Phishing Victimization Research Articles

Discovering the Correlation Between Phishing Susceptibility Causing Data Biases and Big Five Personality Traits Using C-GAN

Recently, on social media, various kinds of social engineering (SE) have made individuals more susceptible to attacks. A phishing attempt is a widely used SE technique that takes advantage of people’s vulnerabilities to acquire personal or confidential information. These attempts are growing at an astonishing speed, causing harm to both individuals and corporations. According to the latest studies, certain individuals are more vulnerable to such kinds of attacks than others. However, the relationship between psychological characteristics and phishing attacks has not been adequately investigated. This study empirically explores the connection between phishing vulnerability that causes data biases and the Big Five personality traits. Recognizing personality traits that make people more vulnerable to phishing attempts is a key step in developing protection and safeguarding individuals. The individuals who scored high in some traits are more probable to suffer from such assault. To the best of our knowledge, no prior quantitative study has attempted to find many genuine phishing victims and their personality behavior. This problem lacks the availability of publically accessible data. It is also challenging to estimate the probability distribution of rows in tabular data and generate realistic synthetic data to train/test the model on more data. This work employs a conditional generative adversarial network (C-GAN) for both data generation and classification to find the correlation between personality traits and phishing attacks.

Predicting Phishing Victimization: Comparing Prior Victimization, Cognitive, and Emotional Styles, and Vulnerable or Protective E-mail Strategies

ABSTRACT Phishing victimization is prevalent and results in theft of personal identifiable information (PII) or installing malware to steal PII. Drawing upon social psychological and criminological theories, we conducted a prospective study to assess three groups of predictors to being phished or not: a) prior victimization; b) protective or vulnerable habitual strategies, and c) emotional and cognitive decision-making styles. Students (N = 236) completed a survey assessing these predictors and then about 4 weeks later received a phishing e-mail using the university’s phishing testing system. The e-mail requested that they click on a link and enter their student ID to avoid having their account blocked. About half (50.8%) clicked on the link, and 81.6% of those phished entered their PII. Individuals who had low avoidant style and high generalized anxiety were four times more likely to be phished, after controlling for the significant effects of vulnerable habitual strategies and using dating apps. Machine learning analyses also found cognitive styles and generalized anxiety are the better predictors of getting phished compared to vulnerable and protective strategies and prior victimization. These findings suggest that cybersecurity training needs to be expanded to address the emotional and cognitive processing of deceptive appeals in e-mails.

Phishing victimization among Malaysian young adults: cyber routine activities theory and attitude in information sharing online

PurposeThe purpose of this paper is to understand the influence of exposure to motivated offenders who may alter the vulnerability levels to phishing victimization. This is particularly focused on explaining the influences of individuals’ online lifestyles and attitudes toward information sharing online on phishing susceptibility.Design/methodology/approachThis conceptual paper explores the risk of phishing victimization using criminological theories. The authors draw on empirical evidence from existing cybercrime literature and revisit routine activities theory (RAT) and lifestyle RAT (LRAT) to elucidate the risk of phishing victimization. This paper proposes that cyber-RAT, which was developed from RAT and LRAT, could interpret phishing victimization. Grounded on the intervention-based theory against cybercrime phishing, this study suggests that an attitude toward precautionary behavior (information sharing online) is essential to mitigate the phishing victimization risk.FindingsThis paper aims to provide a clear insight into the understanding of phishing victimization risk using theoretical and empirical evidence.Originality/valueThe theoretical perspective outlined provides the understanding of the impacts of online routine activities on a phishing attack which in turn will increase the awareness of phishing threats. The important role of the precautionary countermeasure, that is, attitudes toward information sharing online is highlighted to reconcile the phishing victimization risk.

Predicting User Susceptibility to Phishing Based on Multidimensional Features.

