An empirical study on the susceptibility to social engineering in social networking sites: the case of Facebook

Abstract

Research suggests that social engineering attacks pose a significant security risk, with social networking sites (SNSs) being the most common source of these attacks. Recent studies showed that social engineers could succeed even among those organizations that identify themselves as being aware of social engineering techniques. Although organizations recognize the serious risks of social engineering, there is little understanding and control of such threats. This may be partly due to the complexity of human behaviors in failing to recognize attackers in SNSs. Due to the vital role that impersonation plays in influencing users to fall victim to social engineering deception, this paper aims to investigate the impact of source characteristics on users’ susceptibility to social engineering victimization on Facebook. In doing so, we identify source credibility dimensions in terms of social engineering on Facebook, Facebook-based source characteristics that influence users to judge an attacker as per these dimensions, and mediation effects that these dimensions play between Facebook-based source characteristics and susceptibility to social engineering victimization.

Keywords:

• social engineering
• deception
• impersonation
• source credibility
• phishing
• Facebook

Special Issue Editors: Paul Benjamin Lowry, Tamara Dinev, Robert Willison.

Special Issue Editors: Paul Benjamin Lowry, Tamara Dinev, Robert Willison.

Additional information

Notes on contributors

Abdullah Algarni

Abdullah Algarni is an Assistant Professor in the division of information technology, Institute of Public Administration, Saudi Arabia. He was previously with Queensland University of Technology, Australia. He received his PhD in Computer Science from Queensland University of Technology, Australia, Master degree in Computer Science from Western Michigan University, USA, and Bachelor degree in Computer Science from King Abdulaziz University, Saudi Arabia. His current research interests are mainly in the area of social engineering, phishing, deception, and information security management.

Yue Xu

Yue Xu is an Associate Professor in the School of Electrical Engineering and Computer Science, Queensland University of Technology, Brisbane, QLD, Australia. She has worked in the areas of data mining and web intelligence for many years. Her current research interests are focused on user modeling in social media and recommender systems. She has published over 150 refereed papers covering research areas of pattern mining, recommender systems, trust and reputation management, and user profiling in social media. She has published in Journals such as IEEE Transactions on Knowledge and Data Engineering, ACM Transactions on Intelligent Systems and Technology, Data & Knowledge Engineering, Decision Support Systems, and international conferences such as WWW, ICDM, CIKM, ICIS, PACIS.

Taizan Chan

Taizan Chan is senior lecturer and academic director (teaching and learning) at the Information Systems School, Science and Engineering Faculty at QUT. He has published in international journals such as IEEE transactions and Journal of the Association of Information Systems, and conferences such as the International Conference on Information Systems in the areas pertaining to organizational and user behavior related to information systems. His current research focuses on organizational behavior and technology design for big data.