Why People Still Fall for Phishing Emails
fliptop writes:
Despite technical and non-technical countermeasures, humans continue to be tricked by phishing emails. How users make email response decisions is a missing piece in the puzzle to identifying why people still fall for phishing emails. We conducted an empirical study using a think-aloud method to investigate how people make 'response decisions' while reading emails. The grounded theory analysis of the in-depth qualitative data has enabled us to identify different elements of email users' decision-making that influence their email response decisions. Furthermore, we developed a theoretical model that explains how people could be driven to respond to emails based on the identified elements of users' email decision-making processes and the relationships uncovered from the data. The findings provide deeper insights into phishing email susceptibility due to people'semail response decision-making behavior. We also discuss the implications of our findings for designers and researchers working in anti-phishing training, education, and awareness interventions.
The conclusion:
In this paper, we investigate in-depth how people make email response decisions while reading their emails. Analysis of the collected qualitative data enabled us to develop a theoretical model that describes how people can be driven to respond to emails by clicking on email links and replying to or downloading attachments based on people's email response decision-making elements and their relationships. Based on an improved understanding of how people make email responses, this study enables us to identify how people can be susceptible to manipulation, even in our controlled experiment environment. We proposed five concrete enhancements to state-of-the-art anti-phishing education, training, and awareness tools to support users in making safe email responses. Among others, we suggest that the goal of anti-phishing education, training, and awareness tools should shift from accurate email legitimacy judgments to secure email responses. Therefore, we believe our work lays the foundation for improving future anti-phishing interventions to make a significant difference in how we prevent phishing email attacks in the future.
Journal Reference: Why People Still Fall for Phishing Emails: An Empirical Investigation into How Users Make Email Response Decisions, Asangi Jayatilaka, Nalin Asanka Gamagedara Arachchilage, Muhammad Ali Babar - https://arxiv.org/pdf/2401.13199.pdf
Read more of this story at SoylentNews.