To Click or Not to Click? Deciding to Trust or Distrust Phishing Emails

Abstract

While the email traffic is growing around the world, such questions often arise to recipients: to click or not to click? Should I trust or should I distrust? When interacting with computers or digital artefacts, individuals try to replicate interpersonal trust and distrust mechanisms in order to calibrate their trust. Such mechanisms rely on the ways individuals interpret and understand information. Technical information systems security solutions may reduce external and technical threats; yet the academic literature as well as industrial professionals warn on the risks associated with insider threats, those coming from inside the organization and induced by legitimate users. This article focuses on phishing emails as an unintentional insider threat. After a literature review on interpretation and knowledge management, insider threats and security, trust and distrust, we present a methodology and experimental protocol used to conduct a study with 250 participants and understand the ways they interpret, decide to trust or to distrust phishing emails. In this article, we discuss the preliminary results of this study and outline future works and directions.

A cognitive approach to the decision to trust or distrust phishing emails

“…In this section, we first describe the experimental protocol we used to conduct a study with 249 participants on how they interpreted phishing emails, and then decided to trust or distrust them. Second, we discuss the results that were already partially presented by Arduin (2020) during the EWG‐DSS $$\text{sixth}$$ ICDSST 2020 “Cognitive Decision Support Systems and Technologies” held by the Faculty of Economics and Business, Zaragoza, Spain. Third, we present some examples of “trust‐optimized” phishing emails and discuss the limits and ethical implications of this research.…”

SoK: Human-Centered Phishing Susceptibility

“…Knowledge can be categorized into explicit and implicit knowledge. Explicit knowledge is usually gained through S Tian and Jensen [53] S Arduin [54] M learning and direct training, whereas implicit knowledge is gained from experiences, especially after encountering phishing attacks. Studies have found that, the more individuals are familiar with computers and technology, the more capable individuals would be in coping with phishing emails [57].…”