What Message Characteristics Make Social Engineering Successful on Facebook: The Role of Central Route, Peripheral Route, and Perceived Risk

Abdullah Algarni

doi:10.3390/info10060211

Abstract

Past research suggests that the human ability to detect social engineering deception is very limited, and it is even more limited in the virtual environment of social networking sites (SNS) such as Facebook. At the organizational level, research suggests that social engineers could succeed even among those organizations that identify themselves as being aware of social engineering techniques. This may be partly due to the complexity of human behaviors in failing to recognize social engineering tricks in SNSs. Due to the vital role that persuasion and perception play on users’ decision to accept or reject social engineering tricks, this paper aims to investigate the impact of message characteristics on users’ susceptibility to social engineering victimization on Facebook. In doing so, we investigate the role of the central route of persuasion, peripheral route of persuasion, and perceived risk on susceptibility to social engineering on Facebook. In addition, we investigate the mediation effects between the explored factors, and whether there is any relationship between the effectiveness of them and users’ demographics.

Highlights

Social engineering is the art of deceiving or tricking people in order to gain information from them, or to persuade them to perform an action that will benefit the attacker in some way [1,2,3]
We investigate whether there is any relationship between the effectiveness of the explored message characteristics and users’ demographics
As we aim to investigate the message characteristics that influence the success of social engineering trick on Facebook, we need to address the two parts that have been indicated in Elaboration Likelihood Model (ELM): The content of the message and the superficial means of the message

Summary

Introduction

Social engineering is the art of deceiving or tricking people in order to gain information from them, or to persuade them to perform an action that will benefit the attacker in some way [1,2,3]. Several researchers have investigated and highlighted the risks associated with social engineering in SNSs (e.g., References [7,8,9,10,11,12,13]). These studies have suggested that SNSs are the most common source of social engineering threats nowadays. The simple trick of offering free cell phone minutes accounted for the largest number of attacks on Facebook users in 2013, increasing from 56% in 2012 to 81% in 2013 [14]

Objectives

Methods

Results