Cybercrime is usually discussed as a problem of technology. We talk about phishing emails, ransomware, stolen credentials, data breaches, identity theft, online harassment and increasingly sophisticated attacks powered by artificial intelligence. The language itself tends to be technical: attackers exploit vulnerabilities, compromise accounts, exfiltrate data and target users. Yet behind almost every cybercrime is a much older and distinctly human process. Someone makes a decision to deceive, frighten, humiliate or exploit another person. For most people, deliberately causing serious harm to someone standing directly in front of them would create at least some psychological discomfort. We respond to faces, voices and visible distress. We notice fear and confusion. We recognize another person’s reaction to what we have done. Online, many of these signals disappear. A victim may exist only as an email address, username, photograph, account number or entry in a database. The person is still there, of course, but psychologically they can become much easier to ignore. This is where dehumanization becomes relevant to cybercrime. In psychology, dehumanization generally refers to perceiving or treating people as though they possess fewer of the qualities we associate with being fully human, such as individuality, emotional complexity, dignity and the capacity to suffer. It does not always involve hatred, and it certainly does not require an offender to consciously think of a victim as non-human. Often the process is quieter. A person gradually becomes a category rather than an individual: a target, a lead, an account, a potential payment. The digital environment is unusually well suited to creating this psychological distance because online communication removes many of the cues that normally encourage empathy. A fraudster sending hundreds of phishing messages does not usually witness the moment someone realizes that money has disappeared from a bank account. Someone participating in sustained online harassment may never see the person reading those messages alone at home. A criminal stealing credentials may know almost nothing about the individual whose identity is being traded. Anonymity can widen that distance further. It does more than conceal an offender’s identity; it can alter the psychological experience of the behavior itself. When people feel less identifiable and less immediately accountable, some of the social restraints that operate in face-to-face situations can weaken, a phenomenon related to what psychologists studying online behavior have described as online disinhibition. This does not mean that anonymity automatically makes people cruel. Anonymous communication has legitimate and important uses, from privacy and whistleblowing to political expression and participation in sensitive support communities. The issue is that anonymity, physical distance and the absence of visible consequences can combine to make another person’s suffering less psychologically immediate. In an offline encounter, an offender may have to confront the victim’s fear or anger. Online, the offender can close a window, log out or move to the next target. The suffering has not disappeared. Only the perpetrator’s exposure to it has.
That distance becomes particularly important when offenders need to reconcile harmful behavior with the way they see themselves. Most people do not move through life thinking of themselves as villains. Even individuals who behave unethically often maintain a self-image in which their actions are understandable, justified or at least not as bad as they appear. Psychology offers a useful concept for understanding this tension: cognitive dissonance, the discomfort that can arise when a person’s behavior conflicts with their beliefs, values or self-image. Someone who considers themselves fundamentally decent but knowingly steals from another person faces an uncomfortable contradiction. One way to resolve it is to stop stealing. Another is to reinterpret the victim. Instead of thinking, “I took advantage of an innocent person,” the offender can decide that the victim was foolish, greedy, careless or somehow deserving of the outcome. The behavior remains the same, but its meaning changes. This helps explain why victim-blaming can become such a powerful feature of fraud and other forms of exploitation. A person who falls for a phishing message becomes “stupid.” Someone manipulated through a romance scam becomes “desperate.” An employee deceived by a convincing impersonation “should have known better.” A company hit by ransomware “should have had better security.” These judgments can contain fragments of practical truth; people and organizations can certainly reduce their exposure to cybercrime. But vulnerability and responsibility are not the same thing. Forgetting to lock a door may increase the risk of burglary, but it does not make burglary morally neutral. The same principle applies online. Modern social engineering is deliberately constructed around ordinary features of human cognition. Attackers exploit urgency because urgency narrows attention. They imitate authority because people routinely use authority as a shortcut when deciding whom to trust. They create fear because fear can interfere with careful reasoning. They exploit curiosity, fatigue, distraction, loneliness and uncertainty because these are normal human states, not signs of stupidity. A successful phishing attack does not necessarily demonstrate that the victim lacks intelligence; it may demonstrate that the attacker created exactly the circumstances under which normal decision-making becomes vulnerable. For an offender, however, portraying the victim as incompetent can serve a useful psychological purpose. It moves responsibility away from the person deliberately engineering the deception and places it on the person who responded to it. It can also reduce empathy. Once a victim has been categorized as gullible or deserving, their distress becomes easier to dismiss. This is one of the unsettling aspects of dehumanization: it often does not begin with cruelty. It begins with a story we tell ourselves about why another person’s suffering should matter less.
