How Experts Detect Phishing Scam Emails

Abstract

Phishing scam emails are emails that pretend to be something they are not in order to get the recipient of the email to undertake some action they normally would not. While technical protections against phishing reduce the number of phishing emails received, they are not perfect and phishing remains one of the largest sources of security risk in technology and communication systems. To better understand the cognitive process that end users can use to identify phishing messages, I interviewed 21 IT experts about instances where they successfully identified emails as phishing in their own inboxes. IT experts naturally follow a three-stage process for identifying phishing emails. In the first stage, the email recipient tries to make sense of the email, and understand how it relates to other things in their life. As they do this, they notice discrepancies: little things that are "off" about the email. As the recipient notices more discrepancies, they feel a need for an alternative explanation for the email. At some point, some feature of the email -usually, the presence of a link requesting an action -triggers them to recognize that phishing is a possible alternative explanation. At this point, they become suspicious (stage two) and investigate the email by looking for technical details that can conclusively identify the email as phishing. Once they find such information, then they move to stage three and deal with the email by deleting it or reporting it. I discuss ways this process can fail, and implications for improving training of end users about phishing. CCS Concepts: • Human-centered computing → Empirical studies in collaborative and social computing; Computer supported cooperative work; Empirical studies in HCI; HCI theory, concepts and models; User studies; • Security and privacy → Social aspects of security and privacy; Usability in security and privacy; Phishing; • Social and professional topics → Phishing; • Applied computing → Enterprise computing.

I Don’t Need an Expert! Making URL Phishing Features Human Comprehensible

“…When judging the safety of a URL, experts generally have more experience and data sources to draw from but at the end they look for discrepancies in the data and their expectations [84]. They can collect the data using tools like WHOIS (ICANN's domain lookup) to learn about the registered domain owner or understand the implications of a links up-time and popularity.…”

“…Humans are the last point of defense for organizations as detecting phishing emails requires humans awareness of the context in which they received the phishing message, such as who they expect to receive the message from and which website they expect to visit [84]. Experts, for example, identify phishing emails by hovering over links, looking at sender emails address, and other technical information of the email; they typically learn to look at these features from training materials [84]. Training average users to identify phishing messages is a common approach which is often combined with automatic detection [9,12,43,74].…”

How Good Are We at Detecting a Phishing Attack? Investigating the Evolving Phishing Attack Email and Why It Continues to Successfully Deceive Society

“…However, despite the ‘availability of myriads anti-phishing systems, phishing continues unabated due to inadequate detection of a zero-day attack, superfluous computational overhead and high false rates’ [ 30 , p.1]. Moreover, in their research, Wash [ 50 ] found that while technical protections against phishing reduce the number of phishing emails received, they are not perfect. This could be because individual’s phishing susceptibility may be shaped by recent phishing encounters and, more importantly, that the effect of new experience on susceptibility will be heterogeneous among users [ 9 , p.1].…”

“…This could be because individual’s phishing susceptibility may be shaped by recent phishing encounters and, more importantly, that the effect of new experience on susceptibility will be heterogeneous among users [ 9 , p.1]. To better understand the cognitive process that end users can use to identify phishing messages, Wash [ 50 ] interviewed number of IT experts about where they successfully identified emails as phishing in their own inboxes. The problem is ‘the variety of phishing attacks is very broad, and usage of novel, more sophisticated methods complicate its automated filtering’ [ 33 , p.1].…”

SMILE - Smart eMaIl Link Domain Extractor

“…Yet, all phishing emails with links can be identified through the URL behind each link. However, [23] showed that most people are not aware of this and [3] demonstrated that people have problems reading URLs correctly.…”