# The Influence of Interpersonal Factors on Telecommuting Employees' Cybercrime Preventative Behaviours During the Pandemic

Tim Wright, Zainab Ruhwanya, Jacques Ophoff

► To cite this version:

Tim Wright, Zainab Ruhwanya, Jacques Ophoff. The Influence of Interpersonal Factors on Telecommuting Employees' Cybercrime Preventative Behaviours During the Pandemic. 17th International Symposium on Human Aspects of Information Security and Assurance (HAISA), Jul 2023, Kent, United Kingdom. pp.445-458, 10.1007/978-3-031-38530-8_35. hal-05462119

HAL Id: hal-05462119

https://inria.hal.science/hal-05462119v1

Submitted on 16 Jan 2026

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# The Influence of Interpersonal Factors on Telecommuting Employees' Cybercrime Preventative Behaviours During the Pandemic

Tim Wright<fnref n="1" />, Zainab Ruhwanya<fnref n="1" />(✉) ID, and Jacques Ophoff<fnref n="1" />,<fnref n="2" /> ID

**Abstract.** The pandemic forced a major shift in the way employees were completing their work duties. This meant that there was an increased dependence on cyberspace to perform work duties. Although this had its benefits, it also came with its challenges. Cybercrimes, in specific, increased dramatically as more and more people were using cyberspace. Cybercriminals evolved their attacks, and many more people began to fall victim to these cybercriminals. It was the sudden shift to telecommuting which meant that people did not have the correct cybercrime preventative behaviours which could help them to fight these criminals. Telecommuting also meant that employees now had a different work environment, which meant that the interpersonal factors that employees had were different from traditional workspaces. There are limited studies addressing this problem and certainly very few in the South African context. Therefore, this empirical report presents the influence of interpersonal factors on telecommuting employees' cybercrime preventative behaviours. An adapted framework is proposed and evaluated using data collected from 209 South African employees. Descriptive statistics and data analysis were conducted through IBM SPSS and PLS-SEM, respectively. The results uphold the suitability of the adapted Theory of Interpersonal Behaviour model. The results show that the intention to perform cybercrime preventative behaviours has a strong impact on an employee's performing those cybercrime preventative behaviours. It also shows how the habit of an employee with regard to cybercrime preventative behaviours also has a strong impact on the employees performing these preventative behaviours.

**Keywords:** Information security · Cybercrime · Telecommute · COVID-19

## 1 Introduction

The pandemic and nationwide lockdowns forced a significant shift in social situations such as work and learning. For organisations, this resulted in the

© IFIP International Federation for Information Processing 2023

Published by Springer Nature Switzerland AG 2023

S. Furnell and N. Clarke (Eds.): HAISA 2023, IFIP AICT 674, pp. 445–458, 2023.

https://doi.org/10.1007/978-3-031-38530-8_35

<footnote n="1">¹ University of Cape Town, Cape Town, South Africa
WRGTIM001@myuct.ac.za, zainab.ruhwanya@uct.ac.za</footnote>

<footnote n="2">² Abertay University, Dundee, UK
j.ophoff@abertay.ac.uk</footnote>
widespread adoption of telecommuting, which in turn established a new nor-
mal for employees. In this study, telecommuting refers to the practice of working
from home while utilising information and telecommunication technologies, such
as the Internet, to access and engage with organisational resources as though the
employee were physically present at the corporate offices [30].

Social situations during the pandemic, such as telecommuting and online
learning, contributed to increased reliance on the Internet. In South Africa,
reports indicate that internet use increased by 14% overall, with an even greater
increase of 20% among full-time employees [1]. Unfortunately, this shift also
resulted in a rise in cybercrime. Studies report a 667% increase in COVID-
19-related phishing messages [33], highlighting the growing cybersecurity risks.
Additionally, the FBI's Internet Crime Complaint Centre experienced a sub-
stantial increase in daily complaints, from around 1,000 before the pandemic to
3,000–4,000 during the pandemic [10].

During the pandemic, people experienced various affects, which translates as
emotional states such as stress, trauma, loneliness, depression, and anxiety [28].
This created an opportunity for cybercriminals to exploit these psychological
vulnerabilities. Victims of cybercrime often face negative consequences, including
feelings of outrage, anxiety, stress, loss of confidence in technology, and reduced
interest in adopting new technologies [5]. Bada & Nurse [5] argue that individuals
are more likely to change their behaviour in response to cybercrime when they
perceive a high risk and exposure to a threat that could cause harm. However,
those who believe they have sufficient knowledge of cybercrime are less likely
to change their behaviour. Therefore, understanding the influence of affects on
cybercrime prevention behaviours is crucial to developing effective strategies that
promote cybersecurity awareness and resilience in a telecommuting and stressful
environment.

