Decision strategies and susceptibility to phishing

By Julie S. Downs, Mandy B. Holbrook, Lorrie Faith Cranor. Symposium On Usable Privacy and Security, 2006

432 citations recorded by the source corpus.

Phishing emails are semantic attacks that con people into divulging sensitive information using techniques to make the user believe that information is being requested by a legitimate source. In order to develop tools that will be effective in combating these schemes, we first must know how and why people fall for them. This study reports preliminary analysis of interviews with 20 non-expert computer users to reveal their strategies and understand their decisions when encountering possibly suspicious emails. One of the reasons that people may be vulnerable to phishing schemes is that awareness of the risks is not linked to perceived vulnerability or to useful strategies in identifying phishing emails. Rather, our data suggest that people can manage the risks that they are most familiar with, but don't appear to extrapolate to be wary of unfamiliar risks. We explore several strategies that people use, with varying degrees of success, in evaluating emails and in making sense of warnings offered by browsers attempting to help users navigate the web.

Subfields: Information Systems, Sociology and Political Science

View Paper: https://www.semanticscholar.org/paper/1b99fe2f4e680ebb7fe82ec7054d034c8ab8c79d

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Information Systems

In Sociology and Political Science

Citations in the corpus

You've been warned: an empirical study of the effectiveness of web browser phishing warnings (2008, background): “Spear phishing “involves personalized emails or emails sent to a specifically targeted group, such as employees of a particular organization” [8].”
Cantina: a content-based approach to detecting phishing web sites (2007, background): “results of an interview and role-playing study aime d at understanding why people fall for phishing emails a nd what cues they look for to avoid such attacks [10].”
User preference of cyber security awareness delivery methods (2014, background): “Some people may be aware of phishing, but they do not associate that awareness to their own vulnerability or to strategies for identifying phishing attacks (Downs et al. 2006).”
Who falls for phish?: a demographic analysis of phishing susceptibility and effectiveness of interventions (2010, methodology): “Participants were asked to check boxes corresponding to all of the actions they would be likely to take from a list of responses generated through earlier qualitative work [3]:”
Protecting people from phishing: the design and evaluation of an embedded training email system (2007, methodology): “Th is approach has served as a good filter to recruit non -experts in other studies [10, 21].”
A Framework for Reasoning About the Human in the Loop (2008, background): “For example, most users do not understand the meaning of web browser security symbols and pop-up warnings [10], [15].”
Why do people get phished? Testing individual differences in phishing vulnerability within an integrated, information processing model (2011, background): “As Downs et al. (2006a) [17] argue, if we want to develop tools that will be effective in combating phishing schemes, we first must know how and why people fall for them.”
Getting users to pay attention to anti-phishing education: evaluation of retention and transfer (2007, background): “User studies examining phishing or phishing-related interventions are often agnostic to individual user characteristics (sex, age, education level and hours using computer) or have not found significant relationships between features such as age or gender and phishing-related behavior [6, 7, 15, 23]”