1,902
Views
71
CrossRef citations to date
0
Altmetric
Empirical Research

Which phish get caught? An exploratory study of individuals′ susceptibility to phishing

, &
Pages 564-584 | Received 31 Jan 2016, Accepted 14 Jun 2017, Published online: 15 Feb 2018

References

  • AbbasiAZhangZZimbraDChenHNunamakerJFDetecting fake websites: the contribution of statistical learning theoryMIS Quarterly201034343546110.2307/25750686
  • Adler L, Kessler RC and Spencer T (2006) The Value of Screening for Adults with ADHD. Adult ADHD Self-Report Scale (ASES-v1.1) Symptom Checklist.
  • AgarwalRKarahannaETime flies when you’re having fun: cognitive absorption and beliefs about information technology usageMIS Quarterly200024466569410.2307/3250951
  • AikenLSWestSGMultiple Regression: Testing and Interpreting Interactions1991LondonSage Publishing
  • AlbaJWHutchinsonJWKnowledge calibration: what consumers know and what they think they knowJournal of Consumer Research200027112315610.1086/314317
  • Alseadoon I, Chan T, Foo E and Gonzales Nieto J (2012, January) Who is more susceptible to phishing emails?: a Saudi Arabian study. In ACIS 2012: Location, location, location: Proceedings of the 23rd Australasian Conference on Information Systems 2012, pp 1–11, ACIS.
  • AlsharnoubyMAlacaFChiassonSWhy phishing still works: user strategies for combating phishing attacksInternational Journal of Human-Computer Studies201582698210.1016/j.ijhcs.2015.05.005
  • AnandarajanMProfiling web usage in the workplace: a behavior-based artificial intelligence approachJournal of Management Information Systems200219124326610.1080/07421222.2002.11045711
  • AndersonCLAgarwalRPracticing safe computing: a multimedia empirical examination of home computer user security behavioral intentionsMIS Quarterly201034361364310.2307/25750694
  • AndersonBBVanceAKirwanCBJenkinsJLEargleDFrom warning to wallpaper: Why the brain habituates to security warnings and what can be done about itJournal of Management Information Systems201633371374310.1080/07421222.2016.1243947
  • BankerRDKauffmanRJThe evolution of research on information systems: a fiftieth-year survey of the literature in management scienceManagement Science200450328129810.1287/mnsc.1040.0206
  • BerlyneDEConflict, Arousal, and Curiosity1960New York, NYMcGraw-Hill
  • Blythe M, Petrie H and Clark JA (2011, May) F for fake: four studies on how we fall for phish. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, pp 3469–3478, ACM.
  • BossSRGallettaDFLowryPBMoodyGDPolakPWhat do users have to fear? Using fear appeals to engender threats and fear that motivate protective security behaviorsMIS Quarterly201539483786410.25300/MISQ/2015/39.4.5
  • BrancheauJCJanzBDWetherbeJCKey issues in information systems management: 1994–1995 sim delphi resultsMIS Quarterly199620222524210.2307/249479
  • BrockTCLivingstonSDSHRUMLJThe need for entertainment scaleThe Psychology of Entertainment Media: Blurring the Lines Between Entertainment and Persuasion2004Mahwah, New JerseyLawrence Elbaum Associates255274
  • BurgoonJKBurgoonMRobinsonWPGilesHExpectancy theoriesHandbook of Language and Social Psychology2001Sussex, UKWiley79101
  • CarterLBelangerFThe utilization of e-government services: citizen trust, innovation and acceptance factorsInformation Systems Journal200515152510.1111/j.1365-2575.2005.00183.x
  • ChanMWoonIMYKankanhalliAPerceptions of information security at the workplace: linking information security climate to compliant behaviorJournal of Information Privacy and Security200513184110.1080/15536548.2005.10855772
  • ChenRWangJHerathTRaoHRAn investigation of email processing from a risky decision making perspectiveDecision Support Systems2011521738110.1016/j.dss.2011.05.005
  • CheungWChangMKLaiVSPrediction of Internet and World Wide Web usage at work: a test of an extended triandis modelDecision Support Systems20003018310010.1016/S0167-9236(00)00125-1
  • CostaPTMcRaeRRThe NEO PI-R Professional Manual1992Odessa, FloridaPsychological Assessment Resources
  • Cowan BR, Vigentini L and Jack MA (2008) Exploring the relationship between anxiety and usability evaluation: an online study of Internet and wiki anxiety. In Proceedings of IADIS.
