Why phishing works

By Rachna Dhamija, J. Doug Tygar, Marti A. Hearst. 2006

1,590 citations recorded by the source corpus.

To build systems shielding users from fraudulent (or phishing) websites, designers need to know which attack strategies work and why. This paper provides the first empirical evidence about which malicious strategies are successful at deceiving general users. We first analyzed a large set of captured phishing attacks and developed a set of hypotheses about why these strategies might work. We then assessed these hypotheses with a usability study in which 22 participants were shown 20 web sites and asked to determine which ones were fraudulent. We found that 23% of the participants did not look at browser-based cues such as the address bar, status bar and the security indicators, leading to incorrect choices 40% of the time. We also found that some visual deception attacks can fool even the most sophisticated users. These results illustrate that standard security indicators are not effective for a substantial fraction of users, and suggest that alternative approaches are needed.

Subfields: Information Systems, Sociology and Political Science

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Information Systems

In Sociology and Political Science

Citations in the corpus

PhishEye: Live Monitoring of Sandboxed Phishing Kits (2016, background): “In 2006, a number of studies concluded that anti-phishing solutions [44], security indicators [10], and browsers toolbars [42] were ineffective in detecting phishing sites and protecting users.”
"...No one Can Hack My Mind": Comparing Expert and Non-Expert Security Practices (2015, neutral): “[13], Wu et al.”
Why do people get phished? Testing individual differences in phishing vulnerability within an integrated, information processing model (2011, background): “Dhamija et al 2006 [16] Experiment Provide empirical evidence of what malicious strategies are successful at deceiving online users.”
The Emperor's New Security Indicators (2007, background): “Role-playing failures have also been observed in a previous study in which participants logged into ‘phishing’ websites using their own account credentials, even though they knew the websites might be illegitimate and they had been asked to play a role [ 6 ].”
Learning to detect phishing emails (2007, background): “Previous work [25] indicates that the ability to create goodlooking copies, as well as users’ unfamiliarity with browser security indicators, leads to a significant percentage of users being unable to recognize a phishing attack.”
A survey of the applications of text mining in financial domain (2016, background): “Dhamija et al. (2006) provided the first experimental proof that explains about how malicious strategies work.”
Protecting people from phishing: the design and evaluation of an embedded training email system (2007, background): “User studies have shown that a large number of people fall for these phishing attacks, even when the participants are made aware that their ability to identify phishing attacks is being tested [7].”
Phinding Phish: An Evaluation of Anti-Phishing Toolbars (2007, background): “These studies have shown that most users are likely to fall for phishing scams, and that many users ignore warnings provided by anti-phishing tools [7], [8], [13], [25].”
Anti-Phishing Phil: the design and evaluation of a game that teaches people not to fall for phish (2007, background): “The authors noted that 23% of their participants ignored all cues in the browser address bar and status bar as well as all security indicators [5].”
Insights into User Behavior in Dealing with Internet Attacks (2012, methodology): “We designed the experiments as a within-subject study in which all participants responded to a series of tests in various security contexts.”
A Usability Evaluation of Tor Launcher (2017, background): “Usable security research explores a variety of security concepts, such as email encryption [20, 43], authentication [10, 28, 38], security indicators [2, 11], and warnings [15, 37].”
Behind Phishing: An Examination of Phisher Modi Operandi (2008, background): “[3]. Work in [ 5 ] by Dhamija et al. provides a psychology-based discussion of how people fall victim to phishing, while articles, such as, Goth’s [11] discuss the economic impact of phishing related crimes.”
Predicting phishing websites based on self-structuring neural network (2013, background): “Moreover, phishing attacks can be performed quickly, later the phisher may disappear into cyberspace and thus the law enforcement authorities must quickly respond because on average the phishing website lives for only 54 hours [5].”
On the Effectiveness of Techniques to Detect Phishing Sites (2007, background): “In fact, in a later study [6], Dhamija et al. report that more than 20% of the users do not take visual cues into consideration when surfing and that visual deception attacks can fool even the most sophisticated users.”
Anti-Phishing Landing Page : Turning a 404 into a Teachable Moment for End Users (2009, neutral): “showed [7], the fact that these logos and banners look legitimate is one of the main reasons people fall for phishing emails.”