Understanding cybercrime: definitions, scale and the policing challenge

On the morning of Monday, February 9, 2026, Grace Whitford's landline rang at a quarter past ten. A young man's voice, thick and shaky, said, 'Gran, it's me. I'm in trouble.' Grace, a 79-year-old retired schoolteacher who lives alone in Port Ardent, said, 'Ryan?' and the voice said yes. Ryan, he told her, had been in a car crash, the other driver was hurt, and he had been arrested. Then a calm man came on the line and introduced himself as Ryan's lawyer. Bail was 9,200 dollars and had to be paid by wire transfer that afternoon. A court order, the lawyer said, meant she could not tell anyone, not even Ryan's parents. By three o'clock Grace had wired the money from her bank branch. The next morning the lawyer called again: the other driver's medical bills meant another 9,200 was needed. She paid that too.

That evening Grace phoned her daughter, who called Ryan at his apartment in Halifax. He had not been in a crash. He had not been arrested. He had not called anyone. Grace had lost 18,400 dollars, most of her emergency savings, to a grandparent scam. Students who took the victimology course have already met Grace and seen how she was treated as a victim. This course follows the investigation of the crime itself: how Detective Ellen Park of the Port Ardent police service's fraud unit traced the calls, the money and the people behind them, what evidence she gathered and how, and why the case was only partly solved.

Professor Ray Desjardins opens the course at Georgian Shores College in Barrie by asking the class what they think a cybercriminal looks like. Marco DiSanto describes a teenager in a hoodie in a dark bedroom. Priya Sandhu, who spent five years as a bank fraud analyst before coming back to school, laughs and says the people who stole from her bank's customers worked in offices, kept regular hours and had managers. Both images contain some truth. Desjardins says the point of the first lesson is to replace the movie version of cybercrime with a working understanding that a patrol officer can use on the next call.

What cybercrime means

There is no single legal definition of cybercrime. The term is used for a wide range of offences that involve computers, networks or digital devices. Police agencies, researchers and international bodies commonly divide it into two broad groups. Cyber-dependent crimes are offences that can only be committed using computers or networks, where the technology is both the tool and the target. Examples include breaking into a computer system without permission, spreading malicious software, encrypting a company's files and demanding a ransom, or flooding a website with traffic to knock it offline. Cyber-enabled crimes are traditional offences whose scale or reach is increased by technology. Fraud, extortion, harassment, the sexual exploitation of children and the sale of drugs or stolen goods all existed before the internet, but networks let offenders commit them faster, from farther away and against many more victims.

Grace's case is a cyber-enabled crime. Fraud by telephone is as old as the telephone, but the version that reached her used technology at every step. The caller's number was spoofed to look local. The script had been refined across thousands of calls. The voice of the 'grandson' may have been a real person or may have been generated or altered by software. The money moved by wire, then through accounts opened with stolen identities. The people giving the instructions may have been on another continent. Desjardins tells the class that most of the cybercrime they will encounter in uniform will be cyber-enabled: frauds, threats, harassment, extortion and exploitation in which a device holds the evidence.

A third category is sometimes added: crimes in which digital evidence matters even though the offence itself has nothing to do with computers. A phone's location history in a robbery, text messages in a domestic assault, or a dashboard camera in a collision are digital evidence in ordinary cases. That is why the evidence half of this course applies to every officer, not only to specialists. Almost every investigation now involves a device.

How much cybercrime is there?

Cybercrime is among the most under-reported kinds of crime. Victims often do not know where to report, think police cannot help, feel ashamed, or report only to their bank or the platform where it happened. The Canadian Anti-Fraud Centre, which collects fraud reports for the country, said that Canadians reported losing more than 704 million dollars to fraud in 2025, and estimates that only 5 to 10 in every 100 frauds are reported at all. Identity fraud, investment fraud and service fraud were the most commonly reported types. Even those large numbers are a floor, not a ceiling.

Priya adds a point from her bank work: losses are concentrated. A few victims lose very large amounts, often their savings or retirement funds, and the averages hide that. Older people are not targeted more often for every scam, but they tend to lose more per incident, partly because they have savings that can be reached quickly and partly because the scams aimed at them, like the grandparent scam, are designed to create panic. Younger people report more frauds overall, often involving online shopping, rental listings and job offers.

