Vulnerable Groups & Targeted Exploitation
Targeted exploitation is not about finding unintelligent people. It is about finding people whose circumstances reduce the window for verification and raise the cost of inaction.
The Widow's Pension
Margaret was 72 and had managed her finances alone since her husband died three years earlier.
She received a letter, not an email, a physical letter, on what looked like government stationery. It said her pension account had been flagged for irregular activity. She needed to call a number to prevent her account from being suspended.
She called. The man who answered was patient, formal, and unhurried. He asked her to confirm her date of birth, her national insurance number, and her bank's sort code. Just for verification.
She provided all three. By the end of the week, £6,400 had left her account in transfers she did not authorise.
The letter was printed by the attackers. The number was theirs. The stationery was a copy-paste of a government template, freely available online.
The attack required no hacking. It required a printer, a phone number, and an understanding of who would call it.
What Is Actually Happening
$3.4B
lost by adults over 60 to fraud in the US in 2024, the highest reported losses of any age group.
Older adults are targeted for the combination of accumulated savings, trust in authority, and social isolation, not reduced intelligence.
Source: FBI IC3 Elder Fraud Report, 2025Tech Support Scams Target Over-60s
Adults over 60 account for 58% of all tech support scam losses. The combination of genuine unfamiliarity with devices and high trust in anyone claiming to be from a tech company is the specific vulnerability being exploited.
Online Enticement Rose 15% in 2024
NCMEC received over 32 million reports of suspected child sexual abuse material in 2023. Online enticement cases, where adults initiate sexual contact with minors online, rose 15% year-on-year. Gaming platforms are the primary first-contact point.
Immigration Threat Calls Surge
Impersonation scams targeting immigrants, threatening deportation or legal action unless immediate payment is made, represent one of the fastest-growing fraud categories. Fear of legal status loss is the primary lever, it overrides scepticism reliably.
Identity-Based Extortion on the Rise
LGBTQ+ individuals face specific extortion risk where disclosure of identity is used as a threat. Low trust in law enforcement reporting reduces the ability to seek help. Marginalised groups also face compounded harassment campaigns from coordinated groups.
Who Gets Targeted and Why
Each vulnerable group faces a different set of structural conditions that attackers exploit. These are not personal failings. They are circumstances.
Seniors
Older adults are targeted for three reasons: accumulated savings, high trust in authority figures, and relative social isolation. Telephone-based scams, tech support fraud, and romance scams are disproportionately concentrated in this group. Physical letters mimicking government stationery are used specifically because they are more persuasive to people who grew up with formal correspondence.
Children
Children have less experience with deception, higher openness to new contacts, and more time on platforms with minimal verification. Their vulnerability is not naivety, it is inexperience with manipulation as a deliberate act. Gaming platforms, social media, and chat apps are the primary targeting environments.
Immigrants and Recent Arrivals
Unfamiliarity with local systems, potential language barriers, and genuine vulnerability around legal status make immigrants highly susceptible to impersonation of authorities. The fear of deportation or legal consequences is a real and proportionate concern, attackers use that reality as leverage.
People in Mental Health Crisis or Financial Distress
Acute stress and financial pressure narrow the decision window. Someone who genuinely needs money today is less equipped to scrutinise a loan offer. This is not a cognitive failure. It is a predictable response to genuine pressure.
Disabled People and Care Dependents
Dependency on care services creates a legitimate need for help from strangers, which fake care agencies and grant impersonators exploit. The need for remote technical assistance creates an opening for remote access scams.
Try It: Who Gets Targeted
Select any profile to see the three most likely attacks targeting that person, and the specific vulnerability each one exploits.
What That Just Showed You
The script changes per profile.
The same attacker uses different approaches for an elderly pensioner, an immigrant worker, and a person in financial distress. The threat is the same. The framing is calibrated to whoever is on the receiving end.
One trusted contact changes everything.
In almost every scenario, having one person to call before acting is the protection. The gap is not awareness — it is access to someone who can pause the situation from the outside.
Knowing the profile means you can spot it for someone else.
The most effective protection for high-risk groups comes from people around them, not just from them. Recognising which attacks target whom in your network is a form of active protection.
Three Things Worth Doing
1. Talk to seniors in your network about the one rule that prevents most fraud. No government body, bank, or pension provider will call, email, or message asking for account credentials. If someone is asking for those details, hang up and call the official number independently.
2. For parents: build disclosure before the threat arrives. A child who knows they can tell a trusted adult anything without anger is far harder to groom or exploit. The conversation about online safety is less important than the relationship that makes disclosure possible.
3. Know the specific resources for your context. For elder fraud: Report to Action Fraud (UK), FTC (US), or Cyber Crime Helpline 1930 (India). For child exploitation: NCMEC (US), CEOP (UK), NCPCR (India). For immigrant fraud: local legal aid organisations and migrant rights NGOs.
One Question Before You Continue
Margaret received a physical letter on official-looking stationery and called the number on it. What made this attack effective, and what single action would have stopped it?