This study aims to examine the influence of interpersonal factors such as
social factors (norms, roles, social situation and person's self-concept), affects
(positive or negative emotions) and the perceived consequences (subjective prob-
ability that a particular consequence will follow the behaviour and the affect
attached to that consequence), on telecommuting employees' intention to per-
form cybercrime preventative behaviours. This study will use the theory of inter-
personal behaviour [40], which helps to explain how the strength of habit and
behaviour intention can affect a person's behaviour [34].

The remainder of this paper is organised as follows. First, the theoretical
framework is discussed, including the hypotheses and conceptual model. This is
followed by a description of the research design. Next the data analysis is pre-
sented, followed by a discussion of the results. Lastly, the conclusion summarises
the research contributions and opportunities for future work.

## 2 Literature Review

During the COVID-19 pandemic, the rapid shift towards telecommuting exposed
employees to increased cyber threats due to inadequate safeguards. Existing lit-
erature discusses various aspects of cybercrime during the pandemic, such as the
increase in cybercrime [33], cybercriminal targets [6,31], a rise in cyberattacks [9,29], effects of cybercrime on individuals [5], and cybercrime behaviour [5,13]. Cybercriminals primarily targeted older individuals and those with psychological vulnerabilities [6,31], exploiting their inexperience with technology and reliance on it for daily tasks during the pandemic. The effects of cybercrime on individuals include anxiety, anger, loss of confidence in technology, and in severe cases, symptoms of Acute Stress Disorder [5]. Unfortunately, individuals who believe they are well informed about cyber risks may feel less vulnerable and not adopt countermeasures [24], potentially putting them at risk [13]. People's motivation to change their behaviour depends on the perceived severity of the threat, susceptibility to it, and the cost and effort of prevention [2,8,12,23]. While the existing literature provides valuable insights into the effects of cybercrime [5], it does not sufficiently address the impact of pandemic-induced stress, anxiety, and isolation on employees' cybercrime preventative behaviours.

Previous research on employees' cybercrime preventative behaviours has largely focused on factors such as deterrence theory [2, 11, 12] and compliance with information security policies (ISPs) [8,23]. These studies have significantly contributed to our understanding of how employees can safeguard information and technology resources and how organisations can devise mechanisms to improve compliance with ISPs. However, there is a noticeable gap in the literature concerning interpersonal factors influencing employees' cybercrime preventative behaviours, specifically in the context of telecommuting.

The majority of existing literature assumes that employees are working in traditional office settings, where face-to-face interactions and well-established social norms contribute to shaping employee behaviours. Although some studies have considered the role of virtual status (telecommuting) and ISP compliance [11], the literature largely overlooks the emotional factors that might influence telecommuting employees' cybercrime preventative behaviours. The stress, anxiety, and isolation experienced by employees working from home may have a considerable impact on their adherence to ISPs, and this area warrants further investigation. Furthermore, the shift in situational factors and the lack of physical interaction with colleagues and organisational support may lead to a decreased sense of responsibility towards protecting sensitive information and adhering to cybersecurity best practices. This gap in the literature highlights the need to explore the interpersonal factors influencing employees' cybercrime preventative behaviours during the COVID-19 pandemic.

# 3 Theoretical Framework

This study's conceptual model is built upon the theory of Interpersonal Behaviour (TIB) [40]. The TIB is a comprehensive cognitive model that expands upon Ajzen and Fishbein's Theory of Reasoned Action [3] and Ajzen's Theory of Planned Behaviour [4] where the theories posit that an individual's intention to perform a specific act is the primary determinant of their behaviour. TIB accounts for additional factors such as habits, facilitating conditions, and affect,
which contribute to its predictive power over other models [27, 42]. The TIB emphasises the importance of even small amounts of variance in behaviour, as they can be socially significant [37, 42].

The TIB considers interpersonal behaviour as a multifaceted phenomenon shaped by attitudes, habits, social factors, affects, and situational constraints. The tri-level model, as seen in Fig. 1, explores how these factors influence the formation of intentions and ultimately predict the performance of specific behaviours. Though less frequently used, TIB has demonstrated its value in understanding complex human behaviours across various contexts. For instance, [42] used TIB to study internet abuse in the workplace, while [32, 34] applied the TIB model to explain non-work related computing in the workplace and personal use of the Internet at work. [37] used to explain software piracy behaviour, and [7] investigated cyberloafing using TIB in combination with the theory of organisational justice. Other research includes understanding telemedicine adoption by physicians [18] and examining the relationship between computer self-efficacy, anxiety, experience, support and usage [16]. These diverse applications of the TIB model demonstrate its usefulness in explaining and understanding complex human behaviours influenced by social and physical environments.

