Dissecting Spear Phishing Emails for Older vs Young Adults

Abstract

Spear phishing emails are key in many cyber attacks. Successful emails employ psychological weapons of influence and relevant life domains. This paper investigates spear phishing susceptibility as a function of Internet user age (old vs young), weapon of influence, and life domain. A 21day study was conducted with 158 participants (younger and older Internet users). Data collection took place at the participants' homes to increase ecological validity. Our results show that older women were the most vulnerable group to phishing attacks. While younger adults were most susceptible to scarcity, older adults were most susceptible to reciprocation. Further, there was a discrepancy, particularly among older users, between self-reported susceptibility awareness and their behavior during the intervention. Our results show the need for demographic personalization for warnings, training and educational tools in targeting the specifics of the older adult population 1 .

Evaluating the cognitive mechanisms of phishing detection with PEST, an ecologically valid lab-based measure of phishing susceptibility

“…The real phishing emails were selected such that they spanned a range of effectiveness, from obvious phishing to more convincing attacks (based on subjective judgments of two of the authors, ZMH and KL). Simulated phishing emails were taken from the eighty four emails used in the PHishing Internet Task (PHIT) (Lin et al, 2019;Oliveira et al, 2017), see below for details.…”

“…Phishing efficacy of the 84 simulated phishing emails had previously been assessed in a field experiment by our group (Lin et al, 2019;Oliveira et al, 2017). In this Phishing Internet Task (PHIT), 158 participants were sent emails to the email address they had registered with the study, and a browser plug in recorded whether participants clicked on the link embedded in each email.…”

“…Indeed there are even websites (such as ("Test and Optimize your Emails for the Inbox," n.d.)) where attackers can test whether a particular email will be flagged or not by several leading email providers. Thus, human decision-making is the last line of defense against phishing and there is much interest in understanding the cognitive and neural processes underlying phishing detection in order to identify those individuals who are most susceptible (Ebner et al, 2018;Lin et al, 2019;Oliveira et al, 2017) as well as to evaluate the outcome of training programs designed to reduce phishing victimization (Norris, Brookes, & Dowell, 2019).…”

“…Perhaps the Gold Standard for measuring an individual's susceptibility to phishing deception is to actually try to phish them in the home or office setting -that is, to send them a phishing email and measure whether they engage with it or not (Caputo, Pfleeger, Freeman, & Eric Johnson, 2014;Kumaraguru et al, 2009;Luo, Zhang, Burd, & Seazzu, 2013;Oliveira et al, 2017;Vishwanath, 2015;Williams et al, 2018). This direct approach has high ecological validity because the only difference from a real phishing attack is that the participants are not harmed.…”

“…Using a new task, the Phishing Email Suspicion Test (PEST), we asked participants to rate the degree to which a series of 160 emails appeared suspicious. By design, 84 of these emails had been previously used in a field-experimental phishing study using an independent sample of participants (Oliveira et al, 2017). This allowed us to determine whether emails that were effective in real life (i.e., people had fallen for them in the field experiment), were also effective in the lab (i.e., were rated as less suspicious in PEST).…”