links (32.5%), regular software updates (27.5%), two-factor authentication (25.8%), logging out from public devices (25.8%) and antivirus software (17.5%). This low knowledge helps to explain the limited adoption of these measures seen in Table 2. A similar situation was reported among adults in Kerala, where awareness programmes and structured workshops were recommended to improve cyber practices (Sebastian et al., 2022) [10] .

Knowledge about reporting was a particular weakness. Only 14.2% of respondents knew how to report a cybercrime, 39.2% had heard of reporting but did not know the procedure and 45.0% were not aware of it at all. The elderly were considerably less informed, with 63.3% not aware compared with 26.7% of the middle-aged (χ 2 = 17.97, p < 0.001). The local police station (80.8%) and friends or family (78.3%) were the best-known sources of help, whereas the national cybercrime portal was known to only 23.3% in both age groups and helpline 1930 to 51.7%. Awareness of collecting evidence was significantly lower among the elderly (23.3% versus 55.0%), and only 40.0% of respondents knew of government initiatives such as CERT-In and the National Cyber Security Policy (53.3% of the middle-aged versus 26.7% of the elderly; χ 2 = 8.889, p = 0.003). These findings suggest that official channels have not reached the elderly effectively and that the traditional route of the local police station is better known than online reporting.

Safe digital practices and response to cyber fraud

Table 5 shows that several precautions during online payments were followed by most respondents: not sharing OTP, PIN or passwords (92.5%), using trusted payment applications (87.5%), verifying receiver details (84.2%) and checking transaction details (78.3%). Other precautions were less common, such as ensuring that the website or application is secure (40.8%) and regularly checking bank statements or alerts (52.5%). The age pattern was mixed rather than uniformly in favour of the middle-aged: middle-aged respondents more often used trusted payment applications (95.0% versus 80.0%), while elderly respondents more often checked that the website or application was secure (53.3% versus 28.3%) and avoided unknown QR codes (86.7% versus 71.7%; Fisher's exact p = 0.071). Mixed age-related differences in security behaviour have also been reported by Branley-Bell et al. (2022) [11] , who found that older adults were less likely to secure their devices but more likely to adopt some other protective behaviours.

For other digital activities, middle-aged respondents followed safer practices significantly more often: not sharing personal information (93.3% versus 65.0%), using strong and unique passwords (73.3% versus 53.3%), not sharing OTPs or passwords (80.0% versus 58.3%) and avoiding suspicious links (55.0% versus 33.3%). Antivirus installation (30.0%), avoiding unknown apps (40.8%) and logging out of shared devices (38.3%) were low in both groups. Only 15.0% checked their privacy settings regularly, 41.7% did so sometimes and 15.8% never did, with no significant age difference (p = 0.095). That respondents knew a practice but did not follow it consistently supports the view that awareness alone does not secure safe behaviour (Bada et al., 2019) [2] . In case of cyber fraud, no respondent said they would ignore the incident. Seeking help from family members or technical experts (91.7%), informing the bank (84.2%) and blocking the suspicious number or account (84.2%) were the most common first actions, while reporting to helpline 1930 (61.7%) and on the national portal (31.7%) were less common. Elderly respondents were less likely to turn first to family (85.0% versus 98.3%; p = 0.008) but more likely to report on the national portal (41.7% versus 21.7%; p = 0.019). A high proportion of respondents (84.2%) were willing to attend a cyber security awareness programme, with no difference between age groups (86.7% versus 81.7%; p = 0.453). This agrees with the finding that older adults want to protect themselves but need accessible guidance and continuing support (Morrison et al., 2021) [9] , and it offers a favourable basis for community-level education.

Gender-wise differences within age groups

Table 6 presents the items on which male and female respondents differed significantly within each age group; on the remaining items no significant gender difference was found. Among middle-aged respondents, females were more aware of online shopping fraud (86.7% versus 30.0%) and all of them knew about creating strong passwords (100.0% versus 70.0%), but males more often reported protective behaviour: avoiding suspicious links (76.7% versus 33.3%), enabling privacy settings (93.3% versus 40.0%) and regularly checking bank statements (66.7% versus 26.7%). Middle-aged males were also more likely to consider their devices safe (93.3% versus 70.0%) and to know of government initiatives (66.7% versus 40.0%), although the latter was borderline on Fisher's exact test (p = 0.069).

