NCA research found cyber suspects average 17 years old, and most start before 16. See why arrests do not deter and what prevention looks like in practice.
Youth cybercrime is not a small problem, and arrests alone will not fix it. Research from the UK’s National Crime Agency found that the average age of suspects in its cyber investigations was 17, compared with 37 in drugs cases and 39 in economic crime. Most suspects had started hacking before 16. Because new young people keep arriving and see the risk as low, prevention has to start earlier than the police do.
The NCA published its “Pathways into Cyber Crime” report in 2017, based on interviews with offenders and people on the edge of cybercrime. It remains one of the clearest looks at how young people get involved.
| Finding | What the NCA reported |
|---|---|
| Age of suspects | Average of 17 in 2015, against 37 for drugs and 39 for economic crime |
| When it starts | 61% of suspects began hacking before age 16 |
| How it starts | Gaming cheat sites and game-modding forums, then criminal hacking forums |
| Main motive | Accomplishment and respect from peers, more than money |
| Barrier to entry | Off-the-shelf tools such as DDoS-for-hire and remote access trojans |
The report found no socio-demographic bias, so offenders came from many backgrounds, and cybercrime draws from every group. Information Age’s summary quotes the NCA saying that financial gain was not necessarily a priority for young offenders. Instead, the sense of completing a challenge and proving oneself to peers drove many of them.
One caution applies. The report drew on a small number of interviews and 2015 data. Newer, larger studies would help. Even so, its pattern matches what investigators describe today.
Arrests happen after the harm. They also do not seem to deter, though. The NCA report found that law enforcement activity did not act as a deterrent, because individuals considered cyber crime to be low risk.
That belief has a clear cause. First, illegal tools and services are advertised openly, and tutorials make them easy to use. Second, the act can feel like a game, and the victim is a faceless company. Many young people never think of it as a crime.
The NCA tried a different approach. As KrebsOnSecurity reported, it ran online ads aimed at young men aged 13 to 22 who searched for DDoS-for-hire services and remote access trojans. The ads pointed to other paths, such as using their skills legitimately. It was an early example of prevention reaching people before they were arrested.
Discover how Threatcop protects your workforce from modern cyber threats.
The path described by the NCA is gradual. Each step looks small.
First comes curiosity about games or computers. Next come cheat sites and modding forums, where people learn to change how software behaves. Then come forums where criminal tools and services are sold, often with tutorials. Status in these communities comes from skill, so a young person who feels unnoticed elsewhere can feel respected there.
However, nobody announces the moment it becomes a crime. A cheat tool becomes a bot. A bot becomes a rented attack service. Each step feels like a natural next one, and the consequences stay out of sight.
The NCA’s own conclusion was hopeful. Its Prevent team said that positive opportunities, role models, and mentors can steer young people away from cyber crime. It suggested pointing them toward coding and programming, and toward jobs in gaming and cyber security, which give the same sense of accomplishment and respect.
So the steps below are suggestions drawn from that idea, not research findings.
Young attackers do not need advanced tools. Many succeed through social engineering, the oldest method. They research staff, then phone the IT help desk and pretend to be an employee. These impersonation attacks work because they borrow a trusted identity. That is why the defenses are mostly about people and process, and why a rushed help desk is the usual weak point.
Verify identity before any password or MFA reset. Use a call-back to a number you already hold. Limit what the help desk can reset without a second approver. Log every reset request, and review the log weekly for patterns, such as repeated calls about the same account. And make it safe for staff to slow down, since young attackers count on rushed, helpful people.
Against youth cybercrime, rules help, but practice makes them stick. Threatcop Security Awareness Training (TSAT) runs simulations across multiple attack vectors, including voice, so help desk staff can meet a pressured caller in a safe setting. Its Employee Vulnerability Score shows who acts on those lures, and repeat-offender identification points coaching at the people who need it.
TSAT also reports average breach time, which shows how fast a lure turns into a compromise, and its Active Directory integration keeps role groups current. Threatcop Phishing Incident Response (TPIR) then gives staff a one-click way to report a suspicious message from email or WhatsApp. Its “Who Else” insight shows which other mailboxes received it, so one report protects the whole team.
The NCA’s research tells a consistent story. Young offenders start early, often through gaming, driven by respect more than money, and they see little risk. Arrests come late and do not deter. So the response has to include prevention: real challenges, clear legal lines, role models, and a path from curiosity to a career. Security teams still have to defend against the attackers who slip through. Verify identity at the help desk, train people with realistic practice, and make reporting easy. Do both, and fewer young people become attackers while fewer attacks succeed.
Youth cybercrime is cybercrime committed by young people, often teenagers. It ranges from using cheat or hacking tools to joining organized groups that attack companies. Research from the UK’s NCA found that suspects in its cyber cases were far younger than in other crime types.
The NCA found that many start through gaming, move to cheat and modding forums, and then reach criminal hacking forums. Motives often involve accomplishment and peer respect more than money. Free tools and tutorials lower the skill barrier, and many see the risk as low.
In 2015, the NCA reported an average age of 17 for suspects in its cyber crime investigations. The average was 37 in its drugs cases and 39 in economic crime cases. The report also found that 61% of suspects began hacking before age 16.
Not on their own. The NCA found that law enforcement activity did not deter young offenders, who considered cyber crime low risk. Prevention that offers legitimate challenges, role models, and mentors, before people are arrested, aims to reach them earlier.
To defend against youth cybercrime, focus on the help desk and the people around it. Verify identity before any reset, use call-backs, require a second approver for sensitive changes, and train staff with realistic phone-based simulations. Protect accounts with phishing-resistant MFA, and give staff an easy way to report odd requests. Vishing awareness and simulation covers the phone-based practice.
Anjali is the Cybersecurity Manager at Kratikal, leading a team focused on strengthening security through rigorous vulnerability assessments and penetration testing. With expertise across web, network, and cloud environments, she drives strategies to safeguard clients’ critical assets while mentoring her team and staying ahead of escalating cyber threats.
Teen-led groups hit M&S, Co-op, and Harrods through help desk calls. See why young people turn to hacking and...
Help desk impersonation, fake booking-site emails, and vendor risk drive travel cyber losses. See the patterns, the MGM figures,...
AI code is flawed in nearly half of tested tasks, and developers are targets too. See how to train...
