The DOI matches its Crossref record; 1 of the 1 references it cites were found in a registry or an index.
Falling and failing (to learn): Evidence from a nation-wide cybersecurity field experiment with SMEs
Open accessAbstract
Prior experiences are crucial in shaping risk prevention behavior. Previous studies have shown that experiencing a simulated phishing attack (a “phishing drill”) reduces the likelihood of clicking on unsafe links and disclosing one’s password. In a large field experiment involving 670 small and medium-sized enterprises (SMEs) and their 33,000 employees, we examined the impact of experience on individuals’ ability to detect cyber-security threats, and whether this effect persisted over several months. We collected data at both the company and individual levels, including risk preference, time preference, and trust. Our findings indicate only a non-systematic, short-term effect of previous phishing emails on clicking behavior. A cluster of individuals with greater patience, trust, and risk seeking was more likely to click on phishing links in the first place but then also more likely to benefit from phishing drills. • A field experiment with 670 SMEs and 33,000 employees tests phishing drills. • Phishing drills reduce click rates only in the short-term and not systematically. • Patience, trust, and risk tolerance are linked to higher phishing click rates. • Individuals with these traits improve more after phishing drills.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Methods Matter: p-Hacking and Publication Bias in Causal Analysis in Economics
Brodeur, A., Cook, N., & Heyes, A. (2020) · American Economic Review · doi:10.1257/aer.20190687 · Cited by 333
Research works printed but not linked: 36
- Acquisti, 2015, Privacy and human behavior in the age of information, Science, 347, 509, 10.1126/science.aaa1465 · DOI · Paper page
- Acquisti, 2020, Secrets and likes: The drive for privacy and the difficulty of achieving it in the digital age, J. Consum. Psychol., 30, 736, 10.1002/jcpy.1191 · DOI
- Acquisti, 2013, What is privacy worth?, J. Legal Stud., 42, 249, 10.1086/671754 · DOI
- Acquisti, 2016, The economics of privacy, J. Econ. Lit., 54, 442, 10.1257/jel.54.2.442 · DOI · Paper page
- Ankel-Peters, 2023, Do economists replicate?, J. Econ. Behav. Organ., 212, 219, 10.1016/j.jebo.2023.05.009 · DOI
- Arduin, 2023, A cognitive approach to the decision to trust or distrust phishing emails, Int. Trans. Oper. Res., 30, 1263, 10.1111/itor.12963 · DOI
- Asghari, 2016, Chapter 13: Economics of cybersecurity, 262
- Avdeenko, 2019, Linking savings behavior, confidence and individual feedback: A field experiment in Ethiopia, J. Econ. Behav. Organ., 167, 122, 10.1016/j.jebo.2019.09.024 · DOI
- Baillon, 2019, Informing, simulating experience, or both: A field experiment on phishing risks, PLOS ONE, 14, 10.1371/journal.pone.0224216 · DOI
- Benjamin, 2018, Redefine statistical significance, Nat. Hum. Behav., 2, 6, 10.1038/s41562-017-0189-z · DOI · Paper page
- Biener, 2020, Balancing the desire for privacy against the desire to hedge risk, J. Econ. Behav. Organ., 180, 608, 10.1016/j.jebo.2020.03.007 · DOI
- Cai, 2017, Do disaster experience and knowledge affect insurance take-up decisions?, J. Dev. Econ., 124, 83, 10.1016/j.jdeveco.2016.08.007 · DOI
- Chen, 2017, Securing online privacy: An empirical test on internet scam victimization, online privacy concerns, and privacy protection behaviors, Comput. Hum. Behav., 70, 291, 10.1016/j.chb.2017.01.003 · DOI
- Chew, 2020, Motivated false memory, J. Polit. Econ., 128, 3913, 10.1086/709971 · DOI
- Curtis, 2018, Phishing attempts among the dark triad: Patterns of attack and vulnerability, Comput. Hum. Behav., 87, 174, 10.1016/j.chb.2018.05.037 · DOI
- Dean, 2019, The empirical relationship between nonstandard economic behaviors, Proc. Natl. Acad. Sci., 116, 16262, 10.1073/pnas.1821353116 · DOI · Paper page
- Dohmen, 2011, Individual risk attitudes: Measurement, determinants, and behavioral consequences, J. Eur. Econom. Assoc., 9, 522, 10.1111/j.1542-4774.2011.01015.x · DOI
- Falk, 2018, Global evidence on economic preferences, Q. J. Econ., 133, 1645, 10.1093/qje/qjy013 · DOI · Paper page
- Falk, 2023, The preference survey module: a validated instrument for measuring risk, time, and social preferences, Management Science, 69, 1935, 10.1287/mnsc.2022.4455 · DOI
- Goel, 2017, Got phished? Internet security and human vulnerability, J. Assoc. Inf. Syst., 18, 2