<figure><img src="image_3.png" /><figcaption>Fig. 1. The theory of interpersonal behaviour adopted from [34]</figcaption></figure>

**Affect.** Affect refers to the emotions an individual feels when thinking about a particular behaviour [40, p. 9]. These emotions can be positive or negative, and they can vary in intensity [34, 37]. During the pandemic, people experienced various emotional states such as stress, trauma, loneliness, depression, and anxiety [28], which created opportunities for cybercriminals to exploit these psychological vulnerabilities. Victims of cybercrime often face negative consequences, including outrage, anxiety, stress, loss of confidence in technology, and reduced interest in adopting new technologies [5]. Bada et al. [5] argue that individuals are more likely to change their behaviour in response to cybercrime when they perceive a high risk and exposure to a threat that could cause harm, but those with sufficient knowledge of cybercrime are less likely to change their behaviour. Understanding the influence of affect on cybercrime prevention behaviours is crucial for developing effective strategies that promote cybersecurity awareness and resilience in telecommuting and stressful environments. Based on the above evaluation, we can formulate the following hypothesis H1:
*H1: The affect of an employee towards cybercrimes positively influences their intention to perform cybercrime preventative behaviours.*

**Social Factors.** Social factors are comprised of norms, roles, and self-concepts that form due to the interactions individuals have with the people around them [37, p. 8–9]. If people around them have been victims of cybercrime, they may want to enhance their protection so that they do not fall victim as well. Research suggests that employees are more likely to engage in secure behaviours if they perceive support from their organisation and colleagues [11]. As employees adjust to remote work, they may look to their colleagues and supervisors for guidance on cybersecurity best practices. Based on the above evaluation, we can formulate the following hypothesis H2:

*H2: The social factors that form due to the people around an employee have a positive influence on their intention to perform cybercrime preventative behaviours.*

**Norms.** Norms are beliefs that guide an individual’s understanding of which behaviours are acceptable and which are not [40, p. 9]. Norms can influence people to change their behaviour by increasing their desire and pressure to conform to the group’s expected behaviour [32]. The presence of norms can create a cue or pressure that increases the likelihood that the individual will behave in accordance with the given norm [25, 32]. The pandemic disrupted many aspects of daily life, including the norms that guide employees’ understanding of acceptable and unacceptable behaviour [25]. Based on the above evaluation, we can formulate the following hypothesis H3:

*H3: The norms related to cybercrime preventative behaviours have a positive relationship with social factors.*

**Roles.** Roles can be understood as the expected behaviour of an individual based on their position within a group. Roles must be considered when understanding how an individual behaves, as each individual with a different role within a group will likely behave differently based on their role [32]. Therefore, employees’ roles within their organisation can also influence their cybercrime preventative behaviours. For instance, individuals in managerial or leadership positions may be more likely to promote secure behaviours among their team members. Based on the above evaluation, we can formulate the following hypothesis H4:

*H4: The roles related to cybercrime preventative behaviours have a positive relationship with social factors.*

**Self-Concept.** An individual’s self-concept towards a behaviour is likely to affect the amount of social influence perceived by that individual [32]. This is proposed to impact social factors due to the ability of significant and known others to observe behaviours [32]. If an individual believes that it is important to
protect themselves from cybercrimes, they will likely experience pressure from known others to engage in this behaviour. Furthermore, studies have shown that employees who perceive a higher level of control over their cybersecurity behaviours are more likely to engage in such behaviours [2]. Based on the above evaluation, we can formulate the following hypothesis H5:

*H5: The self-concepts related to cybercrime preventative behaviours have a positive relationship with social factors.*

**Perceived Consequences.** Perceived consequences refer to the outcomes that a person believes will occur due to a certain behaviour, and these outcomes can either be positive or negative [37]. Employees who perceive the potential consequences of cybercrime as severe are more likely to engage in preventative behaviours [2, 11]. Based on the above evaluation, we can formulate the following hypothesis H6:

*H6: An employee's perceived consequences of cybercrimes have a positive influence on their intention to perform cybercrime preventative behaviours.*

**Habit.** Habit refers to situation-behaviour sequences that have become automatic (occurring or done without self-instruction or deliberately) in response to something that has happened in their environment [34]. A habit is a form of routine behaviour; the behaviour has become habitual because it is either easy, comfortable, or rewarding [15]. In the context of cybersecurity, habitual behaviours such as updating software, using strong passwords, and avoiding phishing emails are crucial for preventing cybercrime. Research has shown that habits are essential predictors of behaviours [40]; as such, the shift to telecommuting, which disrupted many employees' daily routines, may have affected their cybercrime preventative behaviours. A change in habit can also make people change their behaviour, such as people altering their behaviour after learning about the effects of cybercrimes. By evaluating the above, we can create the following hypotheses H7 and H8.

