Cybersecurity Risk Exposure and Civilian Financial Safety in Digital Payment Systems During Armed Conflict: Evidence from Sudan

2.1 Cybersecurity in digital payment systems

Digital payment technologies have transformed financial services by improving transaction speed, accessibility, and financial inclusion, particularly in developing and resource-constrained contexts [1, 8]. However, their rapid expansion has also increased cybersecurity risks, including phishing, malware, ransomware, denial-of-service attacks, identity theft, account compromise, and authentication vulnerabilities [1, 2]. Phishing remains a particularly serious threat because it exploits users’ trust to obtain sensitive financial and personal information [9].

Existing studies have proposed data mining, machine learning, deep learning, and decentralized fraud detection approaches to enhance fraud detection and strengthen platform security. However, most of this research remains system-centered and assumes stable infrastructure, reliable connectivity, and strong institutional support [1, 10-14]. As a result, there is limited understanding of user-centered cybersecurity risks in fragile and conflict-affected environments.

In humanitarian and armed conflict settings, civilians often depend on digital payment systems under unstable conditions, including infrastructure disruption, internet instability, displacement, and weak institutional protection. These conditions increase user vulnerability and reduce the effectiveness of conventional cybersecurity safeguards. Therefore, cybersecurity in digital payment systems should be understood not only as a technical issue but also as a socio-technical challenge shaped by technology, user behavior, and environmental instability.

2.2 Digital payments in conflict and humanitarian contexts

Digital payment systems have become important tools in humanitarian response because they enable faster assistance, lower transaction costs, improved transparency, and better access to financial support for vulnerable populations affected by displacement, poverty, and armed conflict [6, 15]. Prior studies show that digital cash assistance can improve aid delivery, household welfare, and food security during crises [6, 16].

In fragile and conflict-affected environments, digital payments become especially important when banking infrastructure, communication systems, and formal financial services are disrupted [17]. Evidence from Sudan shows that digital cash transfers can support vulnerable households and reduce food insecurity, while humanitarian reports indicate growing reliance on digital wallets and electronic financial tools among displaced and crisis-affected populations [7, 18]. Thus, digital payment systems function not only as FinTechbut also as mechanisms that support resilience and survival during humanitarian crises.

However, these systems depend on stable infrastructure, connectivity, identification mechanisms, regulation, and institutional support, all of which may be weakened during conflict [6, 19]. Such instability can increase exposure to cybercrime, fraud, misinformation, identity misuse, and unauthorized access, particularly among displaced populations with limited digital literacy and weak cybersecurity support [20, 21]. In Sudan, disruptions to banking systems, internet infrastructure, and public services since 2023 have increased reliance on digital payments, creating both humanitarian benefits and new forms of CRE [22, 23].

2.3 Financial technologies adoption, trust and security

FinTech has transformed financial services by introducing mobile payments, e-wallets, online banking, peer-to-peer payment systems, and other digital financial applications that enhance convenience, efficiency, cost reduction, and financial inclusion [3, 8]. In this context, trust, perceived security, privacy, and financial risk are key factors influencing users’ adoption and continued use of digital FinTech [3, 5, 24].

Previous studies show that users are more likely to adopt digital payment systems when they believe that these platforms protect personal information, ensure transaction integrity, and provide reliable security mechanisms, such as encryption, authentication, and privacy safeguards [3, 24, 25]. Trust also mediates the relationship between perceived usefulness (PU), ease of use, and technology adoption, while institutional and regulatory trust further influence FinTech acceptance [25, 26].

However, most FinTech adoption studies have been conducted in stable environments where users voluntarily evaluate benefits, risks, and trust before adoption [3, 24-26]. In conflict-affected settings, these assumptions may not fully apply because banking disruption and limited financial alternatives may force civilians to use digital payments despite low trust and high cybersecurity risk [20]. This creates a trust-behavior disconnect, where technology use continues due to necessity rather than confidence, highlighting the need to study FinTech adoption in humanitarian and armed conflict contexts.

