Who falls for phish?
Published 10 April 2010
Steve Sheng, Mandy B. Holbrook, Ponnurangam Kumaraguru, Lorrie Faith Cranor, Julie S. Downs
Citations589
Generate an AI Snapshot to get a quick, structured summary of this paper.
Study Snapshot
ObjectiveStudy objective
MethodsResearch methodology
PopulationPopulation studied
Sample sizeSample sizes
OutcomesStudy outcomes here
ResultsStudy results comes here
LimitationsResearch study limitations comes here
A concise AI-generated summary of the paper will appear here once you click Generate AI Snapshot.
TL;DR
The results suggest that women are more susceptible than men to phishing and participants between the ages of 18 and 25 are more susceptibility to phishers than other age groups.
Abstract
In this paper we present the results of a roleplay survey instrument administered to 1001 online survey respondents to study both the relationship between demographics and phishing susceptibility and the effectiveness of several anti-phishing educational materials. Our results suggest that women are more susceptible than men to phishing and participants between the ages of 18 and 25 are more susceptible to phishing than other age groups. We explain these demographic factors through a mediation analysis. Educational materials reduced users' tendency to enter information into phishing webpages by 40% percent; however, some of the educational materials we tested also slightly decreased participants' tendency to click on legitimate links.
Keywords
Computer Science
Behavior Research MethodsAsymptotic and resampling strategies for assessing and comparing indirect effects in multiple mediator models
32,712 Citations2008Kristopher J. Preacher, Andrew F. Hayes
An overview of simple and multiple mediation is provided and three approaches that can be used to investigate indirect processes, as well as methods for contrasting two or more mediators within a single model are explored.
Annual Review of PsychologyMediation Analysis
5,400 Citations2006David P. MacKinnon, Amanda J. Fairchild +1 more
Differences between mediating variables and confounders, moderators, and covariates are outlined and future directions for mediation analysis are discussed.
The Perception of Risk
2,019 Citations2016Paul Slovic
Evaluation ReviewEstimating Mediated Effects in Prevention Studies
1,967 Citations1993David P. MacKinnon, James H. Dwyer
Assessment of how prevention and intervention programs achieve their effects requires the measurement of intervening or mediating variables hypothesized to represent the causal mechanism by which the prevention program achieves its effects.
Risk AnalysisGender, Race, and Perception of Environmental Health Risks
1,539 Citations1994James Flynn, Paul Slovic +1 more
The results of a national survey in which perceptions of environmental health risks were measured showed that white women perceived risks to be much higher than did white men, but this gender difference was not true of nonwhite women and men, whose perceptions of risk were quite similar.
Why phishing works
1,286 Citations2006Rachna Dhamija, J. D. Tygar +1 more
This paper provides the first empirical evidence about which malicious strategies are successful at deceiving general users by analyzing a large set of captured phishing attacks and developing a set of hypotheses about why these strategies might work.
Gothic.netRisk and Rationality in Adolescent Decision Making
1,228 Citations2006Valerie F. Reyna, Frank H. Farley
In the heat of passion, in the presence of peers, on the spur of the moment, in unfamiliar situations, when trading off risks and benefits favors bad long-term outcomes, and when behavioral inhibition is required for good outcomes, adolescents are likely to reason more poorly than adults do.
Communications of the ACMSocial phishing
1,116 Citations2007Tom N. Jagatic, Nathaniel A. Johnson +2 more
Sometimes a "friendly" email message tempts recipients to reveal more online than they otherwise would, playing right into the sender's hand.
Do security toolbars actually prevent phishing attacks?
555 Citations2006Min Wu, Robert C. Miller +1 more
It is found that many subjects do not understand phishing attacks or realize how sophisticated such attacks can be, and security toolbars are found to be ineffective at preventingPhishing attacks.
Anti-Phishing Phil
506 Citations2007Steve Sheng, Bryant Magnien +5 more
The design and evaluation of Anti-Phishing Phil, an online game that teaches users good habits to help them avoid phishing attacks are described and it is confirmed that games can be an effective way of educating people about phishing and other security attacks.
Are your participants gaming the system?
427 Citations2010Julie S. Downs, Mandy B. Holbrook +2 more
The Emperor's New Security Indicators
402 Citations2007Stuart Schechter, Rachna Dhamija +2 more
The first empirical evidence that role playing affects participants' security behavior is contributed: role-playing participants behaved significantly less securely than those using their own passwords.
ACM Transactions on Internet TechnologyTeaching Johnny not to fall for phish
394 Citations2010Ponnurangam Kumaraguru, Steve Sheng +3 more
The results suggest that, while automated detection systems should be used as the first line of defense against phishing attacks, user education offers a complementary approach to help people better recognize fraudulent emails and websites.
Decision strategies and susceptibility to phishing
343 Citations2006Julie S. Downs, Mandy B. Holbrook +1 more
Preliminary analysis of interviews with 20 non-expert computer users to reveal their strategies and understand their decisions when encountering possibly suspicious emails suggests that people can manage the risks that they are most familiar with, but don't appear to extrapolate to be wary of unfamiliar risks.
Protecting people from phishing
279 Citations2007Ponnurangam Kumaraguru, Yong Rhee +4 more
This paper describes the design and evaluation of an embedded training email system that teaches people about phishing during their normal use of email and finds that embedded training works better than the current practice of sending security notices.
School of phish
238 Citations2009Ponnurangam Kumaraguru, Justin Cranshaw +5 more
Results of this study show that users trained with PhishGuru retain knowledge even after 28 days; adding a second training message to reinforce the original training decreases the likelihood of people giving information to phishing websites; and training does not decrease users' willingness to click on links in legitimate messages.
Judgment and Decision MakingA Domain-Specific Risk-Taking (DOSPERT) scale for adult populations
209 Citations2006Ann-Renée Blais, Elke U. Weber
Behavioral response to phishing risk
190 Citations2007Julie S. Downs, Mandy B. Holbrook +1 more
A pilot survey of 232 computer users is reported to reveal predictors of falling for phishing emails, as well as trusting legitimate emails, to suggest that educational efforts should aim to increase users' intuitive understanding, rather than merely warning them about risks.
SSRN Electronic JournalTHE MYTH OF USER EDUCATION
36 Citations2006Stefan Görling
This paper aims to discuss two questions: should the authors expect their users to be interested in education and do they have any evidence that user education leads to a higher level of security?