Why do some people manage phishing e‐mails better than others?

Abstract

PurposeThe purpose of this paper is to investigate the behaviour response of computer users when either phishing e‐mails or genuine e‐mails arrive in their inbox. The paper describes how this research was conducted and presents and discusses the findings.Design/methodology/approachThis study was a scenario‐based role‐play experiment that involved the development of a web‐based questionnaire that was only accessible by invited participants when they attended a one‐hour, facilitated session in a computer laboratory.FindingsThe findings indicate that overall, genuine e‐mails were managed better than phishing e‐mails. However, informed participants managed phishing e‐mails better than not‐informed participants. Other findings show how familiarity with computers, cognitive impulsivity and personality traits affect behavioural responses to both types of e‐mail.Research limitations/implicationsThis study does not claim to evaluate actual susceptibility to phishing emails. The subjects were University students and therefore the conclusions are not necessarily representative of the general population of e‐mail users.Practical implicationsThe outcomes of this research would assist management in their endeavours to improve computer user behaviour and, as a result, help to mitigate risks to their organisational information systems.Originality/valueThe literature review indicates that this paper addresses a genuine gap in the research.

A Systematic Approach to Terahertz-based Glucose Monitoring

“…But they do not cite any source that would support the link between any of the two personality traits and trust. On the contrary, our results (Sudzina, 2016a;Sudzina, 2016b) indicate a link between some of the three remaining personality traits and trust or mistrust; but extraversion and openness to experience were not linked to trust nor to mistrust (this holds not only for Big Five Inventory-10 used in the two papers but also for Big Five Inventory-44 (the instrument used by Pattinson et al (2012)) -though the findings were not published yet).…”

SoK: A Comprehensive Reexamination of Phishing Research From the Security Perspective

“…The effect of priming people on detection of phishing emails has been studied in [219]. They divided a total of 117 participants into two groups.…”

“…[266] 4 [225], [229], [247], [265] 2 [233], [252] 1 [219] No 6 [10], [230], [238], [249], [250], [258] 3 [242], [260], [263] Webpage Yes 5 [204], [239], [245], [253], [261] No 4 [203], [212], [236], [264] 3 [211], [213], [216] 3 [61], [217], [ [232] in [211] and [214] used Functional Magnetic Resonance Imaging (fMRI) and Electroencephalogram (EEG) to measure brain's electrical activity and an eye-tracker to have a better understanding of users' decision-making process. They used both existing phishing websites (by downloading and hosting them on their own network) and manually created ones.…”

You’ve got mail! Explaining individual differences in becoming a phishing target

“…It could be assumed that habitual internet users have more experience with detecting inconsistencies in e-mails. However, a study by Pattinson et al (2012) indicates that only for people who were aware that they participated in an experiment on phishing, familiarity with computers had a significant effect on how they managed phishing e-mails. This might implicate that even experienced internet users need a constant reminder of the risks they face.…”