Trust me and Click! A Pilot Study of Cognitive Walkthrough for Phishing Emails

Abstract

The growing importance of new markets on the Internet in the 1990s led to the development of new guidelines and interface design principles ensuring online consumer trust. These guidelines have been rapidly spoofed by attackers who integrated interface design principles maliciously to deceive users with phishing emails. In this paper we propose to adapt an inspection method, Cognitive Walkthrough, to understand how users walk through the processing of a phishing email. 23 experienced evaluators used the proposed method, Cognitive Walkthrough for phishing emails, in a pilot study and gave a feedback on it. The method allows to analyze the areas of a phishing email eliciting users to trust, to act, and to distrust. These areas are then commented allowing to understand the interface design principles exploited maliciously by attackers when they are saying to users: Trust me and click!