2.4 Theoretical foundation

2.4.1 Technology Acceptance Model

The Technology Acceptance Model (TAM), developed by Davis [27], is one of the most widely used frameworks for explaining technology adoption behavior. TAM proposes that technology acceptance is primarily influenced by PU and perceived ease of use (PEOU), which shape users’ attitudes and behavioral intentions toward technology use. The model has been extensively applied in mobile banking, digital payment, and FinTech studies because of its strong ability to explain technology adoption behavior [25, 28]. Previous studies have found that trust, perceived security, and privacy significantly influence users’ willingness to adopt digital FinTech [3, 24, 25].

Later extensions of TAM incorporated additional factors, such as trust, perceived risk, and security perceptions, to better explain technology use decisions [29]. However, conventional TAM assumptions may be limited in conflict environments, where technology adoption is driven by necessity rather than voluntary choice. In contexts such as Sudan, disruptions to banking systems and financial infrastructure may force civilians to rely on digital technologies regardless of trust or usability considerations [22, 23]. Therefore, this study extends TAM by integrating Cybersecurity Awareness and Security Practices (CASP), APP, and PFS to explain digital payment behavior under conditions characterized by instability, cybersecurity threats, and constrained technological alternatives.

2.4.2 Protection Motivation Theory

Protection Motivation Theory (PMT), developed by Rogers [30], explains how individuals respond to perceived threats and adopt protective behaviors. The theory proposes that individuals evaluate risks through threat appraisal, including perceived severity and vulnerability, and coping appraisal, including response effectiveness and self-efficacy. Together, these appraisals influence adaptive protective actions. PMT has been widely applied in cybersecurity and information security research because it explains why individuals adopt security practices and protective behaviors [31, 32].

Previous studies indicate that greater threat perception and stronger coping capabilities increase individuals’ likelihood of adopting cybersecurity measures, such as privacy protection, secure practices, and risk mitigation behaviors [33, 34]. In digital environments, users increasingly face cybersecurity threats, including phishing, fraud, malware, misinformation, and identity-related risks [1, 2]. In conflict settings, these risks become more severe because of instability, weakened infrastructure, and greater dependence on digital technologies.

The proposed framework aligns with PMT by incorporating CTE as a threat-related dimension, while CASP and APP are treated as protective behavior dimensions. Perceived Cybersecurity TN is examined separately as an indicator of respondents’ perceived need for cybersecurity education, rather than as evidence of completed training or existing preparedness. Accordingly, greater threat exposure is expected to be positively associated with CRE, whereas stronger awareness and privacy protection practices are expected to be negatively associated with CRE. TN is examined as a non-directional correlate because higher perceived TN may reflect either greater vulnerability awareness or a proactive orientation toward cybersecurity support.

2.4.3 Socio-Technical Systems theory

Socio-Technical Systems (STS) theory explains that technological outcomes emerge through interactions between social and technical components rather than from technology alone [35]. The theory argues that system performance depends on the relationships among users, technologies, organizational structures, and environmental conditions. STS has been widely applied in information systems and cybersecurity research because it provides a broader understanding of how social, technical, and environmental dimensions jointly shape security outcomes in complex systems [36]. Recent cybersecurity studies emphasize that effective cyber resilience requires a balanced consideration of behavioral, technological, and contextual factors rather than a focus on technology alone.

This perspective is particularly relevant in conflict environments, where technological systems operate under unstable conditions characterized by infrastructure disruption, communication instability, institutional breakdown, and increased dependence on alternative digital services. Unlike traditional cybersecurity approaches that assume stable infrastructure, STS recognizes that cybersecurity outcomes are shaped by both human behavior and environmental conditions.

The proposed framework aligns with STS by integrating the social and technical dimensions that affect cybersecurity vulnerability. CASP and TN represent behavioral dimensions, APP reflects technical safeguards, and CTE captures environmental pressures and cyber risks. These factors collectively influence CRE, which subsequently affects PFS. STS also supports the study’s concept of a behavior-vulnerability gap, suggesting that strong protective behaviors alone may not sufficiently reduce cyber risks when broader socio-technical environments remain unstable.

2.5 Research gap

Existing studies have significantly contributed to understanding cybersecurity, digital payment adoption, fraud detection, trust, and financial technology behavior [1-5]. Similarly, recent humanitarian and conflict-related studies highlight the increasing role of digital technologies and payment systems in supporting vulnerable populations and maintaining financial access during crises [6, 7, 15, 16, 18, 21]. However, several limitations remain.