While antiphishing techniques have evolved over the years, phishing remains one of the most threatening attacks on current network security. This is because phishing exploits one of the weakest links in a network system—people. The purpose of this research is to predict the possible phishing victims. In this study, we propose the multidimensional phishing susceptibility prediction model (MPSPM) to implement the prediction of user phishing susceptibility. We constructed two types of emails: legitimate emails and phishing emails. We gathered 1105 volunteers to join our experiment by recruiting volunteers. We sent these emails to volunteers and collected their demographic, personality, knowledge experience, security behavior, and cognitive processes by means of a questionnaire. We then applied 7 supervised learning methods to classify these volunteers into two categories using multidimensional features: susceptible and nonsusceptible. The experimental results indicated that some machine learning methods have high accuracy in predicting user phishing susceptibility, with a maximum accuracy rate of 89.04%. We conclude our study with a discussion of our findings and their future implications.

A Routine Activities Approach to Evidence-Based Risk Assessment: Findings From Two Simulated Phishing Attacks

To assess the efficacy of routine activity theory (RAT) for explaining phishing victimization and guide evidence-based policy, we launched two phishing attacks via a university Listserv ( N = 25,875). The first email offered access to a pdf file; the second offered free concert tickets. Several interesting findings emerged demonstrating phishing victimization results from network users’ routine behaviors. Students were significantly less likely to open the phishing email sharing a pdf but more likely to open the email offering free concert tickets. Moreover, students were mor e likely to click the malicious link embedded within the phishing email in both studies, often using mobile devices. Conversely, employees were more likely to click the link while connected to the university network, thus exposing the network to greater levels of risk. Finally, the email offering concert tickets was opened at a frequency more than double the email containing the pdf. Theoretical and policy implications are discussed.

Phish Me, Phish Me Not

ABSTRACT While phishing has evolved over the years, it still exploits one of the weakest links in any information system — humans. The present study aims at describing who the potential phishing victims are. We constructed two types of phishing messages that represented two basic categories of phishing e-mails: regular and spear-phishing. In cooperation with the IT management of a municipality in the southwestern region of the United States, we sent these messages to the municipality’s employees and collected demographic data about individuals employed by the organization. We then applied eight supervised learning methods to classify the municipality’s employees into two groups: phished and not-phished. Our results indicate that spear-phishing yields a significantly higher response rate than regular phishing and that some machine learning methods yield high classification accuracy in predicting phishing victims. We finally provide discussion of the results as well as the future implications.

Why do users not report spear phishing emails?

Cyber security training programs encourage users to report suspicious spear phishing emails, and most antiphishing software provide interfaces to assist in the reporting. Evidence, however, suggests that reporting is scarce. This research examined why this is the case. To this end, Social Cognitive Theory (SCT) was used to examine the influence of the triadic factors of perceived self-efficacy toward antiphishing behaviors, expected negative outcomes from reporting spear phishing emails, and cyber security self-monitoring, on individuals’ likelihood of reporting spear phishing emails. Based on recent research on phishing victims, the present study also incorporated cyber risk beliefs (CRBs) into the SCT framework. The model, tested using survey data (N = 386), revealed that the likelihood of reporting spear phishing emails is increased by perceived self-efficacy, expected negative outcomes, and cyber security self-monitoring. Furthermore, the CRBs directly influenced the three SCT factors and indirectly the individuals’ likelihood of reporting spear phishing emails. The findings add to our understanding of SCT and the science of cyber security.

Using the Lens Model and Cognitive Continuum Theory to Understand the Effects of Cognition on Phishing Victimization

With the growing threat of phishing emails and the limited effectiveness of current mitigation approaches, there is an urgent need to better understand what leads to phishing victimization. There is a limited body of phishing research that identified cognitive automaticity as a potential factor, but more research on the relationship between user cognition and victimization is needed. Additionally, the current phishing research has not considered the characteristics of the environment in which phishing judgments are made. To fill these gaps, this work used the analysis capabilities afforded by the double system lens model (a judgment analysis technique) and the cognitive continuum theory, specifically the task continuum index and the cognitive continuum index. By calculating a task continuum index score, the cognition best suited for the email sorting task was identified. This calculation resulted in a value which indicated that more analytical cognition was most effective. The cognitive continuum index score evaluated the participants’s cognition level while making judgments. The relationships between these measures and achievement were evaluated. Results indicated that more analytical cognition was associated with lower rates of phishing victimization. This work provides a deeper insight into the phishing problem and has implications for combating phishing.

