Empirical analysis of weapons of influence, life domains, and demographic-targeting in modern spam: an age-comparative perspective

Abstract

Spam has been increasingly used for malware distribution. This paper analyzed modern spam from an age-comparative perspective to (i) discover the extent to which psychological weapons of influence and life domains were represented in today’s spam emails and (ii) clarify variations in the use of these weapons and life domains by user demographics. Thirty five young and 32 older participants forwarded 18,605 emails from their spam folder to our study email account. A random set of 961 emails were submitted to qualitative content coding and quantitative statistical analysis. Reciprocation was the most prevalent weapon; financial, leisure, and independence the most prevalent life domains. Older adults received health and independence-related spam emails more frequently, while young adults received leisure and occupation-related spam emails more often. These age differences show a level of targeting by user demographics in current spam campaigns. This targeting shows the need for age-tailored demographic warnings highlighting the presence of influence and pretexting (life domains) for suspicious emails for improved response to cyber-attacks that could result from spam distribution. The insights from this study and the produced labeled dataset of spam messages can inform the development of the next generation of such solutions, especially those based on machine learning.

Susceptibility to Spear-Phishing Emails

“…In particular, frequent experiences with financial scams in everyday life may have transferred knowledge into the study and could be underlying "resilience" to these types of attacks. Consistent with this speculation, in our independent study of naturally received spam emails by young and older Internet users, financial spam emails were most prevalent while legal spam emails were least prevalent (Oliveira et al 2019).…”

“…This could explain the low effectiveness of health-related emails in our study. Supporting this possibility, in an independent study we showed that older compared to young Internet users were more likely to receive spam emails referring to health in their everyday lives (Oliveira et al 2019).…”

“…Also, the small number of simulated phishing emails used in previous studies (i.e., one email per study; Halevi et al 2015;Jagatic et al 2007;Mohebzada et al 2012) did not allow analysis of varying email content on susceptibility. Our study comprised multiple simulated phishing emails with varying content, created based on a large set of authentic spam emails from an independent sample of young and older Internet users (Oliveira et al 2019). This approach allowed systematic manipulation of some variables (weapons of influence and life domains in the present study) and their consideration in the statistical analysis.…”

“…For the development of our simulated phishing emails, we referred to a large set of real-life spam emails that we had collected in a pilot study from an independent sample of young and older Internet users (Oliveira et al 2019). None of the original emails from this independent study were used in the present study.…”

The Role of Cue Utilization and Cognitive Load in the Recognition of Phishing Emails

“…This included informing the participants about the research aims prior to their participation and conducting the experiment in a laboratory setting. These factors have been shown to naturally arouse suspicion levels and induce System 2 (i.e., analytical) cognitive processing (Caputo et al, 2014 ; Oliveira et al, 2019 ). Moreover, participants had no time constraints when completing the phishing detection task.…”