First, most cybersecurity and FinTech studies have been developed in stable environments that assume reliable infrastructure and institutional support [1, 3, 5]. These assumptions may not apply to conflict settings characterized by infrastructure instability and disrupted services. Second, previous studies often examine cybersecurity dimensions independently, such as awareness, trust, or protective behavior, which limits understanding of how these factors interact under humanitarian conditions [33-35]. Third, existing research frequently emphasizes technical solutions, including authentication systems and fraud detection models, while overlooking civilian-centered vulnerabilities and socio-technical conditions [10-14, 37]. Finally, limited empirical evidence exists regarding cybersecurity experiences among conflict-affected populations, particularly in Global South contexts such as Sudan [6, 7, 16].

To address these limitations, this study proposes a conflict-sensitive and civilian-centered framework that integrates CASP, CTE, APP, TN, CRE, and PFS. The study further introduces the concept of a behavior-vulnerability gap, suggesting that civilians may demonstrate strong protective behaviors while remaining exposed to substantial cyber risks under conflict conditions. Thus, this research extends the cybersecurity literature by providing empirical evidence from Sudan and offering a broader socio-technical understanding of cybersecurity vulnerability during armed conflict.

2.6 Conceptual framework and hypothesis development

The model proposes that CASP and APP are negatively associated with CRE, whereas CTE is positively associated with it. Perceived Cybersecurity TN is examined as a non-directional correlate of CRE because higher scores may reflect either greater vulnerability awareness or a proactive orientation toward cybersecurity support.

The hypotheses were developed based on the proposed conceptual framework and supported by PMT and STS. PMT explains how individuals respond to cyber threats through protective behaviors, whereas STS highlights the interaction among users, technology, and environmental conditions. In the context of the Sudan conflict, cybersecurity vulnerability is shaped by both digital risks and conflict-related instability. Therefore, the hypotheses examine how cybersecurity awareness, privacy protection, TN, and CTE influence CRE and PFS.

H1: CASP negatively influence CRE.

H2: CTE positively influences CRE.

H3: APP negatively influences CRE.

H4: Perceived Cybersecurity TN is significantly associated with CRE.

H5: CRE negatively influences PFS.

Collectively, these hypotheses establish the empirical structure of the proposed conceptual framework and explain how cybersecurity awareness, privacy behaviors, CTE, and perceived cybersecurity TN interact to influence cybersecurity vulnerability and financial safety among civilians during armed conflict. These relationships are illustrated in Figure 1 and are subsequently tested through statistical analysis.

1.png

Figure 1. Conflict-sensitive socio-technical framework for cybersecurity vulnerability and financial safety

4.1 Sample characteristics

4.1.1 Demographic profile of respondents

This study analyzed data from 173 valid respondents affected by the Sudan conflict. The demographic characteristics of the sample were summarized in terms of gender, age, and internet access, as these variables are important for understanding digital payment usage and cybersecurity exposure.

4.1.2 Gender distribution

The gender distribution of respondents is presented in Table 2. The results indicate that male participants constituted the majority of the sample (59.0%), while female respondents accounted for 41.0%.

This distribution suggests that males were more represented among digital financial service users in the conflict-affected sample, which may reflect existing gender disparities in access to technology and financial systems.

Table 2. Gender distribution

4.1.3 Age distribution

The age distribution of respondents is summarized in Table 3. The majority of participants were in the 26-35 age group (38.7%), followed by those aged 18-25 years (27.7%), while older age groups represented a smaller proportion of the sample.

This indicates that younger and middle-aged individuals were the primary users of digital payment systems in the study sample. These groups are generally more familiar with digital technologies, which may influence both their level of usage and their cybersecurity awareness.

Table 3. Age distribution

4.1.4 Internet access

Table 4 shows that internet access among respondents was largely unstable. More than half of the respondents reported unstable or intermittent access (51.4%), while only 31.2% had stable connectivity and 17.3% had very limited or no access. These results highlight serious infrastructure challenges during the conflict and support the view that internet instability affects both CRE and digital payment reliability.

