Decision strategies and susceptibility to phishing
Open accessAbstract
Phishing emails are semantic attacks that con people into divulging sensitive information using techniques to make the user believe that information is being requested by a legitimate source. In order to develop tools that will be effective in combating these schemes, we first must know how and why people fall for them. This study reports preliminary analysis of interviews with 20 non-expert computer users to reveal their strategies and understand their decisions when encountering possibly suspicious emails. One of the reasons that people may be vulnerable to phishing schemes is that awareness of the risks is not linked to perceived vulnerability or to useful strategies in identifying phishing emails. Rather, our data suggest that people can manage the risks that they are most familiar with, but don't appear to extrapolate to be wary of unfamiliar risks. We explore several strategies that people use, with varying degrees of success, in evaluating emails and in making sense of warnings offered by browsers attempting to help users navigate the web.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Scams are far less likely to be successful if individuals have heard about them prior to being targeted.
“Scams are far less likely to be successful if individuals have heard about them prior to being targeted 9 .”
From The Online Romance Scam: A Serious Cybercrime (2012) · cites this paper as [9]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
No references could be resolved yet.
Research works printed but not linked: 11
- Jagatic, T., Johnson, N., Jakobsson, M., Menczer, F. Social Phishing. Commun. ACM. To appear. http://www.indiana.edu/ ~phishing/social-network-experiment/phishing-preprint.pdf
- Miller, R. and Wu, M. 2005. Fighting Phishing at the User Interface. In L. Cranor and S. Garfinkel, eds., Usable Security. O'Reilly 2005.
- Chou, N., Ledesma, R., Teraguchi, Y., and Mitchell, J.C. 2004. Client-Side Defense Against Web-Based Identity Theft. 11th Annual Network and Distributed System Security Symposium (NDSS '04), San Diego, CA. http://www.isoc.org/isoc/ conferences/ndss/04/proceedings/Papers/Chou.pdf
- Ye, Z., Smith, S., and Anthony, D. 2005. Trusted paths for browsers. ACM Trans. Inf. Syst. Secur. 8, 2 (May. 2005), 153-186. DOI= http://doi.acm.org/10.1145/1065545.1065546 · DOI
- Dhamija, R. and Tygar, J. D. 2005. The battle against phishing: Dynamic Security Skins. In Proceedings of the 2005 Symposium on Usable Privacy and Security (Pittsburgh, PA, July 06 -08, 2005). SOUPS '05, vol. 93. ACM Press, New York, NY, 77-88. DOI= http://doi.acm.org/10.1145/ 1073001.1073009 · DOI
- Wu, M., Miller, R.C., and Garfinkel, S.L. Do security toolbars actually prevent phishing attacks? In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (Montreal, Quebec, Canada, April 22 -28, 2006). CHI '06.
- Friedman, B., Hurley, D., Howe, D., Felten, E., Nissenbaum, H. 2002. Users' conceptions of web security: a comparative study. In CHI '02 extended abstracts on Human factors in computing systems, Minneapolis, Minnesota, 746-747.
- Dhamija, R., Tygar, J.D., and Hearst, M. 2006. Why phishing works. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (Montreal, Quebec, Canada, April 22 -28, 2006). CHI '06.
- Johnson-Laird, P. N. (1983). Mental Models. Cambridge, MA: Harvard University Press.
- Rouse, W. B., & Morris, N. M. (1986). On looking into the black box: Prospects and limits in the search for mental models. Psychological Bulletin, 100, 349-63.
- Morgan, M. G., Fischhoff, B., Bostrom, A., & Atman, C. (2001). Risk communication: The mental models approach. New York: Cambridge University Press.
Cited by
Sorted by citations
The Online Romance Scam: A Serious Cybercrime
Whitty, M. T., & Buchanan, T. (2012) · Cyberpsychology, Behavior, and Social Networking · doi:10.1089/cyber.2011.0352 · Cited by 198 · see citing works
“Scams are far less likely to be successful if individuals have heard about them prior to being targeted.(9) To date, SOCA and Action Fraud have been targeting the following media to inform the public: television, newspapers, magazines, online dating sites, and the Internet.”
BackgroundHuman Cognition Through the Lens of Social Engineering Cyberattacks
Montañez, R., Golob, E., & Xu, S. (2020) · Frontiers in Psychology · doi:10.3389/fpsyg.2020.01755 · Cited by 106 · see citing works
QRishing: The Susceptibility of Smartphone Users to QR Code Phishing Attacks
Vidas, T., Owusu, E., Wang, S., Zeng, C., Cranor, L. F., & Christin, N. (2013) · Lecture Notes in Computer Science · doi:10.1007/978-3-642-41320-9_4 · Cited by 103 · see citing works
Self-citationUnderstanding cybercrime in ‘real world’ policing and law enforcement
Curtis, J., & Oxburgh, G. (2023) · The Police Journal: Theory, Practice and Principles · doi:10.1177/0032258x221107584 · Cited by 72 · see citing works
“Even when individuals had an awareness of security cues on websites (e.g. broken images or unusual URLs), this often failed to translate into caution (Downs et al., 2006).”
BackgroundAPOLLO: A GPT-based tool to detect phishing emails and generate explanations that warn users
Desolda, G., Greco, F., & Vigano, L. (2025) · Proceedings of the ACM on Human-Computer Interaction · doi:10.1145/3733049 · Cited by 16 · see citing works
- Authors
- Downs, J. S., Holbrook, M. B., & Cranor, L. F.
- Affiliations
- Carnegie Mellon University (US)
- Venue
- Proceedings of the second symposium on Usable privacy and security - SOUPS '06
- Publisher
- ACM Press
- Published
- 2006
- Pages
- 79
- OpenAlex
- W2029827226
- Cited by
- 352
- References
- 0
- Citations by year
- 2026: 12 · 2025: 14 · 2024: 7 · 2023: 24 · 2022: 21 · 2021: 18 · 2020: 14 · 2019: 29 · 2018: 24 · 2017: 18 · 2016: 18 · 2015: 16 · 2014: 16 · 2013: 17 · 2012: 21
- Type
- conference abstract
- Language
- en
- Open access
- green
- figshare.com
- Locations
- Symposium On Usable Privacy and Security (publishedVersion)
- Figshare (submittedVersion, cc-by)
- KiltHub Repository (submittedVersion)
- KiltHub Repository
- Funders
- National Science Foundation (0524189)
- Deutscher Akademischer Austauschdienst
- Army Research Office (DAAD-19-02-1-0389)
- Topics
- Physical Sciences › Computer Science › Information Systems › Spam and Phishing Detection
- Physical Sciences › Computer Science › Information Systems › User Authentication and Security Systems
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Keywords
- phishing, phishing email detection, decision strategies, risk perception, perceived susceptibility, risk awareness
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
