An Italian case study
1. Introduction
It almost seems like an argumentative paradox to discuss about geography in the context of a cybercrime, since the spatial dimension and physicality of the place of the crime committed do not exist in digital crimes.
This situation is inevitably reflected also in the investigative methodologies.
Despite this limitation concerning new forms of crime including cybercrime, it is possible to enhance the "geographic" aspects even in criminal profiling activities that are not applicable to a traditional crime scene.
In fact, there are cyber criminals who need to have physical contacts with "geographical points" of interest in order to perfect their criminal activity and enjoy the benefits of the criminal incidents.
Therefore, even in crimes that do not have a physical and “criminalistic” crime scene such as murders or sexual aggression, there would exist a spatial behavioral model, and this allows the use of geographic profiling techniques in crimes committed through internet.
2.
Geographic Profiling
The analysis of the offender’s spatiality has established itself as a new tool for supporting investigations, and also with a specificity towards an investigation method called Geographic Profiling, a targeted geographical approach to crime built on a specialized location-based procedure, which involves the study of crime locations.
According to Rossmo (2000; 2025), Geographic Profiling is “an investigative methodology for analyzing the locations of a connected series of crimes to determine the most probable area of the offender’s residence. Its major function is suspect prioritization and information management”, used in serial violent, property crimes and in single cases with multiple crime locations.
This method has now reached universality. It is also used in Italy, in crime analysis research and in the investigative field on specific crimes. In order to improve this task, this author, certified geographic profiling analyst, uses a computational approach to reduce the search area with the support of the “Criminal Geographic Targeting” (CGT) algorithm designed by Dr. Rossmo (2000), implemented in Rigel Analyst, the professional geographic profiling system produced by Environmental Criminology Research Inc.
3.
The geography of an Italian serial cyber criminal
One of the conditions for carrying out an investigative analysis with the support of the “criminology of places” and geographic profiling is the presence of physical locations where the offender commits the crimes and the existence of the offender's movements within a delienated space in which the perpetrator selects the targets. According to the geographic dimension of the crime, the offender’s base is likely to be located within the distribution area of the sites of the incidents.
If the criteria of human search and mobility do not satisfy the geographic paradigm, developing the offender's territorial profile can be problematic and, in some cases, impossible.
Some types of crimes involving physical sites are favored by the application of geographic analysis. On the other hand, in certain crimes such as cybercrimes the geographic aspects are not immediately traceable. A cyber offender does not need to interact with the physical geographic environment in order to commit crimes. In theory, this condition makes the use of geographic profiling techniques ineffective during on-line crimes investigation.
Despite this limitation, using the “geographic” dimension even in profiling studies that cannot be adapted to a traditional crime scene, does not seem entirely impossible.
The Italian Penal Code distinguishes on-line criminal activities having as target computers (Computer fraud, referred to article
640-ter of the Penal Code, for example phishing; Illegal possession and dissemination of access codes to computer and telematic systems, article 615-quarter of the Penal Code) and on-line crimes using computer (Online child pornography, under the article 600-ter of the Penal Code, 600-quarter of the Penal Code; «Revenge porn», article 612-ter of the Penal Code; Aggravated fraud, under the article 640 paragraph 2 no. 2-bis of the Penal Code such as romance scams, credit card scams, counterfeit sales and e-commerce fraud).
It is clear that it is possible to find the offender’s spatial dimension in criminal incidents committed through the use of computer in which the targets are individuals.
The exploratory and demonstrative Italian case proposed is a suggestion for an investigative reflection about the possible application of the geographic profiling in a specific digital crime, i.e., e-commerce frauds of fake commercial sales committed by use of credit cards.
The case concerns serial cyber-fraudsters who had deceived numerous victims with fraudulent commercial advertisements on the internet, taking advantage of the distance that separated them from the buyers.
The perpetrators had used several prepaid credit cards and some fictitious telephone numbers. They had then created several profiles on social media platforms - virtual commercial shops - to get in touch more easily with the unaware buyers. In this way, the criminals sold smartphones, technological products and clothing, which they did not have physical possession and availability of, with attractive prices on specialized websites as well as in social network notice-boards.
The buyers/victims, after having agreed on the price and paid the requested amount on the credit cards indicated by the criminals, did not receive the goods “bought” by the scammers-retailers. After the bank transaction, the criminals disappeared without leaving a trace.