Using stage theorizing to make anti-phishing recommendations more effective

PurposeThis paper aims to review the behavioral phishing literature to understand why anti-phishing recommendations are not very effective and to propose ways of making the recommendations more effective. The paper also examines how the concept of stages from health communication and psychology can be used to make recommendations against phishing more effective.Design/methodology/approachThis literature review study focused on the behavioral phishing literature that has relied on human subjects. Studies were excluded for reasons that included lacking practical recommendations and human subjects.FindingsThe study finds that phishing research does not consider where victims are residing in qualitatively different stages. Consequently, the recommendations do not often match the specific needs of different victims. This study proposes a prototype for developing stage theories of phishing victims and identifies three stages of phishing victims from analyzing the previous phishing research.Research limitations/implicationsThis study relied on published research on phishing victims. Future research can overcome this problem by interviewing phishing victims. Further, the authors’ recommendation that phishing researchers categorize phishing victims into stages and develop targeted messages is not based on direct empirical evidence. Nonetheless, evidence from cancer research and health psychology suggests that targeted messaging is efficacious and cost-effective. Thus, the impact of targeted messaging in phishing could be quite large.Practical implicationsThe study recommends categorizing individuals into stages, based on their security knowledge and online behaviors, and other similar characteristics they may possess. A stage approach will consider that individuals who at one time clicked on a phishing link because they lacked the requisite security knowledge, after receiving security training, may click on a link because they are overconfident.Originality/valueThe paper explains why proposing anti-phishing recommendations, based on a “one-size fits all” approach has not been very effective (e.g. because it simplifies why people engage in different behaviors). The proposals introduce a new approach to designing and deploying anti-phishing recommendations based on the concept of stages.

Capable Guardians in the Digital Environment: The Role of Digital Literacy in Reducing Phishing Victimization

ABSTRACTIn this study, we use Routine Activities Theory to explore the role of digital literacy, a measure of guardianship, in the receipt of and response to phishing. Data for the study come from a nationally representative survey conducted by the American Association of Retired Persons. The analysis results in two conclusions. First, respondents with higher levels of digital literacy report receiving phishing e-mails more often, but report responding to them less. Second, the social position of a respondent matters, but largely for the receipt of phishing. These findings indicate that digital literacy significantly effects the receipt of and response to phishing.

Phishing and Malware Attacks on Online Banking Customers in the Netherlands: A Qualitative Analysis of Factors Leading to Victimization