Table 4. Internet access

4.1.5 Discussion of demographics

The demographic profile shows that digital payment usage during the Sudan conflict was mainly concentrated among younger and middle-aged respondents, who are generally more digitally active. It also suggests that gender differences may affect access to digital financial services and exposure to cybersecurity risks. In addition, unstable internet access highlights infrastructure instability as an important factor influencing digital payment reliability and security. Overall, age, gender, and internet access provide important context for understanding CRE and financial vulnerability under conflict conditions.

4.2 Reliability analysis

To evaluate the internal consistency and reliability of the measurement instrument, Cronbach’s Alpha analysis was conducted for all constructs included in the revised conceptual framework. The analysis assessed the extent to which items within each construct consistently measured the same underlying concept.

Table 5 shows that the revised measurement model demonstrated strong reliability. All constructs exceeded the recommended Cronbach’s Alpha threshold of 0.70, with values ranging from 0.887 to 0.926. APP recorded the highest reliability (α = 0.926), followed by CRE (α = 0.918), CASP (α = 0.914), and PFS (α = 0.903). Although CTE had the lowest value (α = 0.887), it still demonstrated good internal consistency. Overall, the full instrument achieved excellent reliability (α = 0.923), confirming its suitability for validity assessment and hypothesis testing.

Table 5. Cronbach’s Alpha reliability test per construct

4.3 Convergent validity results (Average Variance Extracted and Composite Reliability)

Table 6 confirms acceptable convergent validity for the measurement model. All constructs recorded CR values above 0.70 and AVE values above 0.50, meeting the recommended thresholds. APP showed the highest AVE (0.670), followed by CRE (0.661) and PFS (0.628), indicating that their indicators adequately represented the intended constructs. Overall, the results support the reliability and validity of the model for hypothesis testing and regression analysis.

Table 6. Convergent validity results (Average Variance Extracted (AVE) and Composite Reliability (CR))

4.4 Measurement model assessment

Table 7 presents the adequacy tests and exploratory factor analysis results for the measurement model. The KMO value of 0.910 indicates excellent sampling adequacy, while Bartlett’s test of sphericity was statistically significant (χ² = 3411.052, df = 351, p < 0.001), confirming that the correlation matrix was suitable for factor analysis. The exploratory factor analysis retained six factors corresponding to the six theoretical constructs and explained 76.84% of the total variance. These results provide additional support for the factorial validity of the measurement model.

Table 7. Kaiser-Meyer-Olkin (KMO), Bartlett’s test, EFA, and explained variance

Table 8 reports the rotated factor loadings for the 27 measurement items. The results show that all items loaded most strongly on their intended constructs, supporting the six-factor structure of the measurement model. The factor loadings ranged from 0.822 to 0.856 for CASP, 0.800 to 0.867 for CTE, 0.834 to 0.868 for APP, 0.845 to 0.865 for TN, 0.678 to 0.715 for CRE, and 0.718 to 0.794 for PFS. These results indicate acceptable item-level convergent validity and support the distinctiveness of the six constructs.

Table 8. Rotated factor loadings

Tables 9 and 10 present the discriminant validity results using the Fornell-Larcker criterion and HTMT ratios. The Fornell-Larcker results show that the square root of AVE for each construct was greater than its correlations with other constructs, supporting discriminant validity. In addition, all HTMT values were below the conservative threshold of 0.85, with the highest value observed between CRE and PFS (HTMT = 0.739). These results indicate that the six constructs are empirically distinct and that the measurement model demonstrates acceptable discriminant validity.

Table 9. Fornell-Larcker criterion

Table 10. HTMT ratios

4.5 Common method bias assessment

Because all variables were collected from the same questionnaire at a single point in time, common method bias was assessed using Harman’s single-factor test. The unrotated factor solution showed that the first factor explained 34.34% of the total variance, which is below the commonly used 50% threshold. This suggests that common method bias was unlikely to dominate the results. In addition, procedural measures were used to reduce response bias, including voluntary participation, anonymous responses, informed consent, and the non-collection of personally identifiable information. Nevertheless, because the study relied on self-reported, same-source, cross-sectional survey data, common method variance cannot be completely ruled out and is acknowledged as a limitation.

