An empirical investigation of the factors that influence Internet user’s ability to correctly identify a phishing website

Abstract

Purpose – The aim of this study is to report on the results of an empirical investigation of the various factors which have significant impacts on the Internet user’s ability to correctly identify a phishing website. Design/methodology/approach – The research participants were Internet users who have had at least some experience of financial transactions over the Internet. This study conducted a quantitative research with the help of a structured survey questionnaire along with three experimental tasks. A total of 621 valid samples were collected and the multiple regression analysis technique was used to deduce the answers to the research question. Findings – The results show that the model is useful and has explanatory power. And adjusted R2 computed as 0.927, means that 92.7 per cent of the variations in the Internet user’s ability to identify phishing website can be explained by the predictors selected for the model. Research limitations/implications – Future research should account for the Internet user’s general security practices and behaviour, attitude towards online financial activity, risk-taking ability or risk behaviour and their potential effects on Internet users' ability to identify a phishing website. Practical implications – The implications of this study provide the foundation for future research on the areas that intend to explain the Internet user’s necessity to take protection or avoid risky behaviour while performing financial transaction over the Internet. Originality/value – This study provides the body of knowledge with an empirical analysis of impact of various factors on an Internet user’s ability to identify phishing websites. The results of this study can help practitioners create a more successful research model and help researchers better understand user behaviour on the Internet.

You’ve got mail! Explaining individual differences in becoming a phishing target

“…Usually phishing e-mails do not ask for a direct reply, but contain a link to a fraudulent website, which is 'the hook' in the fishing metaphor. This website is very similar in look and feel to the official website it impersonates (Alseadoon et al, 2012;Hinde, 2004;Purkait et al, 2014;. A recent report based on real-world online security incidents indicates that around 1 in 14 targets get successfully phished, either because they clicked the link or opened an attachment in a phishing e-mail (Verizon, 2017).…”

“…Successful phishing attacks often result in identity theft and subsequently in financial gains for the offender. However, Purkait et al (2014) stress the fact that money is not always the main objective for phishers. The collected information can also be used to harm the reputation of an individual or company, for example by spreading some controversial statements on behalf of another person.…”

“…Just like fishers, phishers use bait to increase the chances that their target will "bite". This bait most frequently consists of e-mails seemingly sent by a trusted entity, for example a bank (Purkait, 2012;Purkait et al, 2014;Reyns, 2015). These e-mails often inform the user that a problem occurred that can only be solved if the e-mail's recipient confirms some personal information (Hinde, 2004;, or they promise tempting offers in exchange for personal details like a user ID or password (Hinde, 2004).…”

Examining the effectiveness of phishing filters against DNS based phishing attacks

“…Hunter (2006), in his article in Computer Fraud & Security, points out that although the day of the amateur hacker is gone, there are still plenty of amateur users. Researchers have found that security is not always the main concern for the user when they are online and submitting confidential login credentials into any website (Purkait, 2012b(Purkait, , 2014. Moreover, Internet users are lacking a baseline level of online safety awareness (Furnell, 2007), and they react to a variety of commonly available trust indicators such as logos, third-party endorsements and padlock icons over a selection of authentic phishing stimuli (Jakobsson et al, 2007).…”

“…On the one hand, there are users who are completely ignorant about phishing, and on the other hand, there are criminals who are developing new phishing ideas every day (Purkait, 2012). Researchers have studied in the past, why people fall for phishing attacks (Dhamija et al, 2006 andPurkait et al, 2014), or why people ignore security indicators provided by the anti-phishing toolbars of various Web browsers (Wu et al, 2006). However, there has been very little research on the effectiveness of these toolbars against fresh phishing sites or sophisticated DNS-based phishing attacks on local area networks (LANs).…”