- Goette, 2020, Does positive feedback of social impact motivate prosocial behavior? A field experiment with blood donors, J. Econ. Behav. Organ., 175, 1, 10.1016/j.jebo.2020.04.014 · DOI
- Goldfarb, 2023, The economics of digital privacy, Annu. Rev. Econ., 15, 10.1146/annurev-economics-082322-014346 · DOI
- Gordon, 2019, Assessment of employee susceptibility to phishing attacks at US health care institutions, JAMA Network Open, 2, 10.1001/jamanetworkopen.2019.0393 · DOI
- Harrison, 2016, Individual processing of phishing emails: How attention and elaboration protect against phishing, Online Inf. Rev., 40, 265, 10.1108/OIR-04-2015-0106 · DOI
- Hong, 2013, Keeping up with the joneses: Assessing phishing susceptibility in an email task, Proc. Hum. Factors Ergon. Soc. Ann. Meeting, 57, 1012, 10.1177/1541931213571226 · DOI
- Jalali, 2020, Why employees (still) click on phishing links: Investigation in hospitals, J. Med. Int. Res., 22
- Lawson, 2020, Email phishing and signal detection: How persuasion principles and personality influence response patterns and accuracy, Appl. Ergon., 86, 10.1016/j.apergo.2020.103084 · DOI
- Lee, 2024, Revealed privacy preferences: are privacy choices rational?, Management Science, 10.1287/mnsc.2022.00807 · DOI
- Moore, 2009, The economics of online crime, J. Econ. Perspect., 23, 3, 10.1257/jep.23.3.3 · DOI
- Schudy, 2017, ’You must not know about me’—On the willingness to share personal data, J. Econ. Behav. Organ., 141, 1, 10.1016/j.jebo.2017.05.023 · DOI
- Shai, 2022, Out of time? The effect of an infrequent traumatic event on individuals’ time and risk preferences, beliefs, and insurance purchasing, J. Health Econ., 86, 10.1016/j.jhealeco.2022.102678 · DOI
- Tomaino, 2023, Intransitivity of consumer preferences for privacy, J. Mar. Res., 60, 489, 10.1177/00222437221122994 · DOI
- Tran, 2012, Rank as an inherent incentive: Evidence from a field experiment, J. Public Econ., 96, 645, 10.1016/j.jpubeco.2012.05.004 · DOI
- Vishwanath, 2018, Suspicion, cognition, and automaticity model of phishing susceptibility, Commun. Res., 45, 1146, 10.1177/0093650215627483 · DOI
- Winegar, 2019, How much is data privacy worth? A preliminary investigation, J. Consum. Policy, 42, 425, 10.1007/s10603-019-09419-y · DOI
- Wright, 2014, Research note Influence techniques in phishing attacks: An examination of vulnerability and resistance, Inf. Syst. Res., 25, 385, 10.1287/isre.2014.0522 · DOI
Metadata
- Authors
- Gonzalez-Jimenez, D., Capozza, F., Dirkmaat, T., van de Veer, E., van Druten, A., & Baillon, A.
- Affiliations
- WZB Berlin Social Science Center (DE)
- Ministry of Economic Affairs and Climate Policy (NL)
- Centre National de la Recherche Scientifique (FR)
- Corresponding author
- Baillon, Aurélien
- Venue
- Journal of Economic Behavior & Organization
- Publisher
- Elsevier BV
- Published
- 2025-02
- Volume
- 230
- Issue
- 230
- Pages
- 106868
- ISSN
- 0167-2681 (ISSN-L)
- OpenAlex
- W4406091461
- Cited by
- 1
- References
- 1
- Citations by year
- 2025: 1
- FWCI
- 0.64
- Type
- journal article
- Language
- en
- Open access
- hybrid
- doi.org
- Licence
- Locations
- Journal of Economic Behavior & Organization (publishedVersion, cc-by)
- EUR Research Repository (Erasmus University Rotterdam) (publishedVersion, cc-by)
- HAL (submittedVersion, other-oa)
- RePEc: Research Papers in Economics (submittedVersion)
- Topics
- Physical Sciences › Computer Science › Information Systems › Spam and Phishing Detection
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Social Sciences › Decision Sciences › General Decision Sciences › Decision-Making and Behavioral Economics
- Keywords
- phishing, cybersecurity behavior, small and medium-sized enterprises, experiential learning, risk preferences, time preference, trust, risk tolerance, password disclosure, email security, field experiments
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
How to cite
Cite CoChat for the checks on this page, and the paper for its own findings.
- This page
- CoChat. (2026). Citation check: Falling and failing (to learn): Evidence from a nation-wide cybersecurity field experiment with SMEs. https://app.cochat.ai/papers/10.1016/j.jebo.2024.106868
- The paper
- Gonzalez-Jimenez, D., Capozza, F., Dirkmaat, T., van de Veer, E., van Druten, A., & Baillon, A. (2025). Falling and failing (to learn): Evidence from a nation-wide cybersecurity field experiment with SMEs. Journal of Economic Behavior & Organization. https://doi.org/10.1016/j.jebo.2024.106868