Once the payment was confirmed, the offenders proceeded to withdraw the money accumulated on the credit cards from different postal and bank ATMs; some ATMs were used more frequently.
The newspaper article titled (Italian) “The fraud runs online” published in the official Carabinieri Magazine concerns the investigation of this on-line crime series.
In practice, the cybercrimes subjected to geographic profiling analysis must have elements of interaction between digital space and physical environment, the crime must have a specific location and geographic position, include some social engineering component and the presence of a “direct” contact between the victim and the offender.
Therefore, there are cyber criminals who, while operating on the internet, will necessarily have to leave the virtual space and have physical contact with the victims, with other affiliated offenders, with the tools useful for perfecting their "conduct" and obtaining benefits from it.
Therefore, a spatial structure exists even in crimes that do not have a classic crime scene.
Compared to traditional fraudulent conduct, in the fake online sale frauds, the “physical” crime place has a peculiarity represented by the distance favored by the web space, which separates the offender from the place where the buyer of the goods is located. However, the criminal mechanism of this criminal conduct is completed with the withdrawal of cash paid by the buyers/victims operated by the perpetrators at bank or post office ATMs or with the spending of money at commercial shops.
In these cases of fraud, the spatial and geographical investigation focuses on all the locations linked to the online fraud, such as the location of ATMs, the places where money was withdrawn, and the location of the commercial establishments where the credit cards were used by the perpetrator.
All these places are not crime scenes in the technical sense of the term, but they are places of the crime with physical, geographical, temporal and spatial qualities from which it is possible to reconstruct the mobility pattern of the offender and its likely spatial relationship with the home base area. This means that, in every crime, even in the absence of criminalistic evidence, we will always have the criminological and investigative interlacements between Person (offender/victim or offender/target) – Place (relationship between the sites of the events and the characteristics of the surrounding environment) – and Time (temporal aspect of the offences, perpetrator’s movements).
The crime series analyzed consists of numerous serial on-line frauds committed throughout Italy, in a period between the beginning of 2015 to the end of 2016. The fraudulent credit cards were reported by Law Enforcement Agencies to the banks and then the banking institutions blocked the cards. The criminal investigation insights came from: the cross-examination of the money flows between the credit cards used by offender; the analysis of the positions of the ATM machines; the quantitative and qualitative spatial-temporal analysis of the movements of the fraudsters in the "hunting area" through the analysis of the phone cells; the review of mobile phone records.
Traditional linkage analysis was not possible. In this series, the linkage between frauds and credit cards used (and locations) was performed by the spatial-temporal analysis of associated fictitious telephone numbers. From the phone records data, two phone numbers had contacts with each other shortly after the activation of the credit cards. This was a clue indicating that some credit cards and telephone numbers were connected to the same persons involved in the series and to the places. Another link was represented by one phone call made by the user of one these fictitious telephone numbers to a person, identified at the end of investigation as a co-offender’s family members.
4. Conclusion
This Italian case study demonstrates that some cybercriminals do not act spatially differently from other criminals and, like their counterparts, they tend to stay in the proximity of their home or around the geographical anchors of their normal daily activities.
The selection of crime locations and places where credit cards were used, in particular cash withdrawal sites and commercial shops, is not random in physical space and it could suggest useful information regarding the probable area of the cyber-criminal’s anchor point.
The result of this crime series demonstrative analysis was favorable for the study of geographic profiling, in accordance with previous research developed by leading experts in the field, such as Dr. Rossmo, who demonstrated the possibility of applying geographic profiling in cybercrime and online credit card fraud. However, it is necessary to point out some critical issues and limitations of this application, as in this crime series. For example, if the offender always uses the same ATM or a few ATM devices (few crime locations), the crime analyst will suggest a different investigative strategy or technique.
Without any doubts, Geographic Profiling has proven to be an advantageous decision-making support tool for inferring the spatial characteristics of the offenders, even in digital crimes, such as the e-commerce crime series in which a margin of applicability of the theories and techniques of geographic profiling has been found.
This case illustrated that under analytic conditions the construction of geographic profile is possible with any location where the offender physically visits. At the same time, it indicates that the frequent use of geographic profiling in investigative procedures represents both a radical change of criteria for analyzing some online serial crimes and an integrated operational approach that combines classic investigative techniques, Rigel’s technology and spatial pattern analysis.
