Research Note—Influence Techniques in Phishing Attacks: An Examination of Vulnerability and Resistance

Ryan T. Wright; Matthew L. Jensen; Jason Bennett Thatcher; Michael Dinger; Kent Marett

doi:10.1287/isre.2014.0522

Research Note—Influence Techniques in Phishing Attacks: An Examination of Vulnerability and Resistance

Ryan T. Wright¹; Matthew L. Jensen²; Jason Bennett Thatcher³; Michael Dinger⁴; Kent Marett⁵

¹ Isenberg School of Management, University of Massachusetts, Amherst, Massachusetts 01003; · ² Division of MIS, Center for Applied Social Research, University of Oklahoma, Norman, Oklahoma 73019 · ³ Social Analytics Institute, Department of Management, Clemson University, Clemson, South Carolina 29634 · ⁴ Johnson College of Business and Economics, University of South Carolina Upstate, Spartanburg, South Carolina 29306 · ⁵ Department of Management and Information Systems, College of Business, Mississippi State University, Mississippi State, Mississippi 39762

Information Systems Research 2014

Phishing is a major threat to individuals and organizations. Along with billions of dollars lost annually, phishing attacks have led to significant data breaches, loss of corporate secrets, and espionage. Despite the significant threat, potential phishing targets have little theoretical or practical guidance on which phishing tactics are most dangerous and require heightened caution. The current study extends persuasion and motivation theory to postulate why certain influence techniques are especially dangerous when used in phishing attacks. We evaluated our hypotheses using a large field experiment that involved sending phishing messages to more than 2,600 participants. Results indicated a disparity in levels of danger presented by different influence techniques used in phishing attacks. Specifically, participants were less vulnerable to phishing influence techniques that relied on fictitious prior shared experience and were more vulnerable to techniques offering a high level of self-determination. By extending persuasion and motivation theory to explain the relative efficacy of phishers' influence techniques, this work clarifies significant vulnerabilities and lays the foundation for individuals and organizations to combat phishing through awareness and training efforts.

DOI: 10.1287/isre.2014.0522
Volume: 25 (2)
Pages: 385-400
Language: en
Export: BibTeX
Sources: crossref