SMiShing Attack Vector: Surveying End-User Behavior, Experience, and Knowledge

Abstract

Phishing attacks steal sensitive and valuable information from end-users. Human Factors researchers have extensively studied Phishing over decades, revealing numerous psychological vulnerabilities. A greater understanding of the interaction between attackers and end-users has produced more effective: policies, models, training, and defensive mechanisms. The Human Factors literature lacks information about non-technical users’ knowledge, experience, and behaviors in response to SMiShing. The current survey collected pilot data from college students with average cyber hygiene scores. Our results suggest that while users do not clearly understand the term SMiShing, they report knowing the danger. While all participants reported that using links within text messages from unknown senders can lead to security vulnerabilities, most reported using the links anyway. Users vet messages based on the sender’s phone number and typos, rather than delivery time and other message recipients. These descriptive findings can be used to support future work attempting to defend against SMiShing attacks.