  • D’ArcyJHovavADeterring internal information systems misuseCommunications of the ACM2007501011311710.1145/1290958.1290971
  • D’ArcyJHovavAGallettaDFUser awareness of security countermeasures and its impact on information systems misuse: a deterrence approachInformation Systems Research2009231799810.1287/isre.1070.0160
  • DellarocasCWhinstonABReputation mechanismsHandbooks in Information Systems2005Oxford, UKElsevier629660
  • Dhamija R, Tygar JD and Hearst MA (2006) Why phishing works. In Proceedings of CHI, pp 581–590.
  • DimokaAWhat does the brain tell us about trust and distrust? Evidence from a functional neuroimaging studyMIS Quarterly201034237339610.2307/20721433
  • Egelman S, Cranor LF and Hong J (2008) You’ve been warned: an empirical study of the effectiveness of web browser phishing warnings. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, 1065–1074.
  • EverardAGallettaDFHow presentation flaws affect perceived site quality, trust, and intention to purchase from an online storeJournal of Management Information Systems2006223559510.2753/MIS0742-1222220303
  • FarmerRSundbergNDBoredom proneness – the development and correlates of a new scaleJournal of Personality Assessment198650141710.1207/s15327752jpa5001_2
  • Fette I, Sadeh N and Tomasic A (2007) Learning to detect phishing emails. In Proceedings of the 16th International Conference on World Wide Web, pp 649–656.
  • Galletta DF and Polak P (2003) An empirical investigation of antecedents of internet abuse in the workplace. In SIG Workshop on HCI, pp 47–51.
  • Gartner (2007) Gartner survey shows phishing attacks escalated in 2007; more than $3 billion lost to these attacks. http://www.gartner.com/newsroom/id/565125. Accessed 3 June 2017.
  • Gartner (2009) Gartner says number of phishing attacks on U.S. consumers increased 40 percent in 2008. http://www.gartner.com/newsroom/id/936913. Accessed 3 June 2017.
  • GefenDKarahannaEStraubDWInexperience and experience with online stores: the importance of TAM and trustIEEE Transactions on Engineering Management200350330732110.1109/TEM.2003.817277
  • GefenDStraubDWConsumer trust in B2C e-commerce and the importance of social presence: experiments in e-products and e-servicesOmega200432640742410.1016/j.omega.2004.01.006
  • GohKYPingJWEngaging consumers with advergames: an experimental evaluation of the interactivity, fit and expectancyJournal of the Association for Information Systems2014157388421
  • GrazioliSWhere did they go wrong? An analysis of the failure of knowledgeable Internet consumers to detect deception over the InternetGroup Decision and Negotiation200413214917210.1023/B:GRUP.0000021839.04093.5d
  • GrazioliSJarvenpaaSLPerils of internet fraud: an empirical investigation of deception and trust with experienced internet consumersIEEE Transactions on Systems, Man, and Cybernetics-Part A: Systems and Humans200030439541010.1109/3468.852434
  • HackbarthGGroverVMunYYComputer playfulness and anxiety: positive and negative mediators of the system experience effect on perceived ease of useInformation & Management200340322123210.1016/S0378-7206(02)00006-X
  • HairJFRingleCMSarstedtMPLS-SEM: indeed a silver bulletJournal of Marketing Theory and Practice201119213915210.2753/MTP1069-6679190202
  • HartPSaundersCPower and trust: critical factors in the adoption and use of electronic data interchangeOrganization Science199781234210.1287/orsc.8.1.23
  • HerathTRaoHREncouraging information security behaviors in organizations: role of penalties, pressures and perceived effectivenessDecision Support Systems200947215416510.1016/j.dss.2009.02.005
  • HerathTRaoHRProtection motivation and deterrence: a framework for security policy compliance in organisationsEuropean Journal of Information Systems200918110612510.1057/ejis.2009.6
  • HoffmanDLNovakTPPeraltaMBuilding consumer trust onlineCommunications of the ACM1999424808510.1145/299157.299175