*H7: The habit of an employee with regard to cybercrime preventative behaviours has a positive influence on their affect towards cybercrimes.*

*H8: The habit of an employee with regards to cybercrime has a positive influence on their cybercrime preventative behaviours.*

**Intention.** Intention can be defined as “an individual’s conscious plan or self-instruction to carry out a behaviour” [34, p. 8]. It refers to the amount of effort someone is willing to exert for a particular behaviour [37]. After experiencing or learning about the effects of cybercrime, a person might be more motivated to change their behaviour to better protect themselves. The intention to perform a behaviour often has a strong influence on the individual actually carrying out that behaviour [32]. If an individual has both a habit of being aware of cybercrime and cybersecurity and an intention to improve their behaviour in this regard, they are likely to do so [32]. Based on this evaluation, we can formulate the following hypothesis H9:
*H9: An employee's intention to perform cybercrime preventative behaviours has a positive influence on them actually performing those behaviours.*

**Facilitating Conditions.** Facilitating conditions refer to factors in an individual’s environment that make a behaviour easier to perform [34]. An individual may have the intention to perform a behaviour, but they might lack the environment (i.e., the facilitating conditions) in which to do so, or their environment may hinder them from performing that behaviour [37]. For instance, people who want to protect themselves from cybercrimes may not have the appropriate environment or skills to do so. The COVID-19 pandemic significantly impacted employees’ social and physical environments [25], as they were forced to telecommute during strict lockdowns. Remote work during the pandemic presented unique challenges in terms of facilitating conditions for cybercrime prevention and employees may have had limited access to information and resources. Based on the above evaluation, we can formulate the following hypothesis H10:

*H10: An employee's access to information on cybercrime preventative behaviours while telecommuting during the pandemic had a positive influence on them actually performing those behaviours.*

## 4 Research Design

A deductive approach was used to study the influence of interpersonal factors on telecommuting employees’ cybercrime preventative behaviour during COVID-19. This allowed the causal relationships hypothesised by the theoretical framework to be tested.

The research instrument, accessible at [43], consisted of two parts. The first part collected demographic data such as age, gender, the highest level of education, duration of working from home, and experiences with cybercrime, with questions adapted from [26]. The second part assessed theoretical constructs, including norms, roles, self-concept, social factors, affect, perceived consequences, habit, facilitating conditions, intention, and behaviour with constructs adapted from [7,32,34]. These constructs were evaluated using a 5-point Likert scale, with options ranging from “strongly agree” to “strongly disagree”. The instrument was pilot tested with 11 participants who were a subset of the population. Based on feedback from the participants, small adjustments were made to the length and layout of the instrument. To address method bias [35] we implemented several procedural guidelines. This included using clear and concise language (confirmed by the pilot study), labelling all scale points, and assuring participants that their responses will remain anonymous and confidential.

The study was granted ethical clearance prior to data collection commencing. An online survey was set up using the Qualtrics platform and distributed via the Prolific platform. A probability sampling strategy was used to target employees living in South Africa during the COVID-19 pandemic (2020–2022). Prolific filters were used to target the desired sample and restrict participants to those
with a 100% completion rate on the platform. Data was collected in August 2022, and participants were compensated for their time according to Prolific guidelines.

# 5 Analysis and Results

To analyse the data, IBM SPSS was used for initial data cleaning and a descriptive analysis. Following this, SmartPLS was used for hypothesis testing using Partial Least Squares Structural Equation Modelling (PLS-SEM). PLS-SEM is “particularly suited to situations in which constructs are measured by a very large number of indicators and where maximum likelihood covariance-based SEM tools reach their limit” [19, p. 283]. PLS-SEM is frequently used in research for measuring the relationship of constructs in model-based research using latent variables. Despite its widespread use, it is acknowledged that the method is not without controversy [38, 39]. It appears that information systems, the discipline in which this work is based, has not taken a firm view on the use of the method. Nevertheless, we have endeavoured to apply methodological guidelines to ensure rigour in the following analysis.

The survey was completed by 209 respondents. Respondents were aged from 18–60+ years with the majority (62.2%) being between the ages of 21–30. By gender, there were 66.5% female, 32.1% male, and 1.4% non-binary/third-gender respondents. Most respondents (58.9%) had a bachelor’s degree. Almost half of the respondents (48.3%) had been working from home for 0–12 months, with 34.9% working from home for 13–24 months. Most respondents had some sort of experience with cybercrime, whether as a victim themselves (30.6%) or knowing someone who had been a victim (45.0%).

## 5.1 Measurement Model

The first part of the PLS-SEM analysis examined the measurement model for reliability and validity. The model was assessed using outer loadings, Cronbach’s alpha, composite reliability (CR) and average variance extracted (AVE) to evaluate the internal consistency, indicator reliability and convergent validity.

Following PLS-SEM guidelines, indicators with outer loadings below 0.7 were evaluated and removed if this improved CR and AVE. All constructs were retained, with sufficiently reliable indicators to proceed, as shown in Table 1. All Cronbach’s alpha values were above the 0.7 threshold. It is argued that CR is a better indicator of reliability in a multi-construct model [36]. All CR values were also above the 0.7 threshold. For completeness, we present both measures. Lastly, the AVE was examined for convergent validity, where a threshold of 0.5 is recommended [21, 36]. All AVE values were above the threshold.

