How social engineers use persuasion principles during vishing attacks

Abstract

Purpose This study aims to examine how social engineers use persuasion principles during vishing attacks. Design/methodology/approach In total, 86 examples of real-world vishing attacks were found in articles and videos. Each example was coded to determine which persuasion principles were present in that attack and how they were implemented, i.e. what specific elements of the attack contributed to the presence of each persuasion principle. Findings Authority (A), social proof (S) and distraction (D) were the most widely used persuasion principles in vishing attacks, followed by liking, similarity and deception (L). These four persuasion principles occurred in a majority of vishing attacks, while commitment, reciprocation and consistency (C) did not. Further, certain sets of persuasion principles (i.e. authority, distraction, liking, similarity, and deception and social proof; , authority, commitment, reciprocation, and consistency, distraction, liking, similarity and deception, and social proof; and authority, distraction and social proof) were used more than others. It was noteworthy that despite their similarities, those sets of persuasion principles were implemented in different ways, and certain specific ways of implementing certain persuasion principles (e.g. vishers claiming to have authority over the victim) were quite rare. Originality/value To the best of authors’ knowledge, this study is the first to investigate how social engineers use persuasion principles during vishing attacks. As such, it provides important insight into how social engineers implement vishing attacks and lays a critical foundation for future research investigating the psychological aspects of vishing attacks. The present results have important implications for vishing countermeasures and education.

Detecting deception in computer-mediated communication: the role of popularity information across media types

“…The prevalence of deception, social engineering and other forms of deceptive communication online shows no signs of abating anytime soon (Das et al , 2022; Jones et al , 2021; Van der Walt and Eloff, 2019; Xu and Rajivan, 2023). To reduce the damage that ensues after an individual is victimized, training Internet users to detect and disregard deceptive communication seems to be the only practical solution, at least until automated means of filtering deception are implemented and made widely available (Twitchell and Fuller, 2019; Twyman et al , 2015).…”

The COVID‐19 scamdemic: A survey of phishing attacks and their countermeasures during COVID‐19

“…An orthogonal approach to building an ad-hoc dataset involves the use of well-known existing datasets. For instance, the datasets originally used in [83,85] were also used to train and evaluate the systems recently proposed in [82,84]. Similarly, other scholars used data published in well-known scientific repositories such as Mendeley, Kaggle and the UCI collection of machine learning datasets.…”

How to respond to emerging threats of cyberspace security via social engineering? A novel paradigm to solve cyberspace security issues

“…Approximately, Jonathan [74] believes that the successful implementation of SE attacks stems from the application of psychological and discusses social psychology in SE attacks. Keith et al [75] further analyzed 86 instances of phishing attacks and social psychology in the attacks [74,76]. They defined five "deception guidelines" which can guide SE hackers to deceive users, as shown in Table 3.…”