  • HoldenSJSVanheuleMKnow the name, forget the exposure: brand familiarity versus memory of exposure contextPsychology and Marketing199916647949610.1002/(SICI)1520-6793(199909)16:6<479::AID-MAR3>3.0.CO;2-Y
  • HwangYKimDJCustomer self-service systems: the effects of perceived Web quality with service contents on enjoyment, anxiety, and e-trustDecision Support Systems200743374676010.1016/j.dss.2006.12.008
  • JagaticTNJohnsonNAJakobssonMMenczerFSocial phishingCommunications of the ACM200750109410010.1145/1290958.1290968
  • JohnstonACWarkentinMFear appeals and information security behaviors: an empirical studyMIS Quarterly201034354956610.2307/25750691
  • JohnstonACWarkentinMSiponenMTAn enhanced fear appeal rhetorical framework: leveraging threats to the human asset through sanctioning rhetoricMIS Quarterly201539111313410.25300/MISQ/2015/39.1.06
  • JoinerRBrosnanMDuffieldJGavinJMarasPThe relationship between internet identification, internet anxiety and internet useComputers in Human Behavior20072331408142010.1016/j.chb.2005.03.002
  • JoinerRet alGender, internet identification, and internet anxiety: correlates of internet useCyberPsychology and Behavior20058437137810.1089/cpb.2005.8.371
  • KankanhalliATeoHHTanBCYWeiKKAn integrative study of information systems security effectivenessInternational Journal of Information Management200323213915410.1016/S0268-4012(02)00105-6
  • Kumaraguru P et al (2009a) School of phish: a real-world evaluation of anti-phishing training. In Symposium on Usable Privacy and Security.
  • KumaraguruPShengSAcquistiACranorLHongJTeaching Johnny not to fall for phishACM Transactions on Internet Technology200910213110.1145/1754393.1754396
  • Leung ACM and Bose I (2008) Indirect financial loss of phishing to global market. In Proceedings of ICIS.
  • LiangHXueYAvoidance of information technology threats: a theoretical perspectiveMIS Quarterly2009331719010.2307/20650279
  • LiangHXueYUnderstanding security behaviors in personal computer usage: a threat avoidance perspectiveJournal of the Association for Information Systems2010117394413
  • LimVKGTeoTSHPrevalence, perceived seriousness, justification and regulation of cyberloafing in Singapore: an exploratory studyInformation & Management20054281081109310.1016/j.im.2004.12.002
  • LitmanJASpielbergerCDMeasuring epistemic curiosity and its diversive and specific componentsJournal of Personality Assessment2003801758610.1207/S15327752JPA8001_16
  • LowryPBVanceAMoodyGBeckmanBReadAExplaining and predicting the impact of branding alliances and web site quality on initial consumer trust of e-commerce web sitesJournal of Management Information Systems200824419922410.2753/MIS0742-1222240408
  • LowryPBMoodyGDProposing the control-reactance compliance model (CRCM) to explain opposing motivations to comply with organisational information security policiesInformation Systems Journal201525543346310.1111/isj.12043
  • LowryPBD’ArcyJHammerBMoodyGD“Cargo Cult” science in traditional organization and information systems survey research: a case for using nontraditional methods of data collection, including Mechanical Turk and online panelsJournal of Strategic Information Systems201625323224010.1016/j.jsis.2016.06.002
  • LowryPBGaskinJTwymanNWHammerBRobertsTLProposing the hedonic-motivation system adoption model (HMSAM) to increase understanding of adoption of hedonically motivated systemsJournal of the Association for Information Systems20131411617671
  • MalhotraNKKimSSAgarwalJInternet users’ information privacy concerns (IUIPC): the construct, the scale, and a causal modelInformation Systems Research200415433635510.1287/isre.1040.0032
  • Mathews L (2017) This gmail phishing attack is fooling even savvy users. Forbes.com, Jan 16. Available at: https://www.forbes.com/sites/leemathews/2017/01/16/gmail-phishing-attack-targets-yourcontacts/#644236eb5435.