Next discriminant validity was assessed, which is “the degree to which the measures of different constructs differ from one another” [41, p. 19]. Both the Fornell-Larcker and Heterotrait-Monotrait Ratio (HTMT) criteria was satisfied. The HTMT recommends values be equal to or less than 0.9 [22]. All values
<table><caption>**Table 1.** Construct reliability and convergent validity</caption><thead><tr><th>Construct</th><th>Cronbach's Alpha</th><th>Composite Reliability</th><th>Average Variance Extracted</th></tr></thead><tbody><tr><td>Norms</td><td>0.870</td><td>0.901</td><td>0.605</td></tr><tr><td>Roles</td><td>0.836</td><td>0.901</td><td>0.752</td></tr><tr><td>Self-Concept</td><td>0.800</td><td>0.882</td><td>0.714</td></tr><tr><td>Social Factors</td><td>0.831</td><td>0.881</td><td>0.600</td></tr><tr><td>Affect</td><td>0.875</td><td>0.898</td><td>0.561</td></tr><tr><td>Perceived Consequences</td><td>0.863</td><td>0.892</td><td>0.581</td></tr><tr><td>Habit</td><td>0.936</td><td>0.945</td><td>0.539</td></tr><tr><td>Facilitating Conditions</td><td>0.874</td><td>0.914</td><td>0.726</td></tr><tr><td>Intention</td><td>0.947</td><td>0.966</td><td>0.904</td></tr><tr><td>Behaviour</td><td>0.708</td><td>0.872</td><td>0.772</td></tr></tbody></table>

except one (at 0.943) were below the threshold. This does not disprove that discriminant validity has been achieved because the HTMT measure is not a strict requirement for measuring discriminant validity. The sample size could be a limitation which contributed to the value being above the 0.9 threshold. Importantly the value is not greater than 1 and overall thus overall adequate discriminant validity was achieved.

## 5.2 Structural Model

With the reliability and validity of the model having been established, the structural model was assessed. This replicates the paths (relationships) between the different constructs that have been hypothesised. To evaluate the structural model, the values of the path coefficients were used, as well as the coefficient of determination ($R^2$). Analysis used the recommended 5000 bootstrap samples and a two-tailed bias-corrected and accelerated bootstrapping procedure, using a significance level of 0.05 [20, 21, 36].

$R^2$ represents the amount of variance in the endogenous constructs explained by the exogenous constructs linked to it. $R^2$ values range between 0 and 1 with higher values indicating better predictive accuracy. A threshold for $R^2$ is around 0.1 but is dependent on the type of study; values for predicting human behaviour are usually lower than normal [17]. Therefore, even though affect has a value less than 0.1, predictive power is still achieved. $R^2$ values were calculated as social factors (0.151), affect (0.066), intention (0.137), and behaviour (0.680), respectively.

Hypotheses testing indicated that two were not supported (H4, H5) while three hypotheses were significant at the 5% level (H1, H2, H7) and five hypotheses were significant at the 1% level (H3, H6, H7, H8, H9). These results are summarised in Table 2.
<table><caption>**Table 2.** Overview of findings</caption><thead><tr><th>Hypothesis</th><th>Path Coefficient</th><th>T-Value</th><th>P-Value</th><th>Supported?</th></tr></thead><tbody><tr><td>H1: Affect → Intention</td><td>0.17</td><td>2.293</td><td>0.022</td><td>Yes</td></tr><tr><td>H2: Social Factors → Intention</td><td>0.171</td><td>2.216</td><td>0.027</td><td>Yes</td></tr><tr><td>H3: Norms → Social Factors</td><td>0.289</td><td>2.611</td><td>0.009</td><td>Yes</td></tr><tr><td>H4: Roles → Social Factors</td><td>0.067</td><td>0.716</td><td>0.474</td><td>No</td></tr><tr><td>H5: Self-Concept → Social Factors</td><td>0.067</td><td>0.589</td><td>0.556</td><td>No</td></tr><tr><td>H6: Perceived Consequences → Intention</td><td>0.167</td><td>3.071</td><td>0.002</td><td>Yes</td></tr><tr><td>H7: Habit → Affect</td><td>0.257</td><td>3.992</td><td>0</td><td>Yes</td></tr><tr><td>H8: Habit → Behaviour</td><td>0.552</td><td>9.695</td><td>0</td><td>Yes</td></tr><tr><td>H9: Intention → Behaviour</td><td>0.308</td><td>4.396</td><td>0</td><td>Yes</td></tr><tr><td>H10: Facilitating Conditions → Behaviour</td><td>0.114</td><td>2.48</td><td>0.013</td><td>Yes</td></tr></tbody></table>

