Abstract:Research problem: Phishing is an email-based scam where a perpetrator camouflages emails to appear as a legitimate request for personal and sensitive information. Research question: How do individuals process a phishing email, and determine whether to respond to it? Specifically, this study examines how users' attention to “visual triggers” and “phishing deception indicators” influence their decision-making processes and consequently their decisions. Literature review: This paper draws upon the theory of deception and the literature on mediated cognition and learning, including the critical role of attention and elaboration in deception detection. From this literature, we developed a research model to suggest that overall cognitive effort expended in email processing decreases with attention to visual triggers and phishing deception indicators. The likelihood to respond to phishing emails increases with attention to visceral cues, but decreases with attention to phishing deception indicators and cognitive effort. Knowledge of email-based scams increases attention to phishing deception indicators, and directly decreases response likelihood. It also moderates the impact of attention to visceral triggers and that of phishing deception indicators on likelihood to respond. Methodology: Using a real phishing email as a stimulus, a survey of 321 members of a public university community in the Northeast US, who were intended victims of a spear phishing attack that took place, was conducted. The survey used validated measures developed in prior literature for the most part and tested results using the partial least-squares regression. Results and discussion: Our research model and hypotheses were supported by the data except that we did not find that cognitive effort significantly affects response likelihood. The implication of the study is that attention to visceral triggers, attention to phishing deception indicators, and phishing knowledge play critical roles in phishing detection. The limitations of the study were that the data were drawn from students, and the study explored one phishing attack, relied on some single-item measures, cognitive effort measure, and a one-round survey. Future research would examine the impact of a varying degree of urgency and a varying level of phishing deception indicators, and actual victims of phishing attacks.

How Persuasive is a Phishing Email? A Phishing Game for Phishing Awareness

What Goes Wrong During Phishing Education? A Probe into a Game-Based Assessment with Unfavorable Results

Can serious gaming tactics bolster spear-phishing and phishing resilience? : Securing the human hacking in Information Security

Phish Phinder: A Game Design Approach to Enhance User Confidence in Mitigating Phishing Attacks

User-Centred Security Education: A Game Design to Thwart Phishing Attacks

Re-evaluation of PhishI Game and Its Utilisation in Eliciting Security Requirements

Serious Games for Cyber Security Education

Can a Mobile Game Teach Computer Users to Thwart Phishing Attacks?

Integrating self-efficacy into a gamified approach to thwart phishing attacks

Engaging Users with Educational Games: The Case of Phishing

Designing a Mobile Game for Home Computer Users to Protect Against Phishing Attacks

Securix: a 3D game-based learning approach for phishing attack awareness

Designing a mobile game to thwarts malicious IT threats: A phishing threat avoidance perspective

Building Confidence not to be Phished through a Gamified Approach: Conceptualising User's Self-Efficacy in Phishing Threat Avoidance Behaviour

What Should Abeeha Do? an Activity for Phishing Awareness

Persuasion and Phishing: Analysing the Interplay of Persuasion Tactics in Cyber Threats

A Survey on the Principles of Persuasion as a Social Engineering Strategy in Phishing

Research Article Phishing Susceptibility: an Investigation into the Processing of a Targeted Spear Phishing Email

Exploring and Evaluating Different Game Mechanics for Anti-Phishing Learning Games

Breaching the Human Firewall: Social engineering in Phishing and Spear-Phishing Emails

A Game Theoretical Model for Anticipating Email Spear-Phishing Strategies