Cyber crimes affect millions of people and businesses every year. A single phishing email can empty a bank account, a ransomware attack can shut down a hospital, and a stolen password can expose years of private messages. Yet many people still think of cybercrime as something that only happens to large companies or to other people. In reality, anyone with an email address, a phone or a bank account is a potential target.
This guide explains what cybercrime is, then walks through 12 common cyber crimes, how each one works, who it targets and how to protect yourself.
What Is Cybercrime?
Cybercrime is any crime in which a computer, a network or the internet plays a central role. Experts usually divide it into two groups. Cyber-dependent crimes can only exist because of computers and networks, such as hacking into a system or spreading malware. Cyber-enabled crimes are traditional crimes carried out more easily online, such as fraud, theft, blackmail and harassment.
What makes cybercrime so hard to fight is scale and distance. One criminal can send millions of scam emails in an afternoon, hide behind fake identities and stolen servers, and operate from another continent. Victims often do not realise anything is wrong until money is gone or data has been leaked.
12 Common Types of Cybercrime at a Glance
| Type | What happens | Typical target |
|---|---|---|
| 1. Phishing | Fake emails, texts or sites trick victims into giving up passwords or money | Anyone with an email account |
| 2. Ransomware | Malware locks files and demands payment for the decryption key | Businesses, hospitals, schools |
| 3. Malware | Viruses, trojans and spyware infect devices to steal or damage | Home users and businesses |
| 4. Identity theft | Stolen personal details are used to open accounts or claim benefits | Individuals |
| 5. Online shopping and payment fraud | Fake shops and stolen card details lead to charges for goods never delivered | Online shoppers |
| 6. Business email compromise | Criminals impersonate bosses or suppliers to redirect payments | Companies and finance teams |
| 7. Hacking and unauthorised access | Attackers break into accounts, servers or networks | Businesses and public figures |
| 8. Distributed denial of service (DDoS) | Floods of traffic knock websites and services offline | Websites and online services |
| 9. Insider threats | Staff or contractors misuse legitimate access to steal or sabotage | Employers |
| 10. Data theft and data breaches | Databases are copied and sold or leaked | Companies holding customer data |
| 11. Social engineering | Manipulation and impersonation trick people into handing over access | Employees and individuals |
| 12. Cryptojacking | Devices are hijacked to mine cryptocurrency without permission | Website visitors and servers |
1. Phishing
Phishing is the most common cybercrime of all. The attacker sends an email, text message or social media message that looks like it comes from a bank, a delivery company or a well-known service, and urges the victim to click a link or open an attachment. The link leads to a fake login page that steals the password, or the attachment installs malware.
Targeted versions are even more dangerous. Spear phishing aims at one person using personal details, while whaling targets senior executives whose approval can move large sums of money. Phishing works because it exploits trust and urgency, not technology, which is why it sits at the heart of most social engineering attacks.
2. Ransomware
Ransomware encrypts the victim’s files so they cannot be opened, then demands payment, usually in cryptocurrency, for the decryption key. Modern ransomware gangs also threaten to publish stolen data if the victim refuses to pay, a tactic known as double extortion.
A small business hit by ransomware may lose access to its bookings, invoices and customer records for weeks. Paying does not guarantee recovery, and it marks the victim as willing to pay, which can invite repeat attacks. Reliable offline backups are the single best defence.
3. Malware
Malware is a broad term for malicious software: viruses that spread between files, trojans that hide inside legitimate-looking programs, spyware that records keystrokes and browsing, and banking trojans that steal login credentials. It usually arrives through infected downloads, pirated software, malicious adverts or phishing attachments.
Once installed, malware can steal passwords, record screens, turn a device into part of a botnet, or open a back door for further attacks. Keeping software updated and downloading only from trusted sources removes most of the risk.
4. Identity Theft
Identity theft happens when criminals use someone else’s personal information, such as a name, date of birth, national ID number or bank details, to impersonate them. They may open credit accounts, take out loans, claim benefits or file fake tax returns in the victim’s name.
Victims often discover the crime months later, when debt collectors call or a loan application is refused. Strong, unique passwords, multi-factor authentication and regular checks of bank and credit statements help catch it early.
5. Online Shopping and Payment Fraud
Fake online shops advertise popular goods at impossible prices, take payment and never deliver anything. In other cases, stolen card details are used to buy goods, or a buyer is tricked into paying a private seller by bank transfer, which offers almost no protection.
Warning signs include prices far below the market rate, newly created websites with no reviews, and sellers who insist on payment methods that cannot be reversed. Paying by card through a reputable platform gives the buyer a way to dispute the charge.
6. Business Email Compromise
In business email compromise, criminals impersonate a chief executive, a supplier or a lawyer and convince an employee to transfer money or change bank details for a payment. The emails are carefully researched and often arrive when the real person is travelling or hard to reach.
Losses from a single incident can run into six figures. The most effective countermeasure is simple: verify any change of bank details or unusual payment request through a second channel, such as a phone call to a known number, before sending money.