IntroductionThis paper describes an in-depth analysis into the behaviour and characteristics of bank customers leading to victimization caused by phishing and malware attacks, the most common crimes involving online banking fraud in the Netherlands (NVB, 2013). Phishing is scalable act of deception whereby impersonation is used to obtain information from a (Lastdrager 2014, 8). Malware is the infection of a computer by malicious software, which includes viruses, worms, Trojan horses and spyware. In both cases, the aim of the fraudsters is to deceive the customer or the system used for online banking in order to obtain user credentials and/or to gain control over customers' devices. Fraudster use user credentials to access a victim's online bank account and to validate money transfers on behalf of the victim. Phishing and malware scams, however, are significant across the world and go beyond the online banking context. The Anti-Phishing Working Group reported in their Phishing Activities Trends Report of Q4 2014 that nearly 200,000 unique phishing reports were submitted to them and that an average of 255,000 new malware threats (including variants) emerged each day (APWG, 2015).A number of recent studies try to shed light on how and why people fall victim to these crimes and others do not (Bossler & Holt, 2009; Ngo & Paternoster, 2011; Vishwanath, Herath, Chen, Wang, & Rao, 2011). Jansen and Leukfeldt (2015), for example, carried out an exploratory study into how customers become victims of online banking fraud and demonstrate that customers have a specific role in their own victimization. Customers provide fraudsters with information, such as credentials, which fraudsters can use to steal money from their bank accounts. A study into phishing victimization shows that everybody is at risk when it comes to this type of crime (Leukfeldt, 2014). Additionally, Leukfeldt (2015) claims that this also largely holds for malware victimization; merely spending more time online, carrying out various kinds of activities, increased the risk of a malware infection.Both of Leukfeldt's studies (2014, 2015) - which are based on an online survey - conclude that in-depth studies are necessary to increase knowledge about why customers are victimized. It is not sufficiently clear if certain individuals are more prone to being at risk for online banking fraud than others, and how it can be explained. Therefore, this study qualitatively explores, by means of interviews, what factors explain online banking fraud victimization. Crossler et al. (2013) mention, that, the interview is a valuable method to better understand the actual motivations and behaviour of individuals.Theoretical backgroundFor this study, two theoretical perspectives are in place. First, we take a routine activity approach (Cohen & Felson, 1979) to study victim characteristics and behaviours that influence victimization. This approach is also central to the studies of Leukfeldt (2014, 2015) making it possible to assess whether our qualitative study has added value to the quantitative studies in this context. The routine activity approach holds that victimization is influenced by a combination of a motivated offender, a suitable target and the absence of a capable guardian in a convergence of time and space. We study the two latter aspects of routine activity approach, namely the suitability of targets and the capability of their guardians. Guardians can, for example, be technical security measures such as anti-virus software.Over time, elements regarding suitability have been added to the routine activity approach. Two acronyms that often emerge are CRAVED, which stands for concealable, removable, available, valuable, enjoyable and disposable and VIVA, which stands for value, inertia, visibility and accessibility. Sutton (2009) compared the two acronyms and concluded that they deal with identical attributes. Furthermore, he argues that VIVA elements relate to characteristics that attract attention, while the additional elements of CRAVED are related to characteristics that make an object attractive for criminals. …

Time Up for Phishing with Effective Anti-Phishing Research Strategies

Public awareness is a significant factor in the battle against online identity theft (phishing). Advancing public readiness can be a strategic protection mechanism for citizens' vulnerability and privacy. Further, an effective research strategy against phishing is the combination of increased social awareness with software quality and social computing. The latter will decrease phishing victims and will improve information systems quality. First, the authors discuss recent research results on software quality criteria used for the design of anti-phishing technologies. Second, it is argued that the dynamics of social surroundings affect citizens' trust and can compromise social security. Third, the authors outline basic research needs and strategic steps to be taken for timely citizens' protection. Last, the authors propose strategic research directions for improving information systems total quality management through international collaborative research and by focusing on: i) increasing social awareness; ii) predicting information phishing attempts; iii) adopting social computing approaches.

Phishing for suitable targets in the Netherlands: routine activity theory and phishing victimization.

This article investigates phishing victims, especially the increased or decreased risk of victimization, using data from a cybercrime victim survey in the Netherlands (n=10,316). Routine activity theory provides the theoretical perspective. According to routine activity theory, several factors influence the risk of victimization. A multivariate analysis was conducted to assess which factors actually lead to increased risk of victimization. The model included background and financial data of victims, their Internet activities, and the degree to which they were "digitally accessible" to an offender. The analysis showed that personal background and financial characteristics play no role in phishing victimization. Among eight Internet activities, only "targeted browsing" led to increased risk. As for accessibility, using popular operating systems and web browsers does not lead to greater risk, while having up-to-date antivirus software as a technically capable guardian has no effect. The analysis showed no one, clearly defined group has an increased chance of becoming a victim. Target hardening may help, but opportunities for prevention campaigns aimed at a specific target group or dangerous online activities are limited. Therefore, situational crime prevention will have to come from a different angle. Banks could play the role of capable guardian.

Investigating phishing victimization with the Heuristic–Systematic Model: A theoretical framework and an exploration

To the extent that phishing has become a serious threat to information security, there has been rather limited theory-grounded research on this burgeoning phenomenon. In this paper, we develop a theoretical model of victimization by phishing based on the Heuristic–Systematic Model of information processing. We argue that the Heuristic–Systematic Model offers an ideal theoretical framework for investigating the psychological mechanism underlying the effectiveness of phishing attacks. An exploratory experiment is presented to validate the research model based on the theory.