Behavioural Threats To SME Webshops Under EU Law

Abstract

Underground identity markets occupy one end of the cybercrime supply chain. At the other end, in sectors far removed from dark web forums, small webshop operators face a structurally related problem: customers who exploit contractual constructs, liberal return policies, and EU consumer law to systematically extract value without breaking any laws. This paper looks at that threat and argues that it follows the same economic logic as technical cybercrime. Drawing on Routine Activity Theory and Situation Awareness Theory, it develops a seven-type taxonomy of behavioural threats to EU-based SME webshops, constructs a cost impact model calibrated to micro-business scale, and maps the legal and operational countermeasures available under Directive 2011/83/EU and evolving ECJ jurisprudence. Behavioural threats work differently from technical threats, need a different analytical framework, and hardly appear in the research and guidance that European SME operators rely on today. A small number of abusive customers, often as few as two to five per hundred, can eliminate the net margin of an entire customer segment. Cheap improvements in guardianship reduce this exposure considerably.