4.6 Descriptive statistics per construct

To provide an overview of respondents’ perceptions of the major constructs included in the revised conceptual framework, descriptive statistical analysis was conducted. The analysis included calculating mean values and standard deviations for all study constructs. Mean values were used to indicate the overall level of agreement, while standard deviations measured variability in participants’ responses.

Table 11 shows that respondents reported high levels of APP (M = 4.05), CRE (M = 4.02), CASP (M = 3.88), and CTE (M = 3.84). This indicates that civilians adopted protective behaviors while still experiencing substantial cybersecurity risks during the Sudan conflict. TN showed a moderate-to-high mean score (M = 3.49), reflecting continued demand for cybersecurity education. In contrast, PFS recorded the lowest mean score (M = 2.74), suggesting weak confidence in digital financial security. Overall, the findings support the behavior–vulnerability gap, where strong cybersecurity awareness and protective practices coexist with high cyber risk exposure and reduced financial safety.

Table 11. Descriptive statistics per construct

4.7 Descriptive and response pattern analysis

To provide supportive descriptive evidence, one-sample t-tests and Chi-square tests were conducted. These tests were not used to test the hypothesized relationships among constructs. Instead, they were used to examine whether construct-level responses differed from neutral benchmark values and whether response distributions showed systematic patterns rather than random variation.

4.7.1 One-sample t-test results

To determine whether respondents’ perceptions significantly differed from a neutral benchmark, a one-sample t-test was conducted for all constructs included in the revised conceptual framework. Following common practice in Likert-scale studies, the midpoint value of 3 was used as the test value, representing a moderate or neutral perception level. Because construct scores were aggregated from multiple items, the benchmark values were adjusted according to the number of items in each construct.

The test examined whether respondents’ observed mean values significantly differed from the expected moderate levels.

Table 12 shows that all constructs differed significantly from their neutral benchmark values. CASP, APP, CTE, CRE, and TN all showed significant positive differences, indicating strong awareness, protective behavior, threat exposure, perceived vulnerability, and a continued need for cybersecurity education. In contrast, PFS showed a significant negative difference, reflecting low confidence in digital financial security during the Sudan conflict. Overall, the t-test results support the proposed framework and confirm the behavior-vulnerability gap, where strong protective practices coexist with high cyber risk exposure and reduced financial confidence.

Table 12. One-sample t-test results

4.7.2 Chi-square (χ²) results

To further examine response distributions across the questionnaire constructs, a Chi-square (χ²) goodness-of-fit test was conducted. The purpose of this analysis was to determine whether respondents’ answers differed significantly from an equal or random response distribution. Significant Chi-square values indicate that participants demonstrated meaningful response patterns rather than random selection behavior.

Table 13 shows that all Chi-square results were statistically significant (p < 0.001), indicating that respondents’ answers reflected meaningful and systematic perceptions rather than random patterns. APP recorded the highest Chi-square value, showing strong agreement regarding the use of privacy and device protection practices. CASP also showed strong agreement, indicating active awareness and safe digital behavior among civilians. CRE and CTE confirmed consistent experiences of vulnerability, phishing, fraud, misinformation, and cyber-enabled threats. Although TN and PFS recorded lower values, both remained statistically significant. Overall, these results provide descriptive support for the observed response patterns but do not directly test the hypothesized relationships among constructs.

Table 13. Chi-square (χ²) results per construct

4.8 Regression-based hypothesis testing

To further examine the predictive relationships proposed in the conceptual framework, two regression models were developed. Consistent with the revised theoretical structure, CRE was treated as an intermediate dependent construct influenced by cybersecurity awareness, threat exposure, privacy protection practices, and perceived cybersecurity TN. Subsequently, PFS was modeled as an outcome variable influenced by CRE.

4.8.1 Predictors of Cybersecurity Risk Exposure

The first regression model examined the effects of CASP, CTE, APP, and TN on CRE. The regression coefficients for Model 1 are presented in Table 14, while the corresponding model fit statistics are reported in Table 15.

