Assessing the information quality of phishing-related content on financial institutions’ websites

Abstract

Purpose Phishing attacks exploit social vulnerabilities and remain a global concern. Financial institutions often use their websites as part of their online awareness and education efforts. This paper aims to explore the effectiveness of phishing-related information made available by financial institutions to raise awareness and educate customers. Design/methodology/approach In this mixed methods research, a survey of online consumers was first performed and analysed. Second, the information available on the websites of major financial institutions was analysed. Using the construct of information quality (IQ), content analysis was performed to determine whether the phishing-related information meets the IQ criteria. Findings The survey confirmed that consumers are indeed targeted by phishers. It established that they turn to their financial institutions, more often than any other source, for anti-phishing information. When analysing the IQ of phishing-related information, significant deficiencies as well as different levels of performance between the financial institutions, emerged. In general, the worst performing IQ criteria was information being current and fit for purpose. Research limitations/implications As the research is conducted within South Africa, the results cannot be generalised. The ethical clearance did not allow for identification of the different financial institutions and thus comparing consumers’ perceptions with the observed IQ from the content analysis to determine correlation. Practical implications Protecting consumers against phishing attacks remains critical, and this paper confirms that users turn to their financial institutions for information. Yet, the phishing-related information made available on the websites of financial institutions has severe deficiencies. Practitioners should use IQ to determine the appropriateness of phishing-related information and focus on improving customer awareness and education. Originality/value Researchers often highlight the importance of awareness and education programmes in protecting consumers, but rarely investigate if consumers access publicly available information and express an opinion on the quality of this information. Although the results should not generalised, the recommendations, if necessary through similar analysis, has an impact beyond the geographical constraints of the study.

Role of Awareness to Prevent Personal Disasters: Reducing the Risks of Falling for Phishing by Strengthening User Awareness

“…Awareness can be considered as the first step towards a sustainable protection from phishing fraud since it helps to make the users aware of the risk and realize exposure to this threat [17]. Financial institutions and their customers are regular targets of phishing campaigns as the information shared on the homepages of selected Austrian financial institutions demonstrate.…”

“…Butler and Butler [17] underline the importance of websites as a source of security awareness effort for financial institutions. The quality of phishing related information plays therefore an important role and can significantly contribute to help users identify phishing attacks and avoid from falling into them.…”

“…However, there is also reference to online users not knowing where to find the related information or users actively seeking for such information. There is also reference to users not reading related information even when receiving clear recommendation on respective information sections [17].…”

“…Measurable, consistent and continuous awareness programs will contribute to minimizing this percentage [12]. 6 LIMITATIONS Within this paper, the whole industry of phishing and spamming, that from the literature chosen, can be considered as a significant malicious business domain [17] couldn't be further investigated in.…”

Analysis of publicly available anti-phishing webpages: contradicting information, lack of concrete advice and very narrow attack vector

“…Regarding research focusing on anti-phishing recommendations, Butler and Butler [9] focused on effectiveness of anti-phishing related information allocated by financial institutes, including banks. They used the construct of information quality (IQ) to rate the effectiveness.…”