  • McElroyJCHendricksonARTownsendAMDemarieSMDispositional factors in Internet use: personality versus cognitive styleMIS Quarterly200731480982010.2307/25148821
  • McKnightDHChouduryVKacmarCDeveloping and validating trust measures for e-commerce: an integrative typologyInformation Systems Research200213333435910.1287/isre.13.3.334.81
  • McKnightDHCummingsLLChervanyNLInitial trust formation in new organizational relationshipsAcademy of Management Review1998233473490
  • MitnickKSimonWLThe Art of Deception: Controlling the Human Element of Security2002New York, New YorkWiley
  • MoodyGDSiponenMUsing the theory of interpersonal behavior to explain non-work-related personal use of the Internet at workInformation & Management201350632233510.1016/j.im.2013.04.005
  • MoodyGDGallettaDFLowryPBWhen trust and distrust collide online: the engenderment and role of consumer ambivalence in online consumer behaviorElectronic Commerce Research and Applications201413426628210.1016/j.elerap.2014.05.001
  • Moody GD, Lowry PB and Galletta DF (2016) It’s complicated: explaining the relationship between trust, distrust, and ambivalence in online transaction relationships using polynomial regression analysis and response surface analysis. European Journal of Information Systems 1–35.
  • MoodyGDLowryPBGallettaDFIt’s complicated: explaining the relationship between trust, distrust, and ambivalence in online transaction relationships using polynomial regression analysis and response surface analysisEuropean Journal of Information Systems2017
  • NicholsonNSoaneEFenton-O’creevyMWillmanPPersonality and domain-specific risk takingJournal of Risk Research20058215717610.1080/1366987032000123856
  • NunnallyJCBernsteinIHPsychometric Theory1994New York, New YorkMcGraw-Hill Humanities/Social Sciences/Languages
  • PaulhusDLWilliamsKMThe dark triad of personality: Narcissism, Machiavellianism, and psychopathyJournal of Research in Personality200236655656310.1016/S0092-6566(02)00505-6
  • PavlouPADimokaAThe nature and role of feedback text comments in online marketplaces: implications for trust building, price premiums, and seller differentiationInformation Systems Research200617439241410.1287/isre.1060.0106
  • PettyRECacioppoJTSchumannDCentral and peripheral routes to advertising effectiveness: the moderating role of involvementJournal of Consumer Research198310913514610.1086/208954
  • PettyREWegenerDTGilberDTFiskeELindzeyGAttitude change: multiple roles for persuasion variablesThe Handbook of Social Psychology1998New York, New YorkMcGraw-Hill323390
  • PoseyCLowryPBRobertsTLEllisSThe culture-influenced online community self-disclosure model: the case of working professionals in France and the UK who use online communitiesEuropean Journal of Information Systems2009274163200
  • PoseyCRobertsTLLowryPBThe impact of organizational commitment on insiders’ motivation to protect organizational information assetsJournal of Management Information Systems201532417921410.1080/07421222.2015.1138374
  • RogersRWA protection motivation theory of fear appeals and attitude changeThe Journal of Psychology19759119311410.1080/00223980.1975.9915803
  • Romanosky S (2016) Examining the costs and causes of cyber incidents. FTC PrivacyCon, Washington DC, 14 January 2016.
  • RossiPHAndersonABRossiHNockSLThe factorial survey approach: an introductionMeasuring Social Judgments1982Beverly Hills, CaliforniaSage Publications1567
  • SavillePHoldsworthJOccupational Personality Questionnaire Manual1984Surrey, EnglandEscher
  • SchulYMayoRBurnsteinEEncoding under trust and distrust: the spontaneous activation of incongruent cognitionsJournal of Personality and Social Psychology200486566810.1037/0022-3514.86.5.668
  • SchulYMayoRBurnsteinEThe value of distrustJournal of experimental social psychology20084451293130210.1016/j.jesp.2008.05.003
  • Sheng S, Holbrook M, Kumaraguru P, Cranor L and Downs J (2010) Who falls for phish? A demographic analysis of phishing susceptibility and effectiveness of interventions. In Proceedings of CHI, pp 373–382.