Among elderly respondents the pattern differed. Elderly females were more likely to know about two-factor authentication (30.0% versus 6.7%) and software updates (40.0% versus 6.7%), to be aware of call and message verification apps (93.3% versus 53.3%) and to enable privacy settings (83.3% versus 46.7%), but 33.3% of them had not heard of the term cyber security, against 6.7% of elderly males (p = 0.016). Elderly males relied more on government campaigns for information (80.0% versus 43.3%). Gender differences were therefore item-specific and ran in different directions in the two age groups, rather than showing one gender to be consistently more aware. This is in keeping with Branley-Bell et al. (2022) [11] , who found that gender did not directly predict cyber security behaviour.

Conclusion

The study examined awareness of cyber threats and cyber security among 120 middle-aged and elderly persons in Udaipur city. Smartphones and digital payment platforms were used by almost all respondents, and nearly all (97.5%) had experienced some form of cyber threat, mainly through phone calls. Respondents knew common frauds such as phishing, online banking fraud and OTP fraud and a few basic practices such as not sharing passwords, but familiarity with the terms cyber threats and cyber security, knowledge of technical safeguards and use of antivirus software, two-factor authentication, software updates and privacy settings were low. Only 14.2% knew how to report a cyber threats and 40.0% were aware of government initiatives, although 84.2% were willing to attend awareness programmes.

Middle-aged respondents generally had better knowledge of threats and practices, used more security features and were better informed about reporting and government initiatives than the elderly, while the elderly depended more on others for operating devices. The age differences were not uniform: for example, elderly respondents were more careful about checking website security and unknown QR codes, and gender differences within each age group were item-specific. These findings point to the need for simple, practical and repeated cyber security education suited to each age group, delivered in the local language through demonstrations and realistic examples, with clear step-by-step guidance on reporting (informing the bank, calling helpline 1930, using the national cybercrime portal and preserving evidence) and with the involvement of family members, banks, educational institutions and the police. The findings should be read with caution because the sample was small, urban, relatively well educated and drawn by snowball sampling, and many comparisons were made, so isolated significant results may be due to chance.

References

1. Oliveira D, Rocha H, Yang H, Ellis D, Dommaraju S, Muradoglu M, Weir D, Soliman A, Lin T, Ebner NC. Dissecting spear phishing emails for older vs young adults: On the interplay of weapons of influence and life domains in predicting susceptibility to phishing. In Proceedings of the 2017 CHI Conference on Human Factors in Computing Systems. ACM. 2017:6412-6424.
2. Bada M, Sasse AM, Nurse JRC. Cyber security awareness campaigns: Why do they fail to change behaviour? arXiv. 2019.
3. Grilli MD, McVeigh KS, Hakim ZM, Wank AA, Getz SJ, Levin BE, Ebner NC, Wilson RC. Is this phishing? Older age is associated with greater difficulty discriminating between safe and malicious emails. The Journals of Gerontology: Series B. 2021;76(9):1711-1721.
4. Pehlivanoglu D, Shoenfelt A, Hakim Z, Heemskerk A, Zhen J, Mosqueda M, Wilson RC, Huentelman M, Grilli MD, Turner G, Spreng RN, Ebner NC. Phishing vulnerability compounded by older age, apolipoprotein E e4 genotype, and lower cognition. PNAS Nexus. 2024;3(8):pgae296.
5. Ebner NC, Ellis DM, Lin T, Rocha HA, Yang H, Dommaraju S, Soliman A, Woodard DL, Turner GR, Spreng RN, Oliveira DS. Uncovering susceptibility risk to online deception in aging. The Journals of Gerontology: Series B. 2020;75(3):522-533.
6. Gavett BE, Zhao R, John SE, Bussell CA, Roberts JR, Yue C. Phishing suspiciousness in older and younger adults: The role of executive functioning. PLOS ONE. 2017;12(2):e0171620.
7. Ross M, Grossmann I, Schryer E. Contrary to psychological and popular opinion, there is no compelling evidence that older adults are disproportionately victimized by consumer fraud. Perspectives on Psychological Science. 2014;9(4):427-442.
8. Shang Y, Wu Z, Du X, Jiang Y, Ma B, Chi M. The psychology of the Internet fraud victimization of older adults: A systematic review. Frontiers in Psychology. 2022;13:912242.
9. Morrison B, Coventry L, Briggs P. How do older adults feel about engaging with cyber-security? Human Behavior and Emerging Technologies. 2021;3(5):1033-1049.
10. Sebastian SR, Babu BP. Are we cyber aware? A cross-sectional study on the prevailing cyber practices among adults from Thiruvalla, Kerala. International Journal of Community Medicine and Public Health. 2022;9(12).
11. Branley-Bell D, Coventry L, Dixon M, Joinson A, Briggs P. Exploring age and gender differences in ICT cyber security behaviour. Human Behavior and Emerging Technologies. 2022;2022:2693080.