Abstract:Cyber attacks such as phishing, IRS scams, etc., still are successful in fooling Internet users. Users are the last line of defense against these attacks since attackers seem to always find a way to bypass security systems. Understanding users' reason about the scams and frauds can help security providers to improve users security hygiene practices. In this work, we study the users' reasoning and the effectiveness of several variables within the context of the company representative fraud. Some of the variables that we study are: 1) the effect of using LinkedIn as a medium for delivering the phishing message instead of using email, 2) the effectiveness of natural language generation techniques in generating phishing emails, and 3) how some simple customizations, e.g., adding sender's contact info to the email, affect participants perception. The results obtained from the within-subject study show that participants are not prepared even for a well-known attack - company representative fraud. Findings include: approximately 65% mean detection rate and insights into how the success rate changes with the facade and correspondent (sender/receiver) information. A significant finding is that a smaller set of well-chosen strategies is better than a large `mess' of strategies. We also find significant differences in how males and females approach the same company representative fraud. Insights from our work could help defenders in developing better strategies to evaluate their defenses and in devising better training strategies.

The Benefit of Warning to Improve Detecting Social Engineering Attack Messages

Can Warnings Curb the Spread of Fake News? the Interplay Between Warning, Trust and Confirmation Bias

Adapting Security Warnings to Counter Online Disinformation

The Effect of Signal Icon and Persuasion Strategy on Warning Design in Online Fraud

WARNING This Contains Misinformation: The Effect of Cognitive Factors, Beliefs, and Personality on Misinformation Warning Tag Attitudes

A Key Point in Scam Compliance and Warning Compliance in Real Life

Mental States: A Key Point in Scam Compliance and Warning Compliance in Real Life

Understanding and Deciphering of Social Engineering Attack Scenarios.

Less is More: Exploiting Social Trust to Increase the Effectiveness of a Deception Attack

Milling and Public Warnings

"It is Luring You to Click on the Link With False Advertising" - Mental Models of Clickbait and Its Impact on User's Perceptions and Behavior Towards Clickbait Warnings

Contemplating social engineering studies and attack scenarios: A review study.

Internet-based Social Engineering Attacks, Defenses and Psychology: A Survey

Design Elements that Promote the use of Fake Website Detection Tools

Alerting consciences to reduce cybercrime: a quasi-experimental design using warning banners

Deception Strategies and Threats for Online Discussions

Breaching the Human Firewall: Social engineering in Phishing and Spear-Phishing Emails

"Should I Worry?" A Cross-Cultural Examination of Account Security Incident Response

Meaningful Context, a Red Flag, or Both? Users' Preferences for Enhanced Misinformation Warnings on Twitter

The effectiveness of warning statements in reducing careless responding in crowdsourced online surveys

Counteracting Social Engineering Attacks