EU Drafts New Digital Crime Victim Laws

Routine Activity Theory Explains Elderly Fraud Risk

The academic underpinning for the heightened focus on vulnerable populations, particularly the elderly, is rooted in criminological theories regarding environmental opportunities.

Research published in Frontiers in June 2023 highlights how Routine Activity Theory explains the disproportionate victimisation of older people in online environments.

The theory posits that crime occurs when a motivated offender encounters a suitable target in the absence of a capable guardian.

In the physical world, a capable guardian might be a neighbour, a bank teller, or a family member present during a transaction.

In the digital realm, these guardians are conspicuously absent.

The study compared younger and older victims of online fraud, finding distinct differences in susceptibility and the mechanisms of the crimes committed.

Younger victims often fall prey to investment scams or purchase frauds, driven by greed or inexperience.

In contrast, older victims are frequently targeted through relationship scams or technical support fraud, exploiting their isolation and potential lack of digital literacy.

The research indicates that the social isolation common among the elderly effectively removes the 'capable guardian' from the equation.

Without a second pair of eyes to review a suspicious email or a fraudulent request for funds, the risk of victimisation skyrockets.

• Older adults lost an average of €4,800 per fraud incident in 2022, double the youth average.
• Social isolation increases the likelihood of engaging with fraudulent actors by 40%.
• Technical support scams specifically target demographics over 65.

What makes the digital space so dangerous for this demographic is the sophistication of the伪装 used by offenders.

Criminals use psychological manipulation rather than brute force, creating a false sense of trust or urgency.

The absence of a 'capable guardian' in the digital space is a structural failure that the new EU measures aim to address.

Officials suggest that the legislation may encourage the role of 'digital guardians', potentially involving banks or internet service providers.

We are looking at mechanisms to flag unusual transactions before the money leaves the account, a Commission advisor explained.

This effectively institutionalises the role of the guardian in the banking sector.

However, privacy advocates have raised concerns about the level of monitoring required to fulfil this role effectively.

The challenge lies in balancing protection with the fundamental rights to privacy and autonomy.

Despite these concerns, the data makes a compelling case for intervention.

The Frontiers study underscores that without systemic intervention, the 'capable guardian' gap will continue to widen as society becomes increasingly digital.

The Commission's proposal is a direct response to this identified vulnerability.

Systemic Failures in Victim Care Exposed

While the theoretical framework explains why crimes happen, a recent report by Criminal Justice Inspectorates exposes how the system fails victims after the fact.

Published in February 2024, the report titled 'Meeting the needs of victims in the criminal justice system' paints a damning picture of the current support infrastructure.

The inspection found that victims are often treated as mere witnesses rather than individuals with rights and needs.

The systemic issues identified range from poor communication to a lack of specialised training for police officers handling sensitive digital cases.

Victims of digital crime often report feeling dismissed by law enforcement, who may lack the technical expertise to investigate complex online frauds.

This secondary victimisation—where the system itself inflicts harm through indifference or incompetence—is a key driver for the Commission's reforms.

The report highlights that information is the most critical missing element.

Victims are frequently left in the dark about the progress of their case for months or even years.

In the digital sphere, where evidence can be deleted or moved across jurisdictions in seconds, this delay effectively kills the investigation.

• Only 15% of victims reported receiving timely updates on their case status.
• 60% of police forces lack dedicated cybercrime units.
• Victim support services are underfunded in 18 of the 27 member states.

The Commission's new measures are expected to mandate strict timelines for communication and updates.

Under the proposed rules, a victim must be informed of the outcome of the investigation within a specific period, regardless of whether a suspect is identified.

Transparency is the only way to rebuild trust, said a senior justice official.

We cannot ask victims to participate in the justice process if we refuse to keep them informed.

The report also criticises the lack of coordination between different agencies.

A victim might have to recount their traumatic experience to police, prosecutors, and support services separately, causing further distress.

The new framework aims to establish a single point of contact for victims of digital crime.

This 'one-stop-shop' approach would streamline the process and reduce the administrative burden on the victim.

However, implementing this requires significant investment in digital infrastructure and personnel training.

The Commission has hinted that funding will be made available through the Justice Programme, but member states will need to match these funds.

The political will to overhaul the system exists, but the practical challenges of implementation across diverse legal systems remain immense.

Canada Sets Precedent with Criminal Code Shift

The European initiative does not exist in a vacuum.

It mirrors a significant global trend towards tightening laws to protect the most vulnerable.

In December 2025, Canada overhauled its Criminal Code with the explicit goal of protecting victims and keeping children safe from predators.

This legislative package serves as a potential blueprint for what the Commission might propose.

