Suspicion, Cognition, and Automaticity Model of Phishing Susceptibility

Abstract

Social-psychological research on phishing has implicated ineffective cognitive processing as the key reason for individual victimization. Interventions have consequently focused on training individuals to better detect deceptive emails. Evidence, however, points to individuals sinking into patterns of email usage that within a short period of time results in an attenuation of the training effects. Thus, individual email habits appear to be another predictor of their phishing susceptibility. To comprehensively account for all these influences, we built a model that accounts for the cognitive, preconscious, and automatic processes that potentially leads to phishing-based deception. The resultant suspicion, cognition, and automaticity model (SCAM) was tested using two experimental studies in which participants were subjected to different types of emailbased phishing attacks.

User characteristics that influence judgment of social engineering attacks in social networks

“…Prior literature on email environment victimisation [22][23][24] has explored the effect of social network habits on predicting behaviour toward email phishing. In the virtual network setting, users tend to exhibit their trust by their degree of engagement in the network [25].…”

Exploratory lens model of decision-making in a potential phishing attack scenario

“…These are personality traits that tend to be fairly stable independent of training (Parrish, Bailey, & Courtney, 2009;Vishwanath, Harrison, & Ng, 2016). Knowing an individual user's scores on a personality battery, training and technological interventions could adjust to optimize ratios of accepted and rejected messages, and on what bases.…”

“…Parrish, Bailey, and Courtney (2009) proposed a framework using the Big-Five personality traits to explain why some people are more susceptible than others to phishing attacks. Other authors such as Vishwanath, Harrison, and Ng (2016) note that relatively suspicious individuals bias their message classification against compliance with the sorts of requests that phishing attack messages tend to include, such as to follow a link.…”

Fusing system design and social science to reduce susceptibility to online influence

“…However, certain populations, such as police officers, and certain contexts, such as sales environments, have been linked with a greater degree of suspicion (DePaulo & DePaulo, 1989;Garrido, Masip & Herrero, 2004). People's awareness of online risk, their degree of technical understanding and their perception of the potential threat are all likely to impact on trust decisions regarding online communications (Vishwanath, Harrison & Ng, 2016).…”

“…Frameworks for understanding differences in susceptibility to influence are currently being developed and expanded (e.g., Vishwanath et al, 2016;Wright & Marrett, 2014). However, these have focused predominantly on dispositional factors, such as personality, or experiential factors, such as knowledge and habits, and do not currently account for potential interactions with wider context or state-induced factors such as emotional state, cognitive capacity or relative position within wider technical, organisational and social systems.…”