# Why averages mislead: a few large losses dominate the total
losses = [120, 85, 40, 300, 60, 18400, 95, 250, 75, 9800, 150, 45]
losses.sort()
total = sum(losses)
mean = total / len(losses)
mid = len(losses) // 2
median = (losses[mid - 1] + losses[mid]) / 2
top_two = losses[-1] + losses[-2]
print("reports:", len(losses))
print("total lost:", total, "dollars")
print("mean loss:", round(mean), "dollars")
print("median loss:", round(median), "dollars")
print("share of total from the two largest losses:", round(100 * top_two / total), "in 100")

reports: 12
total lost: 29420 dollars
mean loss: 2452 dollars
median loss: 108 dollars
share of total from the two largest losses: 96 in 100

In this small set of twelve reports, the two largest losses, Grace's 18,400 and a 9,800 loss in another case, account for 96 in every 100 dollars lost. The median report is about a hundred dollars. A unit that measures its workload only by the number of reports will see mostly small cases; a unit that measures harm will see that a handful of victims carry most of it. Park says her unit tries to triage on both: the number of reports shows where to warn the public, and the size and circumstances of each loss show where to put investigators.

Why cybercrime is hard to police

Desjardins lists the features that make cybercrime different from the crimes police were built to handle. The first is distance. A break-in requires the offender to be at the door. A fraud can be run from anywhere with a phone line or internet connection, and offender, victim, money and evidence may be in four different countries. Police jurisdiction stops at borders; the internet does not.

The second is scale. A burglar can break into a few houses in a night. A fraud call centre can make thousands of calls a day, and one piece of malicious software can infect hundreds of thousands of computers. Each victim may lose a small amount that no single police service would investigate, while the offenders collect millions in total.

The third is anonymity, or the appearance of it. Offenders hide behind spoofed phone numbers, false names, rented servers, anonymizing networks and cryptocurrency. None of these makes identification impossible, but each adds steps, and many of those steps require legal orders served on companies in other places.

The fourth is speed and volatility. Money moves in minutes. Logs are overwritten in days or weeks. Accounts are deleted. Evidence that would have answered the key question can disappear while a report sits in a queue. This is why the first officer's actions matter so much, and why later lessons spend time on preservation.

The fifth is skill and resources. Most police officers have had little training in cybercrime, and specialized units are small and busy. Victims who call their local police may be told, sometimes correctly and sometimes not, that nothing can be done. Grace was told something close to that by the first person she spoke to, which the victimology course examined. Desjardins says a modern patrol officer does not need to be a forensic examiner, but does need to know what evidence exists, how to keep it from being lost, where to send the report, and how to treat the victim.

Who does what

Cybercrime response involves many organizations, and an officer should know the main ones. In Canada, local and provincial police investigate most cybercrime reported to them. The RCMP's National Cybercrime Coordination Centre, known as NC3, coordinates cybercrime investigations across the country, helps connect related reports and supports police services; it works with the Canadian Anti-Fraud Centre, which is jointly run by the RCMP, the Ontario Provincial Police and the Competition Bureau, through a shared national system for reporting cybercrime and fraud. The Canadian Centre for Cyber Security, part of the Communications Security Establishment, is the government's technical authority on cyber security and receives reports of incidents affecting organizations. Cybertip.ca, run by the Canadian Centre for Child Protection, is the national tipline for the online sexual exploitation of children.

Banks, phone companies, internet providers, social media platforms and cryptocurrency exchanges are not police, but they hold most of the evidence and often detect fraud before anyone else. Grace's second recovery-scam transfer was stopped by a teller who had been told to watch her account. Priya says some of the most effective fraud prevention she saw was done by bank staff who asked one more question. Park's unit has named contacts at each local bank branch and at the main phone and internet companies, which shortens the time it takes to stop a payment or preserve a record.

The first officer and the specialist

Most police services have a small cybercrime or technological crime unit, a digital forensics unit that examines devices, and a fraud unit. They cannot take every report. The first officer, usually on patrol or at the front desk, takes the report, identifies urgent steps, preserves what can be preserved and decides, with policy, where the file goes. Desjardins describes the first officer's job in four words: listen, preserve, report, refer. Listen to the victim and get the facts in order. Preserve money and evidence by calling the bank at once and keeping devices, messages and records safe. Report the incident in the police records system and to the national reporting centre. Refer the victim to support and, where appropriate, to the specialist unit.

In Grace's case, the first contact went badly, as the victimology course described, but the report was taken, a file number was given, and the file reached Park the next day. Park's first action was to call Grace's bank to ask whether the second wire could still be recalled, and to ask the receiving bank to freeze what remained. The first wire had already been moved on. The second had been received into the same account and moved within hours. The window to recover the money had been less than a day.