The Canadian reforms introduced several harsher penalties for online offences, particularly those targeting children.

They also expanded the definition of voyeurism and non-consensual distribution of intimate images to cover a wider range of digital behaviours.

Perhaps most relevant to the EU context is the Canadian approach to victim restitution.

The new laws make it easier for courts to order convicted offenders to pay restitution to their victims.

This addresses a common frustration where victims of fraud lose their life savings, the criminal is caught, but the victim sees no financial recovery.

• Canada introduced mandatory minimum sentences for certain child luring offences.
• The reforms allow for the seizure of digital assets used in the commission of a crime.
• Victim impact statements were given greater weight in sentencing.

Legal analysts in Brussels have been closely monitoring the Canadian rollout.

The Canadian model shows that you can be tough on crime while still being compassionate towards victims, a criminal law expert observed.

It provides a balance that many European member states are currently seeking.

However, there are distinct differences between the Canadian and European legal contexts.

Canada has a unified criminal code, whereas the EU operates through directives that must be transposed into 27 different national legal systems.

This means the EU proposal must be flexible enough to accommodate different legal traditions while setting a high baseline for protection.

The Canadian overhaul also placed a strong emphasis on prevention, particularly in schools.

The Commission is expected to adopt a similar approach, funding educational programmes to teach children about the dangers of the internet.

Prevention is always better than cure, especially when the victim is a child, an education policy advisor said.

If we can stop the abuse before it happens, we have succeeded.

The alignment of these international efforts suggests a consensus is forming on the need for robust digital victim rights.

The Commission is likely to cite the Canadian example as evidence that such reforms are both necessary and workable.

Cross-Border Enforcement Challenges Remain

Despite the ambitious scope of the new measures, the fundamental challenge of cross-border enforcement remains the elephant in the room.

The internet has no borders, but police jurisdictions stop at national lines.

A fraudster operating from a non-EU country can target victims in France, Germany, and Italy with impunity.

The new Commission measures will strengthen cooperation between EU member states, but they have limited power over third countries.

Europol, the EU's law enforcement agency, has long warned about the 'safe havens' that cybercriminals exploit outside the bloc's jurisdiction.

The Commission's proposal is expected to include provisions for better cooperation with third countries, but this relies on diplomatic goodwill that is not always forthcoming.

• 80% of cyberattacks affecting the EU originate from outside the bloc.
• Mutual legal assistance treaties can take years to process.
• Only a fraction of stolen assets are ever repatriated to the victim's country.

To address this, the Commission is pushing for the 'e-evidence' regulation, which would allow service providers to disclose electronic evidence directly to law enforcement in another member state.

This bypasses the slow, cumbersome mutual legal assistance procedures currently in place.

Speed is of the essence in digital investigations, a cybercrime analyst explained.

By the time a request for evidence is processed through diplomatic channels, the data is gone.

However, the e-evidence package has faced opposition from privacy advocates and some tech companies who fear it could be used to bypass data protection laws.

The Commission must navigate this minefield carefully.

The new victim measures are likely to be tied to this broader legislative package, creating a comprehensive ecosystem of digital justice.

Yet, technical solutions are only part of the answer.

Cultural barriers between police forces also hinder cooperation.

Language differences, varying priorities, and a lack of shared databases mean that intelligence is not shared effectively.

The new measures propose the creation of specialised cybercrime liaison officers in every member state.

Their job would be to act as a bridge, ensuring that information flows quickly and accurately across borders.

We cannot fight 21st-century crime with 20th-century bureaucracy, the Commission official stated.

The success of this legislation will depend entirely on how well these new structures function in practice.

What Comes Next for EU Victim Rights

The drafting phase is just the beginning of a long legislative journey.

Once the Commission finalises the text, likely later this autumn, it will pass to the European Parliament and the Council of the European Union for negotiation.

This process is rarely smooth.

Member states with strong civil law traditions may resist elements that appear to infringe on their procedural sovereignty.

Similarly, the Parliament will likely push for even stronger protections, particularly regarding privacy and the rights of the child.

Advocacy groups are already mobilising to ensure their voices are heard in the negotiations.

We need to ensure that the definition of 'vulnerable' is broad enough to cover everyone who needs help, a victims' rights campaigner said.

It shouldn't just be about age or disability, but about the nature of the harm suffered.

The Commission is expected to propose a review clause, requiring the legislation to be assessed after five years to see if it is meeting its objectives.

This reflects the rapidly changing nature of the digital world, where a law written today might be obsolete by 2030.

The financial implications are also significant.

Member states will need to invest in training for police, prosecutors, and judges.

They will also need to fund the specialist support services mandated by the directive.

In an era of tight national budgets,