Cybercrime is a phenomenon which has seen an expansive development over the last few
years. As a result, phishing has become a crime in Denmark which demands more and more
attention from both state and private actors. It is a complicated crime to both investigate
and prevent, as phishers are sending thousands of phishing mails within a very short time
span. This thesis examines phishing as a phenomenon and the practices around preventing
and combating it in Denmark. Through interviews with several experts both from the
police and the private sector we have collected extensive information, which is analyzed
with Bruno Latour’s actor-network theory in order to map the different actors which
interact in the network, and through this process uncover the challenges that appear when
combating phishing. This thesis uncovers several challenges.

1. Challenges related to police investigation and difficulties in the Danish legislation
which is formulated based on the physical world and used on a digital phenomenon.
Furthermore, international investigations are time consuming and cooperation
with international actors can be difficult.
2. Challenges related to different procedures for reports regarding phishing. The
police receive few phishing reports from citizens, and as a result the extent of
phishing in Denmark is unknown due to the dark figure of phishing attacks.
3. Challenges related to the nature of cybercrime. Phishers are collaborating and
trading information on the dark web. They mostly remain anonymous and use
money mules to avoid detection. The difference in the spatial and temporal
dimension of the internet compared to the physical world makes it difficult to
investigate cybercrime and track down the offender’s location.

This thesis also discusses challenges in criminological theory when analyzing cybercrimes
like phishing. In applying Michel Callon’s translation process on phishing it is uncovered
that manipulation plays a significant part in a successful phishing attack. This thesis
concludes that more extensive research on phishing in a Danish context is required, as
knowledge on the subject is inadequate.