Cyber Crime Taxonomy: The Critical #9 Bifurcation

The Industry Confusion about Cyber Crime

When executives say "we suffered a cyber crime," they might mean:

• $2M wire fraud via CEO impersonation call
• Ransomware attack via phishing email
• Romance scam targeting an employee
• Data breach via compromised credentials
• Sextortion through manipulation
• Account takeover leading to fraud

These are fundamentally different threats requiring different teams, different controls, and different response strategies. Yet most organizations treat them identically under the vague umbrella of "cyber crime." The TLCTC framework brings precision to this chaos by recognizing that Social Engineering (#9) operates in two distinct modes.

The #9 Bifurcation: Where Attack Paths Separate

#9.1: Social Engineering as Standalone Threat

Definition

Pure manipulation leading directly to harm. No IT system is compromised. Classical crimes executed via digital communication channels.
Attack Path: #9 → [(Private) Business Impact]

Examples

• CEO fraud: Phone call impersonating executive requesting wire transfer
• Romance scams: Building fake relationships for financial exploitation
• Investment fraud: Ponzi schemes, fake crypto opportunities
• Sextortion via manipulation: Coercion to share content, then blackmail
• Digital harassment: Coordinated online campaigns, review bombing
• Extortion: Using publicly obtained information for threats

The TLCTC Reality: Minimal Applicability

From a cyber threat perspective, only two controls apply:

1. Awareness training - Reduce success rate (never eliminate)
2. Law enforcement coordination - Remove criminals from ecosystem

That's all. You cannot change human nature. The generic vulnerability—human psychological factors (trust, fear, urgency, greed)—is inherent. It exists on both sides:

• Attacker side: Criminals exploit psychology (always have, always will)
• Target side: Humans remain susceptible (this is biology, not a technical flaw)

What About Dual Authorization, Verification, Transaction Limits?

These are not cyber threat controls. They are business process controls for liability mitigation and regulatory compliance. They apply equally whether fraud occurs via:

• Phone call (physical world)
• In-person manipulation (physical world)
• Postal mail (physical world)
• Digital communication (digital world)

These belong in Operational Risk / Fraud Prevention, not cybersecurity threat management.

The Damage & Liability and Legal Driver

This is the critical insight: For #9.1, controls are driven by liability exposure and regulatory mandates, not cyber threat prevention. When an organization's product or service is the fraud vector (e.g., banking wire transfer systems, payment platforms, communication services), regulators and legal systems impose requirements:

Regulatory Examples:

• PSD2 Strong Customer Authentication (EU)
• FINMA RS 17/01 operational risk requirements (Switzerland)
• Banking transaction verification standards (global)
• Product liability standards (sector-specific)

Liability Drivers:

• Demonstrate "reasonable care" to courts
• Reduce financial exposure when fraud occurs
• Satisfy insurance requirements
• Comply with duty of care obligations

Example: A bank implements dual authorization for wire transfers not because it prevents #9 social engineering (it doesn't—humans remain manipulable), but because:

1. Regulators mandate it
2. It reduces the bank's liability when fraud occurs
3. It demonstrates "reasonable security measures"
4. Courts expect it as industry standard

This is why banks "mix" these controls into cybersecurity programs even though they're fundamentally business/compliance controls.

Organizational Response: #9.1

Primary responders:

• Human Resources (employee victims)
• Legal/Compliance/Police (fraud, extortion)
• Communications/PR (reputation attacks)
• Finance (financial fraud)

NOT primary responders:

• SOC/Security Operations (no system to investigate)
• Digital forensics (no compromised systems)
• CSIRT (no technical incident)

#9.2: Social Engineering as Bridge Threat

Definition

Social engineering that crosses the domain boundary from human trust into technical system compromise. Loss of Control occurs.
Attack Path: #9 → [#1-#8, #10] → [Loss of Control] → [Data Risk Events] → [Business Impact]

Examples

• Phishing → Malware: #9 → #7 → #4 → (#1+#7) (Ransomware)
• Credential harvesting → Access: #9 → #4 → #1 → [Exfiltration]
• Manipulation → Config change: #9 → #1 → [System weakening]
• Social engineering → Physical access: #9 → #8 → #7

The TLCTC Reality: Full Framework Applies

All cyber threat controls become relevant:

Technical Controls:

• Email filtering, URL reputation (detect malicious content)
• EDR, anti-malware (prevent code execution)
• MFA (prevent credential abuse)
• Network segmentation (limit lateral movement)
• Application whitelisting (control execution)
• SIEM/SOC (detect compromise)

PLUS Awareness Training:

• #9 is the initial vector, so awareness remains critical
• But awareness alone is insufficient—technical controls required

Velocity Matters (Δt)

In #9.2 sequences, attack velocity becomes measurable and critical:

#9 →[Δt=2h] #7 →[Δt=30m] #4 →[Δt=15m] (#1+#7)

Detection Coverage Score = (Mean Time to Detect) / (Attack Velocity)

Goal: DCS < 1.0 (detecting faster than attack progresses)

Organizational Response: #9.2

Primary responders:

• SOC/Security Operations
• CSIRT/Incident Response
• Digital forensics
• IT operations

Supporting responders:

• HR (if employee accounts involved)
• Legal (breach notification, regulatory reporting)
• Communications (customer notification)

Why This Distinction Matters Operationally

Resource Allocation

Risk Assessment

Key insight: Same business outcome, different attack paths, different primary defenses, different risk levels.

Decision Framework: Quick Classification

Integration with Cyber Crime Frameworks

The TLCTC #9.1 / #9.2 distinction integrates cleanly with regulatory and legal frameworks:

Conclusion: Precision Through Bifurcation

Social Engineering (#9) is unique among the 10 TLCTC clusters—it can operate standalone OR as a bridge. Understanding which mode applies transforms your response:

For #9.1: You're dealing with classical crime in a digital medium. Cyber threat controls offer minimal value. Your response is driven by liability exposure and regulatory compliance, not cyber threat management. Focus on awareness, law enforcement, and business process controls like transaction monitoring mandated by your legal/regulatory environment.

For #9.2: You're dealing with a cyber threat enabling system compromise. Full TLCTC framework applies. Technical defenses work because systems can be hardened (unlike human nature). Focus on prevention, detection, response, and measurable control effectiveness.

The critical question is always: Did Loss of Control occur?

Answer that, and you know exactly which playbook to execute.