Heads-up! An alert and warning system for phishing emails

Molly Cooper,Laurie Dringus,Ling Wang,Yair Levy

doi:10.1108/ocj-03-2021-0006

Abstract

PurposeThis study introduces the concept of audiovisual alerts and warnings as a way to reduce phishing susceptibility on mobile devices.Design/methodology/approachThis study has three phases. The first phase included 32 subject matter experts that provided feedback toward a phishing alert and warning system. The second phase included development and a pilot study to validate a phishing alert and warning system prototype. The third phase included delivery of the Phishing Alert and Warning System (PAWSTM mobile app) to 205 participants. This study designed, developed, as well as empirically tested the PAWSTM mobile app that alerted and warned participants to the signs of phishing in emails on mobile devices.FindingsThe results of this study indicated audio alerts and visual warnings potentially lower phishing susceptibility in emails. Audiovisual warnings appeared to assist study participants in noticing phishing emails more easily and in less time than without audiovisual warnings.Practical implicationsThis study's implications to mitigation of phishing emails are key, as it appears that alerts and warnings added to email applications may play a significant role in the reduction of phishing susceptibility.Originality/valueThis study extends the existing information security body of knowledge on phishing prevention and awareness by using audiovisual alerts and warnings to email recipients tested in real-life applications.

Highlights

Over the past two decades, email became an essential part of personal and business communication (Clement, 2018)
The overarching research problem this study addresses is the significant volume of users who continue to click on phishing links in emails, exposing them and/or their organizations to identity theft, monetary loss and data loss (Aaron, 2010; ElAassal et al, 2020)
The first phase of this research study included collecting Subject matter expert (SME) opinion on the initial list of simulated phishing examples, the study measures to be operationalized by the app, along with a set of audio/visual/haptic alerting should be paired with matching signs of phishing in emails for presentation in the Phishing Alert and Warning System (PAWS) mobile app prototype

Summary

Introduction

Over the past two decades, email became an essential part of personal and business communication (Clement, 2018). It is estimated that 72% of users check their email via mobile smartphone, and 19% of users check email as soon as they arrive to work (Clement, 2018). Users still fall for phishing in emails (Wash and Cooper, 2018) and collectively costing themselves and their employers millions of dollars annually. Phishing and social engineering attacks target more than 37.3 million people per year and cost organizations an average of US$3.7m annually (Abass, 2018). Phishing and social engineering encompass approximately 93% of information security incidents (Anti-Phishing Working Group, 2018). Phishing emails continue to present a significant threat to both personal and corporate data loss, even after phishing awareness training

Objectives

Methods

Results

Discussion

Conclusion