Phishing for the Truth: A Scenario-Based Experiment of Users’ Behavioural Response to Emails

Abstract

Using a role play scenario experiment, 117 participants were asked to manage 50 emails. To test whether the knowledge that participants are undertaking a phishing study impacts on their decisions, only half of the participants were informed that the study was assessing the ability to identify phishing emails. Results indicated that the participants who were informed that they were undertaking a phishing study were significantly better at correctly managing phishing emails and took longer to make decisions. This was not caused by a bias towards judging an email as a phishing attack, but instead, an increase in the ability to discriminate between phishing and real emails. Interestingly, participants who had formal training in information systems performed more poorly overall. Our results have implications for the interpretation of previous phishing studies, the design of future studies and for training and education campaigns, as it suggests that when people are primed about phishing risks, they adopt a more diligent screening approach to emails.

Social engineering attacks on the knowledge worker

“…Obviously, social engineering attacks that are started from internal accounts or emails with forged internal addresses are more likely to slip through the screening of a potential victim. For instance, Parsons et al [31] conduced a role play scenario experiment where 117 participants were tested about their ability to judge about phishing emails and real emails. Their results indicates that people with a higher awareness level identify significantly more phishing emails.…”

A Phish Scale: Rating Human Phishing Message Detection Difficulty

“…For each cue, the associated references and the criteria we used for counting are also provided. [2], [3], [8], [12], [13], [19], [20], [21], [31], [38], [40], [43] Does the message contain spelling or grammar errors, including mismatched plurality?…”

“…Formatting and design elements that do not appear to have been professionally generated [7], [11], [19], [21], [31], [37] Does the design and formatting violate any conventional professional practices?…”

“…Generic greeting A generic greeting and an overall lack of personalization in the email [1], [3], [8], [9], [21], [31], [37] Does the message lack a greeting or lack personalization in the message?…”

“…Contest winnings or other unlikely monetary and/or material offerings [13], [21], [31], [43] Does the message offer anything that is too good to be true, such having won a contest, lottery, free vacation and so on?…”