Predicting susceptibility to social influence in phishing emails. Issue 128 (August 2019)

• Record Type: Journal Article
• Authors: Parsons, Kathryn; Butavicius, Marcus; Delfabbro, Paul; Lillie, Meredith
• Is Part Of: International journal of human-computer studies. Issue 128(2019)
• Page Start: 17
• Page End: 26
• Publication Date: 2019-08
• Subjects: Influence principles -- Phishing -- Cybersecurity -- Dual-process models; Human-machine systems -- Periodicals; Systems engineering -- Periodicals; Human engineering -- Periodicals; Human engineering; Human-machine systems; Systems engineering; Periodicals; Electronic journals; 004.019
• DOI: 10.1016/j.ijhcs.2019.02.007
• Languages: English
• ISSNs: 1071-5819

Abstract

Highlights: A total of 985 participants completed a role play scenario-based phishing study. The presence of social influence principles influenced phishing susceptibility. Phishing emails using consistency and reciprocity were most successful. Phishing emails using scarcity and social proof were least successful. Individual susceptibility to persuasion could predict susceptibility to phishing. Abstract: To reduce the threat caused by phishing attacks, it is vital to investigate why some phishing attacks are successful, and why some people are more susceptible to them than others. To examine this, we used a social influence framework, and applied the Susceptibility to Persuasion Strategies scale within a dual-process model of persuasion framework. A total of 985 participants took part in a role-play scenario-based phishing study. Results indicated that phishing emails utilising scarcity and social proof principles were least successful, whereas those applying consistency and reciprocity principles were most successful. The same principles were also considered least and most persuasive according to the Susceptibility to Persuasion Strategies scale. For the majority of principles, participants who were susceptible to a specific principle were significantly more susceptible to emails containing that principle. Further results revealed that age; the percentage of time spent using a computer; susceptibility to the social proof principle; and, both dispositional and situational impulsivity, were significant predictors in people's ability to detect phishing emails. Practical implications of these findings as well as future directions are discussed.