A new field study has found that browser personas modeled on older users encountered nearly twice as much scam or malicious content as other profiles. The findings have implications for identity, access, and endpoint security management in an environment where AI-powered fraud attacks are surging.
The study deployed decoy browser profiles across senior-living communities and monitored user-agent and browsing-event data. Profiles representing older individuals encountered scam or malicious elements on about one and a half percent of rendered pages, compared to less than one percent for other personas. While the full methodology has not been published, the differential indicates that attacker targeting can vary based on demographic traits.
Demographic Factors in Identity Risk
Although the study focused on browser behavior rather than identity systems, the results suggest that demographic characteristics shape attack surfaces. Older workers, retirees, and contractors may face elevated risk not only from weak credentials but also from tailored phishing, social engineering, and malvertising campaigns. This demographic targeting increases the likelihood that credentials associated with these users may be compromised or reused.
Enterprises that apply uniform authentication and access policies across all user populations risk underestimating exposure for higher-risk groups. Incorporating demographic and behavioral signals into adaptive authentication frameworks can improve protection for these users.
Security Recommendations
Identity and access teams are advised to expand user-risk modeling to include demographic and behavioral indicators such as age, job role, and browsing patterns. Stronger authentication measures, including device-bound passkeys and hardware-based multifactor authentication, should be enforced for users mapped to higher-risk profiles. Browser and endpoint configurations should also incorporate stricter ad-blocking, extension control, and sandboxing policies for such users.
Awareness training can be tailored to reflect the social engineering themes most likely to target older users, such as tech-support scams or benefits-related impersonations. Additionally, organizations should ensure that off-boarding and credential revocation procedures extend to users who continue to access systems post-retirement or from unmanaged devices.
Context and Limitations
While the reported malicious-content rate of one and a half percent may not be definitive, it aligns with broader research on online fraud risk among older adults. Studies have shown that frequent use of social networks and mobile applications correlates with greater exposure to scams. The core message for identity teams is that user demographics influence attack targeting and should be integrated into risk-based authentication strategies.
Sources: FTC Data Spotlight, FTC Consumer Sentinel Data Book 2024, FTC Press Release.
—
By Ali Nassar-Smith