Table 14. Multiple regression results (model 1)

Table 15. Model fit statistics for model 1

The results show that the model was statistically significant and explained 61.0% of the variance in CRE, indicating strong explanatory power. CTE was the strongest positive predictor, suggesting that higher self-reported exposure to phishing, fraud, malware, and other cyber-enabled threats was associated with greater perceived cybersecurity vulnerability.

CASP and APP were significantly and negatively associated with CRE, indicating that stronger cybersecurity awareness and privacy protection practices were linked to lower perceived cybersecurity risk exposure. TN was also significantly and negatively associated with CRE (β = −0.244, p = 0.001). This inverse relationship may indicate that respondents who recognized a greater need for training were also more risk-aware or more receptive to protective support. However, because TN measures perceived training need rather than completed training, this finding should not be interpreted as evidence that training needs causally reduce vulnerability.

4.8.2 Effect of Cybersecurity Risk Exposure on Perceived Financial Safety

The second regression model examined the effect of CRE on PFS.

The second regression model examined the effect of CRE on PFS, as shown in Table 16. The model was statistically significant (F = 73.561, p < 0.001) and explained 44.6% of the variance in PFS (R² = 0.446), as reported in Table 17.

Table 16. Simple regression results (model 2)

Table 17. Model fit statistics for model 2

CRE was significantly and negatively associated with PFS (β = −0.446, p < 0.001), indicating that increased vulnerability to cyber threats substantially reduced respondents’ confidence in digital financial environments.

This finding suggests that perceived exposure to cyber risks is associated with lower trust, weaker security perceptions, and reduced financial confidence under conflict conditions.

The regression analyses were used to evaluate the proposed hypotheses, as summarized in Table 18. The findings indicate that all hypothesized relationships were statistically supported. CASP and APP were negatively associated with CRE, while CTE was positively associated with CRE. TN also showed a significant association with CRE, and CRE was negatively associated with PFS.

Table 18. Hypothesis-testing summary

This study has several limitations that should be considered when interpreting the findings. First, the study employed a purposive and snowball sampling approach, which may limit the generalizability of the findings beyond the conflict-affected populations included in this research. Second, the study focused exclusively on the Sudan conflict context; therefore, the findings may reflect country-specific social, technological, and institutional conditions. Third, the cross-sectional design captured perceptions at a single point in time and may not reflect changes in cybersecurity experiences across different stages of conflict.

Fourth, the study relies on self-reported perceptions rather than objective cybersecurity records. The survey did not collect verified evidence of actual fraud incidents, financial losses, account compromise, platform security breaches, transaction failures, or digital payment system logs. Therefore, the findings should be interpreted as evidence of perceived CRE and PFS, rather than as direct evidence of actual cybersecurity incidents or technical platform performance. Future research should combine survey data with objective indicators, such as verified fraud reports, transaction failure records, platform incident data, or institutional cybersecurity logs.

Fifth, because all variables were collected from the same respondents using the same questionnaire at a single point in time, the findings may be affected by common method variance. Although Harman’s single-factor test suggested that common method bias was not severe, future research should use multiple data sources, temporal separation, objective incident records, or longitudinal designs to reduce this risk.

Future research may extend this work by conducting comparative studies across multiple conflict-affected regions, employing longitudinal approaches to examine changes in cybersecurity experiences over time, and validating the proposed framework using larger samples and advanced analytical techniques, such as Structural Equation Modeling (SEM). Future studies may also examine additional factors influencing digital resilience, including institutional trust, infrastructure resilience, and humanitarian technology interventions.

This study investigated cybersecurity risks associated with digital payment usage among civilians during the Sudan conflict. It examined the effects of CASP, CTE APP, and TN on CRE and PFS.

Regression analysis showed that APP and CASP were significantly and negatively associated with CRE, whereas CTE was significantly and positively associated with it. TN also demonstrated a significant negative association with CRE; however, this finding should not be interpreted as evidence that perceived TN causally reduce vulnerability.

The study contributes theoretically by integrating TAM, PMT, and STS within a conflict-sensitive framework and introducing the concept of a behavior-vulnerability gap, in which civilians exhibit strong protective behaviors but remain highly vulnerable because of conflict-related environmental instability. The findings emphasize that cybersecurity in conflict settings should be understood as a broader socio-technical issue requiring civilian-centered resilience strategies.