From the results, it can be concluded that there is a strong relationship between habit and affect, and a moderate relationship between affect, social factors, and intention. This is consistent with the results of Woon et al. [42]. Consistent with Moody & Siponen [32], there is a strong relationship between norms and social factors. However, contrary to their results, there was a weak relationship between roles and social factors, and this hypothesis was rejected. This could be because prior literature examined non work-related personal use of the Internet at work. It appears that cybercrime preventative behaviours in specific roles at work do not help to predict the social factors affecting employees. It is shown that self-concept has a weak effect on social factors (p = 0.567). Again this was not consistent with Moody & Siponen [32], perhaps indicating that peoples' beliefs about cybercrime preventative behaviours do not imply they will experience pressure from others as to how they should behave.

It is shown that habit is a strong predictor of behaviour, and there is also a strong relationship between intention and behaviour. This is consistent with Moody & Siponen [32] and Pee et al. [34]. There is a strong relationship between perceived consequences and intention and between facilitating conditions and behaviour, consistent with Pee et al. [34].

# 6 Discussion

Due to COVID-19, many businesses needed to start the telecommuting way of business. This created an increase in cybercrime during this period as more people were now using the Internet and devices to perform their work duties, phishing, for example, increased by 667% during this time [33]. These cybercrimes increased peoples' anxiety, stress, or anger during COVID-19, and it has been found that people will change their behaviour towards cybercrimes if their perceived risk is high or if they or someone they know falls victim to a cybercrime [5]. To reduce the risk of falling victim to a cybercrime, people can perform
cybercrime preventative behaviours, which will reduce the opportunity of cyber-
crime as it will take cybercriminals more time and effort to get the person’s
information [14].

By first assessing the demographic statistics, one can observe that the major-
ity of respondents either experienced cybercrimes themselves or know of someone
who has experienced cybercrimes (75.6% combined). This ties into the literature
surrounding the fact that cybercrime increased during COVID-19 [33]. Respon-
dents mostly agree or strongly agree that they intend to, will, and expect to
perform cybercrime preventative behaviours while telecommuting in the future.
This is consistent with the fact that people will change their behaviour towards
cybercrimes after becoming a victim or from the influence of the people around
them [5].

By assessing the structural model, one can first observe that, as predicted
by the TIB, the intention to engage in cybercrime preventative behaviour
strongly predicts actual behaviour towards cybercrime preventative behaviours.
One can also observe that an individual's habits towards cybercrime preven-
tative measures strongly predict actual behaviour towards cybercrime preven-
tive behaviours. This shows how the habit of an individual can strongly predict
whether they will engage in that specific behaviour. These are relationships sup-
ported by prior literature [32] though in the context of non work-related personal
use of work computers.

Facilitating conditions surrounding an individual appear to predict whether they will perform cybercrime preventative measures. In addition, the affect of a respondent predicted whether they intend to perform cybercrime preventative behaviours in the future. Interestingly, the hypotheses for both roles and self-concept for predicting social factors were both rejected. This is contrary to findings where self-concept strongly predicted the social factors surrounding non work-related personal use of work computers [32]. This means that both roles and self-concepts of cybercrime preventative behaviours do not predict the social factors surrounding cybercrime preventative behaviours well.

7 Conclusion

This study explored the interpersonal factors influencing telecommuting employ-
ees' cybercrime preventative behaviours during COVID-19 pandemic. TIB was
used as a foundation for the research. Intention and habit were found to be signifi-
cant predictors of behaviour, as well as being positively correlated to behaviour,
as was predicted. Facilitating conditions were also found to be a predictor of
behaviour, although not as strong as both habit and intention, as well as a
positive predictor of behaviour, this was also predicted. Affect, perceived con-
sequences, and social factors were all found to be predictors of intention, and
all were positively correlated to intention, as was also predicted. These findings
indicate that an individual's intention and current habits regarding cybercrime
prevention strongly influence their engagement in such behaviours. Access to rel-
evant resources also plays a role in the decision to engage in cybercrime preven-
tative actions. Moreover, an individual's perceived consequences of not engaging
in cybercrime preventative behaviours, their emotions towards cybercrimes, and
the influence of their social environment impact their intention to engage in such
behaviours.

Thus, organisations should prioritise a positive emotional environment around cybersecurity among their telecommuting employees. Establishing strong cybersecurity social norms within remote work settings and raising awareness of cybercrime consequences. Additionally, promote the development of robust cybersecurity habits tailored to telecommuting and ensure remote employees have easy access to the necessary resources and tools for preventing cybercrime.

