Baiting the hook: factors impacting susceptibility to phishing attacks

Abstract

Over the last decade, substantial progress has been made in understanding and mitigating phishing attacks. Nonetheless, the percentage of successful attacks is still on the rise. In this article, we critically investigate why that is the case, and seek to contribute to the field by highlighting key factors that influence individuals’ susceptibility to phishing attacks. For our investigation, we conducted a web-based study with 382 participants which focused specifically on identifying factors that help or hinder Internet users in distinguishing phishing pages from legitimate pages. We considered relationships between demographic characteristics of individuals and their ability to correctly detect a phishing attack, as well as time-related factors. Moreover, participants’ cursor movement data was gathered and used to provide additional insight. In summary, our results suggest that: gender and the years of PC usage have a statistically significant impact on the detection rate of phishing; pop-up based attacks have a higher rate of success than the other tested strategies; and, the psychological anchoring effect can be observed in phishing as well. Given that only 25 % of our participants attained a detection score of over 75 %, we conclude that many people are still at a high risk of falling victim to phishing attacks but, that a careful combination of automated tools, training and more effective awareness campaigns, could significantly help towards preventing such attacks.

User characteristics that influence judgment of social engineering attacks in social networks

“…4 that education has the highest rank among other considered factors. This result conflicts with a previous study which argued that the level of education is not significantly related to phishing victimisation [12]. But most importantly, when comparing university students with people from outside higher education institutions [44], both behave in a similar way in social networks.…”

“…However, the statistic mean for this item is higher than the population mean (μ0 = 3) and has been ranked as moderately important in the scale which makes this item hard to exclude from the framework. Surprisingly, the experts did not consider gender as a very important determinant, a result that opposes many previous studies [12,23,31]. One of which was Algarni et al [31] experimental study that revealed a strong correlation between gender and response to social engineering attacks in social network contexts.…”

“…Yet, these results are difficult to generalise as the vast majority of such studies were reported on constrained samples, mainly university students [23,33]. It was found recently that among many examined demographic features, computer usage experience, as well as gender, are the most significant predictors of user's detection ability of webbased phishing attacks [12]. Yet, in the context of victimisation in social networks, selfconfidence in computer skills might lead to risky behaviour as a positive relationship has been found between higher computer skills and user victimisation [26].…”

“…4). Yet, among many studies [12,23,24,26,30] that have empirically tested the impact of the Internet and computer knowledge in preventing users from getting phished, only two studies [12,30] found this relation to be significant. This contradictory result might imply that user internet or computer knowledge is a very general concept whose impact on safe or risky behaviour could be hard to measure.…”

“…The risks to users persist, with a recent study revealing that only 25% of their participants have detected the phishing attacks [12]. Thus, research aiming to comprehend human activities and practices that lead to potential abuses is vital to thwart the effectiveness of any security threats [13].…”