Research Note—Influence Techniques in Phishing Attacks: An Examination of Vulnerability and Resistance

Abstract

Phishing is a major threat to individuals and organizations. Along with billions of dollars lost annually, phishing attacks have led to significant data breaches, loss of corporate secrets, and espionage. Despite the significant threat, potential phishing targets have little theoretical or practical guidance on which phishing tactics are most dangerous and require heightened caution. The current study extends persuasion and motivation theory to postulate why certain influence techniques are especially dangerous when used in phishing attacks. We evaluated our hypotheses using a large field experiment that involved sending phishing messages to more than 2,600 participants. Results indicated a disparity in levels of danger presented by different influence techniques used in phishing attacks. Specifically, participants were less vulnerable to phishing influence techniques that relied on fictitious prior shared experience and were more vulnerable to techniques offering a high level of self-determination. By extending persuasion and motivation theory to explain the relative efficacy of phishers' influence techniques, this work clarifies significant vulnerabilities and lays the foundation for individuals and organizations to combat phishing through awareness and training efforts.

The dark side of social networking sites:Understanding phishing risks

“…However, research did not come to any strong conclusions about which techniques are the most effective (Sundie, Cialdini, Griskevicius, & Kenrick, 2012). In that context, it seems that each technique's effectiveness is result of the context and the way in which it is employed (Ryan T Wright et al, 2014). Consequently, we have little insight into which technique will be the most effective in a phishing context where we have no clarity on the message source (Ryan T Wright et al, 2014).…”

“…Some influence techniques were found to be more effective than others. Specifically, phishing influence techniques that relied on fictitious prior shared experience were found to be less effective than techniques offering a high level of selfdetermination (Ryan T Wright, Jensen, Thatcher, Dinger, & Marett, 2014). Overall, influence techniques, supported by persuasion and motivation theories, can be split into six different categories: liking, reciprocity, social proof, consistency, authority, and scarcity (Cialdini & James, 2009).…”

“…In that context, it seems that each technique's effectiveness is result of the context and the way in which it is employed (Ryan T Wright et al, 2014). Consequently, we have little insight into which technique will be the most effective in a phishing context where we have no clarity on the message source (Ryan T Wright et al, 2014). This is particularly true in the SNSs context, where employees generally think that they can easily identify and avoid phishing attacks.…”

Can Trust be Trusted in Cybersecurity?

“…Recently, ISec research has turned to collective intelligence via knowledge management systems to leverage the human element by creating human firewalls in identifying malicious email [20]. Leveraging humans and engaging them as an effective countermeasure has proven elusive since it requires them to pay attention to information security warnings, phishing emails, information security training, and notifications [21,36,45,48,49].…”

You’ve got mail! Explaining individual differences in becoming a phishing target

“…When phishers succeed in convincing the receivers that the mail is authentic, the next step is to persuade the recipient that sharing personal information is required. Here, social engineering strategies that have proven to be effective are 'liking' (i.e., pretending to be a person, organization or company the recipient likes and trusts) (Jagatic et al, 2007;Wright et al, 2014), 'reciprocity' (i.e., giving people the impression they have to return a favor), 'social proof' (i.e., claiming other people have shared their personal details as well), 'scarcity' (i.e., giving the impression that an opportunity is limited) (Wright et al, 2014) and 'authority' (i.e., pretending to be an authority figure) (Butavicius et al, 2015).…”