Susceptibility to Spear-Phishing Emails

Abstract

Phishing is fundamental to cyber attacks. This research determined the effect of Internet user age and email content such as weapons of influence (persuasive techniques that attackers can use to lure individuals to fall for an attack) and life domains (a specific topic or aspect of an individual's life that attackers can focus an email on) on spear-phishing (targeted phishing) susceptibility. In total, 100 young and 58 older users received, without their knowledge, daily simulated phishing emails over 21 days. A browser plugin recorded their clicking on links in the emails as an indicator of their susceptibility. Forty-three percent of users fell for the simulated phishing emails, with older women showing the highest susceptibility. While susceptibility in young users declined across the study, susceptibility in older users remained stable. The relative effectiveness of the attacks differed by weapons of influence and life domains with age-group variability. In addition, older compared to young users reported lower susceptibility awareness. These findings support effects of Internet user demographics and email content on susceptibility to phishing and emphasize the need for personalization of the next generation of security solutions. CCS Concepts: • Security and privacy → Phishing; Social aspects of security and privacy; • Humancentered computing → Empirical studies in HCI; • Social and professional topics → Seniors;

Evaluating the cognitive mechanisms of phishing detection with PEST, an ecologically valid lab-based measure of phishing susceptibility

“…The real phishing emails were selected such that they spanned a range of effectiveness, from obvious phishing to more convincing attacks (based on subjective judgments of two of the authors, ZMH and KL). Simulated phishing emails were taken from the eighty four emails used in the PHishing Internet Task (PHIT) (Lin et al, 2019;Oliveira et al, 2017), see below for details.…”

“…Phishing efficacy of the 84 simulated phishing emails had previously been assessed in a field experiment by our group (Lin et al, 2019;Oliveira et al, 2017). In this Phishing Internet Task (PHIT), 158 participants were sent emails to the email address they had registered with the study, and a browser plug in recorded whether participants clicked on the link embedded in each email.…”

“…In particular, each participant received 21 emails each during the course of 21 days (one per day). Emails had been created based on a large set of authentic spam emails from an independent sample of Internet users (Oliveira et al, 2019). On average each email was sent to just under 40 participants (range 37-42).…”

“…As a test of the ecological validity of our newly developed PEST, we compared the average suspicion score of each email on PEST to the efficacy of the email as previously assessed in the original PHIT field experimental (Lin et al, 2019;Oliveira et al, 2017). By design, 84 emails (the simulated phishing emails) for which we had real-world measures of efficacy were included in PEST.…”

“…Indeed there are even websites (such as ("Test and Optimize your Emails for the Inbox," n.d.)) where attackers can test whether a particular email will be flagged or not by several leading email providers. Thus, human decision-making is the last line of defense against phishing and there is much interest in understanding the cognitive and neural processes underlying phishing detection in order to identify those individuals who are most susceptible (Ebner et al, 2018;Lin et al, 2019;Oliveira et al, 2017) as well as to evaluate the outcome of training programs designed to reduce phishing victimization (Norris, Brookes, & Dowell, 2019).…”