This study provides a testable framework that could be enhanced in future work. First, the study adopted self-reported cybercrime preventative behaviours as a dependent variable, which may introduce self-report bias. Future studies could devise measures of actual cybercrime preventative behaviours. Second, the study focused specifically on the cybercrime preventative behaviours of telecommuting employees within South Africa. As a result, it should be cautiously generalised to a broader population; this opens opportunities for future studies to investigate cybercrime preventative behaviours within different contexts. Further exploration is required to understand the limited role of roles and self-concept in predicting social factors.

References

1. Africa online: Internet access spreads during the pandemic. https://news.gallup.com/poll/394811/africa-online-internet-access-spreads-during-pandemic.aspx. Accessed 21 Apr 2023

2. Herath, T., Rao, H.R.: Protection motivation and deterrence: a framework for security policy compliance in organisations. Eur. J. Inf. Syst. **18**(2), 106–125 (2009)

3. Ajzen, I., Fishbein, M.: Theory of reasoned action in understanding attitudes and predicting social behaviour. J. Soc. Psychol. (1980)

4. Ajzen, I.: From intentions to actions: a theory of planned behavior. In: Kuhl, J., Beckmann, J. (eds.) Action Control. SSSSP, pp. 11–39. Springer, Heidelberg (1985). https://doi.org/10.1007/978-3-642-69746-3_2

5. Bada, M., Nurse, J.R.: The social and psychological impact of cyberattacks. In: Emerging Cyber Threats and Cognitive Vulnerabilities, pp. 73–92. Elsevier (2020)

6. Benbow, S.M., Bhattacharyya, S., Kingston, P., Peisah, C.: Invisible and at-risk: older adults during the COVID-19 pandemic. J. Elder Abuse Negl. **34**(1), 70–76 (2022)

7. Betts, T.K., Setterstrom, A.J., Pearson, J.M., Totty, S.: Explaining cyberloafing through a theoretical integration of theory of interpersonal behavior and theory of organizational justice. J. Organ. End User Comput. (JOEUC) **26**(4), 23–42 (2014)

8. Bulgurcu, B., Cavusoglu, H., Benbasat, I., Burcu, B., Cavusoglu, H., Benbasat, I.: Information security policy compliance: an empirical study of rationality-based beliefs and information security awareness. MIS Q. **34**, 523–548 (2010)

9. Chigada, J., Madzinga, R.: Cyberattacks and threats during COVID-19: a systematic literature review. S. Afr. J. Inf. Manage. **23**(1), 1–11 (2021)

10. Cimpanu, C.: FBI says cybercrime reports quadrupled during COVID-19 pandemic. ZD Net (2020)
11. D'Arcy, J., Herath, T.: A review and analysis of deterrence theory in the IS security literature: making sense of the disparate findings. Eur. J. Inf. Syst. **20**(6), 643–658 (2011). https://doi.org/10.1057/ejis.2011.23

12. D'Arcy, J., Hovav, A., Galletta, D.: User awareness of security countermeasures and its impact on information systems misuse: a deterrence approach. Inf. Syst. Res. **20**(1), 79–98 (2009). https://doi.org/10.1287/isre.1070.0160

13. De Kimpe, L., Walrave, M., Verdegem, P., Ponnet, K.: What we think we know about cybersecurity: an investigation of the relationship between perceived knowledge, internet trust, and protection motivation in a cybercrime context. Behav. Inf. Technol. **41**(8), 1796–1808 (2022)

14. Drew, J.M.: A study of cybercrime victimisation and prevention: exploring the use of online crime prevention behaviours and strategies. J. Criminol. Res. Policy Pract. **6**, 17–33 (2020)

15. Egmond, C., Bruel, R.: Nothing is as practical as a good theory. Analysis of theories and a tool for developing interventions to influence energy-related behaviour (2007)

16. Fagan, M.H., Neill, S., Wooldridge, B.R.: An empirical investigation into the relationship between computer self-efficacy, anxiety, experience, support and usage. J. Comput. Inf. Syst. **44**(2), 95–104 (2004)

17. Frost, J.: How high does R-squared need to be. Statistics by Jim (2021)

18. Gagnon, M.P., et al.: An adaptation of the theory of interpersonal behaviour to the study of telemedicine adoption by physicians. Int. J. Med. Inform. **71**(2–3), 103–115 (2003)

19. Haenlein, M., Kaplan, A.M.: A beginner's guide to partial least squares analysis. Underst. Stat. **3**(4), 283–297 (2004). https://doi.org/10.1207/s15328031us0304_4

20. Hair, J.F., Hult, G.T.M., Ringle, C.M., Sarstedt, M.: A primer on partial least squares structural equation modeling (2014)

21. Hair Jr., J.F., Hult, G.T.M., Ringle, C.M., Sarstedt, M., Danks, N.P., Ray, S.: Partial Least Squares Structural Equation Modeling (PLS-SEM) Using R. CCB, Springer, Cham (2021). https://doi.org/10.1007/978-3-030-80519-7

