Most people think of cybercrime as a fundamentally different beast from traditional crime. After all, it involves computers, code, and shadowy hackers in basements. But criminologists studying digital offenses have noticed something striking: the same theories that explain street crime work remarkably well for understanding online offending.

The patterns are familiar. Criminals look for easy targets. They exploit moments when no one's watching. They weigh risks against rewards. What's changed isn't human nature—it's the environment where these ancient impulses play out. Understanding this shift reveals both the challenges ahead and the prevention strategies most likely to work.

Criminologists have long used something called routine activity theory to explain crime patterns. The idea is simple: crime happens when three things converge in time and space—a motivated offender, a suitable target, and the absence of capable guardians. Remove any one element, and the crime doesn't occur.

The internet has supercharged this convergence in ways physical spaces never could. A single attacker can simultaneously probe millions of potential targets across the globe. Your inbox is a space where strangers can reach you directly, bypassing the social barriers that would normally protect you. And the "guardians" who might intervene—whether parents, security guards, or observant neighbors—often can't see what's happening online.

Research shows this isn't just theoretical. Studies of phishing attacks, online fraud, and identity theft consistently find that victimization patterns mirror what we see offline. People are targeted when they're isolated, distracted, or operating in unfamiliar environments. The criminals aren't smarter than their street counterparts. They've just found a hunting ground with vastly more opportunity and fewer witnesses.

Takeaway

Crime opportunity theory still applies online—the internet hasn't created new criminal motivations, just removed the friction that kept offenders and targets apart.

Here's a prevention reality that rarely makes headlines: traditional policing relies heavily on geographic jurisdiction. A detective investigating a burglary can interview witnesses, collect evidence, and make an arrest because everything happened within their legal authority. Cybercrime obliterates this model.

A scammer in one country can victimize someone in another using servers based in a third while routing payments through a fourth. Each jurisdiction has different laws, different priorities, and different levels of cooperation. Even when investigators identify perpetrators, extradition is slow, expensive, and often impossible. Countries that don't experience the harms have little incentive to help.

The evidence supports this frustration. Cybercrime prosecution rates remain remarkably low compared to traditional offenses, not because police don't care, but because the structural barriers are genuine. This has important implications: if we can't rely on catching and punishing offenders to deter cybercrime, prevention strategies that reduce opportunity become even more critical than they are for conventional crime.

Takeaway

When punishment becomes unreliable due to jurisdictional chaos, prevention through reducing opportunity matters more than ever.

Not all cybersecurity advice is created equal. Criminological research on "target hardening"—making targets more difficult to victimize—reveals an important distinction: some measures genuinely deter criminals, while others merely inconvenience them briefly before they adapt.

Effective deterrence works when it raises the effort required relative to alternative targets. Multi-factor authentication, for instance, doesn't make your account impenetrable. It makes attacking you more work than attacking someone who doesn't use it. Criminals, like water, flow toward the path of least resistance. Studies consistently show that even modest security improvements shift attacks toward easier victims.

What doesn't work as well? Security theater—measures that look protective but don't substantially change the criminal's calculation. Complex password requirements that lead people to write passwords down. Warning messages so frequent they get ignored. The research suggests focusing resources on a few high-impact protections rather than spreading effort across many low-impact ones. The goal isn't perfection. It's being a harder target than the next person.

Takeaway

Effective cybersecurity isn't about being unhackable—it's about being more trouble than the millions of easier targets available.

Cybercrime isn't a break from criminal history—it's the latest chapter. The same human tendencies toward opportunism, risk calculation, and path-of-least-resistance thinking that drove crime for millennia now operate in digital spaces. This is actually good news for prevention.

We don't need to reinvent criminology. We need to apply what works—reducing opportunity, increasing effort for offenders, and accepting that perfect security matters less than relative security. The criminals are human. So are the solutions.