7. Hacking and Unauthorised Access
Hacking means breaking into a computer system, account or network without permission. Attackers exploit weak passwords, unpatched software and misconfigured systems, or buy stolen credentials leaked in earlier breaches and try them against many services, a technique called credential stuffing.
Once inside, an attacker may steal data, plant malware, spy on communications or use the system as a launchpad for attacks on others. Multi-factor authentication blocks most credential-based break-ins even when a password has leaked.
8. Distributed Denial of Service (DDoS)
A DDoS attack floods a website or online service with so much traffic that genuine users cannot get through. The traffic usually comes from a botnet of thousands of compromised devices, which makes it hard to block by simply banning one address.
DDoS attacks are sometimes used for extortion, with attackers demanding payment to stop, and sometimes as a distraction while another crime takes place. Content delivery networks and DDoS mitigation services absorb most attacks before they reach the target.
9. Insider Threats
Not every cybercrime comes from outside. Insider threats involve employees, contractors or business partners who misuse the access they legitimately hold, whether to steal customer data, sabotage systems or sell trade secrets. Some act out of greed or grievance; others are careless, falling for phishing or mishandling sensitive data.
Because insiders already have access, technical defences alone are not enough. Least-privilege access, logging and prompt removal of access when staff leave are essential controls.
10. Data Theft and Data Breaches
Data breaches expose names, email addresses, passwords, health records or payment details belonging to customers or citizens. The stolen data is sold on underground markets, where it fuels identity theft, phishing and further breaches, sometimes years after the original incident.
For businesses, a breach brings regulatory fines, legal claims and lasting reputational damage. Encryption, access controls, patching and a rehearsed incident response plan limit both the chance of a breach and the harm it causes.
11. Social Engineering
Social engineering is the manipulation of people rather than machines. Attackers impersonate IT support, delivery drivers, police officers or colleagues, invent urgent pretexts and talk victims into revealing passwords, approving transfers or granting remote access. Vishing (voice phishing) and smishing (SMS phishing) are common variants.
Technology helps, but awareness is the real defence. A healthy rule is to never hand over credentials or approve a payment solely because someone on the phone or in an email asks you to, however convincing they sound.
12. Cryptojacking
Cryptojacking hijacks a victim’s computer, phone or server to mine cryptocurrency for the attacker. It often arrives through a compromised website that runs mining code in the visitor’s browser, or through malware installed on a poorly secured server.
Victims notice slow performance, overheating devices and rising electricity bills, while cloud customers may face large unexpected charges. Ad blockers, endpoint protection and monitoring for unusual CPU usage catch most cases.
Who Do Cyber Criminals Target?
Everyone, but not equally. Individuals are targeted at scale with phishing and scams because even a small success rate pays. Small businesses are attractive because they hold valuable data and money but often lack dedicated security staff. Large organisations and public services are targeted for bigger payouts and for disruption. Attackers also follow the news: natural disasters, major sporting events and tax deadlines all bring waves of themed scams.
How to Protect Yourself from Cybercrime
No single tool stops every threat, but a handful of habits cover most of them: use strong, unique passwords with a password manager; switch on multi-factor authentication wherever it is offered; keep devices and apps updated; back up important data and test that the backup restores; pause before clicking links or acting on urgent messages, and verify requests through a separate channel; and use reputable security software on every device.
What to Do If You Become a Victim
Act quickly. Contact your bank to freeze cards and reverse fraudulent payments, change passwords for affected accounts and any account that shared the same password, and switch on multi-factor authentication. Preserve evidence such as emails and screenshots, report the crime to the police or your national cybercrime reporting service, and tell anyone else who may be affected, such as contacts who might receive scam messages in your name.
Common Mistakes That Make Cybercrime Easier
The most common mistakes are reusing one password everywhere, ignoring software updates, trusting caller ID or email display names, oversharing personal details on social media, and assuming a small business or personal account is too unimportant to be attacked. Criminals count on exactly these assumptions.
Frequently Asked Questions
What is the most common type of cybercrime?
Phishing is the most common type of cybercrime. It is cheap to run at scale, it targets people rather than systems, and it opens the door to further crimes such as identity theft, ransomware and business email compromise.
Is cybercrime only a problem for big companies?
No. Individuals lose money to scams, identity theft and payment fraud every day, and small businesses are frequent targets precisely because they often have weaker defences than large firms. Good basic security protects organisations of every size.
What is the difference between hacking and cybercrime?
Hacking is a technique, breaking into a system without permission, while cybercrime is the broader category of crimes committed with computers and the internet. Hacking is one type of cybercrime, alongside fraud, phishing, ransomware and others.
Can cybercrime be reported?
Yes. Report it to your local police and to your country’s national cybercrime or fraud reporting service, and tell your bank immediately if money or card details are involved. Reporting helps investigators link cases and warn other potential victims.
Can antivirus software stop all cybercrime?
No. Antivirus software catches much known malware, but it cannot stop a phishing email you act on, a scammer you willingly pay, or an insider misusing legitimate access. Layered defences, including updates, backups, multi-factor authentication and awareness, are needed.
