Email phishing and signal detection: How persuasion principles and personality influence response patterns and accuracy

摘要

Phishing is a social engineering tactic where a malicious actor impersonates a trustworthy third party with the intention of tricking the user into divulging sensitive information. Previous social engineering research in a real-world setting has shown an interaction between the personality of the target and the persuasion principle used. This study investigated whether this interaction is present in the realm of email phishing. Additionally, a signal detection theory framework was used to evaluate how the various persuasion principles influence accuracy, sensitivity (d'), and response criterion placement. A personality inventory and an email identification task (phishing or legitimate) were used. These data support previous findings that high extroversion is predictive of increased susceptibility to phishing attacks. The various persuasions principles elicited diverse response criterions and sensitivities, though all investigated persuasion principles resulted in a liberal decision criterion, except one. These findings are interpreted and discussed.