How Good Are We at Detecting a Phishing Attack? Investigating the Evolving Phishing Attack Email and Why It Continues to Successfully Deceive Society

Fiona Carroll,John Ayooluwa Adejobi,Reza Montasari

doi:10.1007/s42979-022-01069-1

Fiona Carroll, John Ayooluwa Adejobi + Show 1 more

Open Access

https://doi.org/10.1007/s42979-022-01069-1

Copy DOI

Abstract

Phishing attacks are on the increase. The fact that our ways of living, studying and working have drastically changed as a result of the COVID pandemic (i.e., almost everything being done online) has created many new cyber security concerns. In particular, with the move to remote working, the number of phishing emails threatening employees has increased. The 2020 Phishing Attack Landscape Report (Greathorn: 2020 Phishing attack landscape. https://info.greathorn.com/report-2020-phishing-attack-landscape/, 2020) highlights a sharp increase in the frequency of attempted phishing attacks. In this paper, we are interested in how the phishing email attack has evolved to this very threatening state. In detail, we explore the current phishing attack characteristics especially the growing challenges that have emerged as a result of the COVID-19 pandemic. The paper documents a study that presented test participants with five different categories of emails (including phishing and non phishing) . The findings from the study show that participants, generally, found it difficult to detect modern phishing email attacks. Saying that, participants were alert to the spelling mistakes of the older phishing email attacks, sensitive information being requested from them and any slight change to what they were normally used to from an email. Moreover, we have found that people were not confident, worried and often dissatisfied with the current technologies available to protect them against phishing emails. In terms of trust, these feelings alerted us to the increasing severity of the phishing attack situation and just how vulnerable society has become/ still is.

Highlights

During the last year and a half of lockdown and COVID, emails have become far more important than they ever were before
As participants felt: ‘It does not have a normal email format’ (P.53) and ‘Because it just looks like a cyber-attack
The findings show that participants became more alert and nervous as they came in contact with newer examples

Summary

Introduction

During the last year and a half of lockdown and COVID, emails have become far more important than they ever were before. For many they have become the lifeline for sustaining communication and contact with friends, family and work colleagues. As Williams and Joinson [51, p.1] note ‘Phishing e-mails are fraudulent e-mails used to gain access to sensitive information or secure computer systems. They persuade users to click on malicious links, download attachments or provide sensitive information, such as usernames or passwords’. Artificial Intelligence (AI) techniques such as machine learning, deep learning, hybrid learning, and scenario-based techniques are all being urgently explored to try to solve this phishing email pandemic

Objectives

Results

Discussion

Conclusion