22. Henseler, J., Ringle, C.M., Sarstedt, M.: A new criterion for assessing discriminant validity in variance-based structural equation modeling. J. Acad. Mark. Sci. **43**, 115–135 (2015)

23. Ifinedo, P.: Understanding information systems security policy compliance: an integration of the theory of planned behavior and the protection motivation theory. Comput. Secur. **31**, 83–95 (2012). https://doi.org/10.1016/j.cose.2011.10.007

24. Ifinedo, P.: Effects of security knowledge, self-control, and countermeasures on cybersecurity behaviors. J. Comput. Inf. Syst. **63**(2), 380–396 (2023)

25. Kautondokwa, P., Ruhwanya, Z., Ophoff, J.: Environmental uncertainty and end-user security behaviour: a study during the COVID-19 pandemic. In: Drevin, L., Miloslavskaya, N., Leung, W.S., von Solms, S. (eds.) WISE 2021. IAICT, vol. 615, pp. 111–125. Springer, Cham (2021). https://doi.org/10.1007/978-3-030-80865-5_8

26. Li, L., He, W., Xu, L., Ash, I., Anwar, M., Yuan, X.: Investigating the impact of cybersecurity policy awareness on employees' cybersecurity behavior. Int. J. Inf. Manage. **45**, 13–24 (2019). https://doi.org/10.1016/j.ijinfomgt.2018.10.017

27. Limayem, M., Khalifa, M., Chin, W.W.: Factors motivating software piracy: a longitudinal study. IEEE Trans. Eng. Manage. **51**(4), 414–425 (2004)

28. Ma, K.W.F., McKinnon, T.: COVID-19 and cyber fraud: emerging threats during the pandemic. J. Fin. Crime **29**(2), 433–446 (2022)

29. Minnaar, A., Herbig, F.J.: Cyberattacks and the cybercrime threat of ransomware to hospitals and healthcare services during the COVID-19 pandemic. Acta Criminologica: Afr. J. Criminol. Vict. **34**(3), 155–185 (2021)
30. Mokhtarian, P.L.: Defining telecommuting (1991)

31. Monteith, S., Bauer, M., Alda, M., Geddes, J., Whybrow, P.C., Glenn, T.: Increasing cybercrime since the pandemic: concerns for psychiatry. Curr. Psychiatry Rep. **23**, 1–9 (2021)

32. Moody, G.D., Siponen, M.: Using the theory of interpersonal behavior to explain non-work-related personal use of the internet at work. Inf. Manage. **50**(6), 322–335 (2013)

33. Naidoo, R.: A multi-level influence model of COVID-19 themed cybercrime. Eur. J. Inf. Syst. **29**(3), 306–321 (2020)

34. Pee, L.G., Woon, I.M., Kankanhalli, A.: Explaining non-work-related computing in the workplace: a comparison of alternative models. Inf. Manage. **45**(2), 120–130 (2008)

35. Podsakoff, P.M., MacKenzie, S.B., Podsakoff, N.P.: Sources of method bias in social science research and recommendations on how to control it. Annu. Rev. Psychol. **63**(1), 539–569 (2012). https://doi.org/10.1146/annurev-psych-120710-100452

36. Ringle, C.M., Wende, S., Becker, J.M., et al.: Smartpls 3 (2015)

37. Robinson, J.: Triandis’ theory of interpersonal behaviour in understanding software piracy behaviour in the South African context. Ph.D. thesis, University of the Witwatersrand Johannesburg (2010)

38. Rönkkö, M., Lee, N., Evermann, J., McIntosh, C., Antonakis, J.: Marketing or methodology? Exposing the fallacies of PLS with simple demonstrations. Eur. J. Mark. **57**(6), 1597–1617 (2023). https://doi.org/10.1108/EJM-02-2021-0099

39. Rönkkö, M., McIntosh, C.N., Antonakis, J., Edwards, J.R.: Partial least squares path modeling: time for some serious second thoughts. J. Oper. Manag. **47–48**(1), 9–27 (2016). https://doi.org/10.1016/j.jom.2016.05.002

40. Triandis, H.: Interpersonal Behavior. Brooks/Cole Publishing Company (1977). https://books.google.co.za/books?id=Sz63AAAAIAAJ

41. Urbach, N., Ahlemann, F.: Structural equation modeling in information systems research using partial least squares. J. Inf. Technol. Theory Appl. (JITTA) **11**(2), 2 (2010)

42. Woon, I.M., Pee, L.G.: Behavioral factors affecting internet abuse in the workplace-an empirical investigation. In: SIGHCI 2004 Proceedings, p. 5 (2004)

43. Wright, T., Ruhwanya, Z., Ophoff, J.: Measurement items - the influence of interpersonal factors on telecommuting employees’ cybercrime preventative behaviours (2023). https://doi.org/10.6084/m9.fishshare.23465885