The Role of Cue Utilization and Cognitive Load in the Recognition of Phishing Emails

Abstract

Phishing emails represent a major threat to online information security. While the prevailing research is focused on users' susceptibility, few studies have considered the decision-making strategies that account for skilled detection. One relevant facet of decision-making is cue utilization, where users retrieve feature-event associations stored in long-term memory. High degrees of cue utilization help reduce the demands placed on working memory (i.e., cognitive load), and invariably improve decision performance (i.e., the information-reduction hypothesis in expert performance). The current study explored the effect of cue utilization and cognitive load when detecting phishing emails. A total of 50 undergraduate students completed: (1) a rail control task; (2) a phishing detection task; and (3) a survey of the cues used in detection. A cue utilization assessment battery (EXPERTise 2.0) then classified participants with either higher or lower cue utilization. As expected, higher cue utilization was associated with a greater likelihood of detecting phishing emails. However, variation in cognitive load had no effect on phishing detection, nor was there an interaction between cue utilization and cognitive load. Further, the findings revealed no significant difference in the types of cues used across cue utilization groups or performance levels. These findings have implications for our understanding of cognitive mechanisms that underpin the detection of phishing emails and the role of factors beyond the information-reduction hypothesis.

Errors, Irregularities, and Misdirection: Cue Utilisation and Cognitive Reflection in the Diagnosis of Phishing Emails

“…The current study aimed to examine the role of, and potential interplay between, cue utilisation and cognitive reflection in email users' ability to accurately (and efficiently) differentiate between phishing and genuine emails. In doing so, this work directly extends upon existing phishing victimology frameworks that have established the role of cue utilisation (Nasser et al, 2020a(Nasser et al, , 2020bBayl-Smith et al, 2020) and factors relating to dual process information processing (Butavicius et al, 2016;Frauenstein & Flowerday, 2020;Harrison et al, 2016;Jones et al, 2019;Luo et al, 2013;Valecha et al, 2015;Vishwanath et al, 2011;Vishwanath et al, 2016;Vishwanath et al, 2018;Yan & Gozu, 2012;Zhang et al, 2012) in determining users' phishing susceptibility. Critically, clarifying the interplay between users' perceptual-cognitive skills and their existing preferences concerning information processing have implications to the future design of cyber security interventions such as education and training programs, and more broadly, to our understanding of the acquisition of skilled intuition and expertise in similar domains of judgement and decision-making.…”

“…Finally, despite previous work differentiating levels of performance based on phishing cue utilisation (Nasser et al, 2020b), and others eliciting a set of 'correct' phishing cues , differences in the types of cues used across high and low cue users are yet to be captured. This has largely been attributed to limitations in previous designs (e.g., asking participants to recognise the features they use from a pre-defined list; Nasser et al, 2020b).…”

“…The study aimed to examine the role of, and potential interplay between, cue utilisation and cognitive reflection in email users' ability to accurately (and efficiently) differentiate between phishing and genuine emails. As in Bayl-Smith et al (2020), andNasser et al (2020a;2020b), EXPERTise 2.0 was used to gauge participants' level of phishing cueutilisation. Consistent with their findings we expected that those participants with higher levels of cue utilisation would demonstrate superior performance on a phishing diagnosis task compared to those with lower levels of cue utilisation, but that, based on the theorised relationship between greater cognitive reflection and the development of skilled cue utilisation (Kahneman & Klein, 2009), this relationship would also be moderated by users' cognitive reflection tendencies.…”

Investigation into Phishing Risk Behaviour among Healthcare Staff

“…Healthcare staff can fall victim to phishing attacks due to the nature of their work. They are often occupied with a heavy workload due to the high patients-to-staff ratio and their work is sometimes characterized by emergency situations, thereby increasing their cognitive load [70]. Additionally, healthcare workers may have poor information security knowledge and training and poor perception, possibly causing them to undermine better cyber security hygiene in phishing attacks [71].…”

“It may take ages”: Understanding Human-Centred Lateral Phishing Attack Detection in Organisations

“…These systems give individuals another platform for interaction, networking, knowledge, and information sharing through messaging, voice, photos, videos, and more. The use of these platforms has increased considerably in organisations during and post-pandemic periods [2], [80],…”