COVID-19 and Phishing: Effects of Human Emotions, Behavior, and Demographics on the Success of Phishing Attempts During the Pandemic

Abstract

Phishing is an online scam where criminals trick users with various strategies, with the goal of obtaining sensitive information or compromising accounts, systems, and/or other personal or organisational Information Technology resources. Multiple studies have shown that human factors influence the success of phishing attempts. However, these studies were conducted before the COVID-19 pandemic, which is significant because security reports show that the numbers of phishing attacks have been rapidly increasing since the start of COVID-19. This study investigates the extent to which users' fear, anxiety and stress levels regarding COVID-19, impact falling for common and COVID-19 themed phishing scams during the outbreak period. Prior studies have depicted the effects of human behaviour on phishing attacks before the pandemic, such as risk-taking preferences and users' demographic factors, hence this study also focuses on the effects of those factors on the likelihood of phishing victimisation. More concretely, we present the results of a scenario-based roleplay experiment to study the relationship between fear, anxiety, stress, risk-taking, and demographic factors and the success of phishing attacks during the pandemic. The findings indicate that fear of COVID-19 influences the success of COVID-19 specific themed phishing scams, while anxiety, stress, and risk-taking influences the success of both the COVID-19 themed and common phishing scams. Our findings also suggest that the users' education level impacts common phishing attacks during the pandemic.

Uma breve análise sobre phishing

“…Com tudo isso, invasores cibernéticos aproveitaram para tirar vantagens de possíveis vítimas ao usar informac ¸ões e palavras chaves relacionadas ao COVID-19, para realizar ataques de phishing [Abroshan et al 2021].…”

“…Após mais de 25 anos na sociedade, tendo surgido em 1995 [James 2006], o número de ataques de phishing alcanc ¸aram mais de 300 mil ataques em dezembro de 2021 [APWG 2021]. Esses ataques exploraram, entre outros cenários, o de pandemia de COVID-19 [Abroshan et al 2021], período no qual os indivíduos ficaram mais dependentes de servic ¸os online, como aplicativos de mensagens e de mídias sociais, aumentando o número de técnicas de abordagem para se usar no ataque.…”

Promoting Cybersecurity Awareness Utilizing a “Build Your Own Adventure” Serious Game

“…Phishing : This is a method or using various strategies to trick a user into disclosing sensitive information, compromising online accounts, compromising computer systems, and/or other personal or organizational information technology resources (Abroshan et al, 2021). These are mainly executed using emails to catch users that are not fully aware of the danger.…”

A Systematic Literature Review on Phishing Email Detection Using Natural Language Processing Techniques

“…Since the outbreak of coronavirus in 2019 (COVID-19), the issue of phishing attacks has become a subject of major interest. During the period from September 2020 till now, a number of studies have been initiated to investigate phishing attacks with respect to COVID-19 [3]- [5]. Phishers usually hunt their potential victims by using text and information related to the COVID-19 pandemic [1].…”

“…FIGURE5 An example of the structure of e-mail messages (suggested f or purposes related to f eature extraction and selection (adapted f rom[43]). …”