Repetition can make that story easier to maintain. Human beings are remarkably adaptable, and one consequence of that adaptability is desensitization. Experiences that initially provoke strong emotional reactions can become less intense when they are encountered repeatedly. This ability is often useful; without some degree of habituation, people working in emotionally demanding environments would struggle to function. But the same mechanism can operate in environments where harmful behavior is normalized. The first act of deception may produce anxiety, hesitation or guilt. The fiftieth may feel routine. A person who repeatedly encounters discussions of stolen accounts, manipulated victims or successful scams may gradually stop reacting to them with the same emotional intensity. Group culture can accelerate the process. If everyone in an online community treats victims as idiots, celebrates successful attacks and describes exploitation as a game or a business, the moral boundaries of the group can slowly shift. Harm becomes ordinary because the people surrounding the offender treat it as ordinary. This connects closely with psychologist Albert Bandura’s work on moral disengagement, which examined how people can temporarily disconnect their behavior from the moral standards they would normally apply to themselves. One way this happens is through language. Words can soften the psychological meaning of an action. A victim becomes a target. Manipulation becomes a technique. Theft becomes a job. A successful deception becomes a conversion. Language does not alter what happened to the victim, but it can alter how the offender experiences responsibility for it. Responsibility can also be divided among many people. Contemporary cybercrime does not always involve one offender personally carrying an attack from beginning to end. Criminal ecosystems can be specialized. One person obtains access to compromised accounts, another sells credentials, another deploys malicious software, another communicates with victims, and someone else moves or launders the money. Each participant may see only a small piece of the process and can tell themselves that the worst part was someone else’s responsibility. The victim, however, experiences the combined result. This fragmentation is psychologically important because direct responsibility becomes harder to feel when an individual’s action is separated from its eventual consequence by several other people, systems or transactions. Something similar happens with scale. Imagine physically taking $5,000 from one person while they stand in front of you. Now imagine extracting five dollars each from a thousand anonymous accounts through an automated system. The financial outcome is identical, but the psychological experience is very different. In the second scenario there may be no recognizable victim at all, only numbers moving across a screen. Digital systems are exceptionally good at turning individual human experiences into aggregated information. That ability is enormously useful in legitimate business and technology, but in cybercrime it can help transform suffering into statistics. Once harm is expressed as a number, it becomes easier to measure and, sometimes, easier not to feel.
Artificial intelligence and automation make this question even more relevant. Technology has always allowed human actions to operate at a distance, but AI can dramatically increase both the scale and personalization of digital interactions. A criminal no longer needs to manually write every fraudulent message or research every potential victim. AI-assisted systems can help produce convincing communication, adapt language for different audiences, imitate familiar styles and process large quantities of information. From the offender’s point of view, an operation involving thousands of people can begin to resemble a technical workflow. Messages are generated, responses are analyzed, techniques are adjusted and results are measured. The human beings on the receiving end may become almost invisible inside the process. This is not an argument that artificial intelligence creates cruelty, nor that technology is inherently dehumanizing. The more interesting question is what happens when technology increases the distance between a human decision and its human consequences. Digital interfaces have a remarkable ability to make morally significant actions feel administratively simple. A click can transfer money, expose private information, publish humiliating material or send a threatening message to thousands of people. The physical effort required may be tiny even when the consequences are enormous. As automation increases, that imbalance can become greater. This is one reason cyberpsychology deserves a larger role in conversations about cybersecurity. Technical security focuses, understandably, on vulnerabilities in software, networks and devices. Cyberpsychology asks what happens to human perception and behavior inside those systems. Why do people trust some messages and distrust others? Why does urgency interfere with judgment? Why do online groups become more extreme? Why does anonymity change behavior for some people but not others? And why can another person’s suffering become easier to dismiss when it is mediated through a screen? These questions matter because every cyberattack exists within a human environment. There is a person deciding to act, a person or organization being targeted, and a technological system influencing how each side perceives the interaction. The danger is not simply that technology gives malicious people better tools. It can also remove some of the natural psychological friction that might otherwise make harmful behavior uncomfortable. When an offender cannot see the victim, does not hear the victim’s reaction, feels protected by anonymity, shares responsibility with others and performs the act through an automated interface, several barriers to harmful behavior can weaken at the same time. That does not eliminate moral responsibility. If anything, understanding these mechanisms makes responsibility more important, because it shows how easily ordinary psychological processes can be used to make extraordinary harm feel routine.
The consequences are especially important because cybercrime is still sometimes treated as less tangible than crime involving physical contact. The language of the internet can reinforce this perception. Data is “lost.” An account is “compromised.” Information is “leaked.” A user is “targeted.” These descriptions may be technically accurate, but they can conceal what happens afterward. A person whose savings are stolen may lose money accumulated over decades. Someone subjected to cyberstalking may become frightened inside their own home even though the stalker is physically far away. Identity theft can create months or years of administrative and financial problems. Online harassment can affect sleep, employment, relationships and mental health. Romance fraud can be particularly devastating because the financial loss may occur alongside the realization that a relationship the victim believed was genuine never existed. The harm is digital in its delivery, not necessarily in its consequences. Recognizing this should also change how cybersecurity professionals talk about victims. Describing human beings as the “weakest link” may be convenient, but it can unintentionally reproduce the same psychological distancing that attackers exploit. People are not defective components in otherwise perfect security systems. They are part of the system, and they bring predictable cognitive tendencies with them. Effective security should be designed around those tendencies rather than assuming that perfect attention, suspicion and judgment are realistic. Education should help people recognize manipulation without humiliating those who have already been manipulated. Organizations should examine how technology, culture and processes make mistakes more or less likely instead of treating every successful social-engineering attack as an individual failure. At a broader level, digital platforms can consider how design affects accountability, empathy and behavior. None of these measures will eliminate cybercrime, but they address something technical defenses alone cannot solve: the psychological conditions that allow another human being to disappear behind an interface. The internet has given us an extraordinary ability to interact with people we may never meet, yet that same distance can make those people easier to reduce to usernames, profiles, accounts and numbers. Cyberpsychology reminds us that the person on the other side of the screen does not become less human simply because we cannot see them. Perhaps that is the deeper lesson of dehumanization in cybercrime. The most dangerous vulnerability is not always a flaw in software or a poorly protected password. Sometimes it is the very human ability to stop imagining the person who will experience the consequences of our actions.