  • SiponenMCritical analysis of different approaches to minimizing user-related faults in information systems security: implications for research and practiceInformation Management and Computer Security20008519720910.1108/09685220010353178
  • Siponen M, Pahnila S and Mahmood A (2006) A new model for understanding users’ is security compliance. In Proceedings of PACIS, pp 644–657.
  • SiponenMVanceANeutralization: new insights into the problem of employee information systems security policy violationsMIS Quarterly201034148750210.2307/25750688
  • SteelmanZHammerBILimayemMData collection in the digital age: innovative alternatives to student samplesMIS Quarterly201438235537810.25300/MISQ/2014/38.2.02
  • SternthalBDholakiaRLeavittCThe persuasive effect of source credibility: tests of cognitive responseJournal of Consumer Research19784425226010.1086/208704
  • StraubDWEffective IS securityInformation Systems Research19901325527610.1287/isre.1.3.255
  • StraubDWGoodhueDLSecurity concerns of systems users: a study of perceptions of the adequacy of securityInformation & Management1991201132710.1016/0378-7206(91)90024-V
  • SunLSrivastavaRPMockTJAn information systems security risk assessment model under Dempster-Shafer theory of belief functionsJournal of Management Information Systems200622410914210.2753/MIS0742-1222220405
  • TheoharidouMKokolakisSKarydaMKiountouzisEThe insider threat to information systems and the effectiveness of ISO17799Computers and Security200524647248410.1016/j.cose.2005.05.002
  • TutenTLBosnjakMUnderstanding differences in web usage: the role of need for cognition and the five factor model of personalitySocial Behavior and Personality200129439139810.2224/sbp.2001.29.4.391
  • HeijdenHUser acceptance of hedonic information systemsMIS Quarterly200428469570410.2307/25148660
  • HeijdenHVerhagenTCreemersMUnderstanding online purchase intentions: contributions from technology and trust perspectivesEuropean Journal of Information Systems2003121414810.1057/palgrave.ejis.3000445
  • VanceAElie-Dit-cosaqueCStraubDWExamining trust in information technology artifacts: the effects of system quality and cultureJournal of Management Information Systems20082447310010.2753/MIS0742-1222240403
  • VishwanathAHerathTChenRWangJRaoHRWhy do people get phished? Testing individual differences in phishing vulnerability within an integrated, information processing modelDecision Support Systems201151357658610.1016/j.dss.2011.03.002
  • WangJChenRHerathTRaoHRVisual e-mail authentication and identification services: an investigation of the effects on e-mail useDecision Support Systems20094819210210.1016/j.dss.2009.06.012
  • WangWBenbasatIAttributions of trust in decision support technologies: a study of recommendation agents for e-commerceJournal of Management Information Systems200824424927310.2753/MIS0742-1222240410
  • WaskoMMFarajSWhy should I share? Examining social capital and knowledge contribution in electronic networks of practiceMIS Quarterly2005291353710.2307/25148667
  • WebsterJTrevinoLKRyanLThe dimensionality and correlates of flow in human-computer interactionComputers in Human Behavior19939441142610.1016/0747-5632(93)90032-N
  • WeinbergSLAbramowitzSKStatistics Using SPSS: An Integrative Approach2008Cambridge, MassachusettsCambridge University Press
  • Woon IMY, Tan GW and Low R (2005) A protection motivation theory approach to home wireless security. In Proceedings of ICIS, pp 367–380.
  • WorkmanMWisecrackers: a theory-grounded investigation of phishing and pretext social engineering threats to information securityJournal of the American Society for Information Science and Technology200859411210.1002/asi.20779
  • WrightRTChakrabortySBasogluAMarettKWhere did they go right? Understanding the deception in phishing communicationsGroup Decisions and Negotiation201019439141610.1007/s10726-009-9167-9
  • WrightRTJensenMLThatcherJBDingerMMarettKInfluence techniques in phishing attacks: an examination of vulnerability and resistanceInformation Systems Research201425238540010.1287/isre.2014.0522
  • WrightRTMarettKThe influence of experiential and dispositional factors in phishing: an empirical investigation of the deceivedJournal of Management Information Systems201027127330310.2753/MIS0742-1222270111

Reprints and Corporate Permissions

Please note: Selecting permissions does not provide access to the full text of the article, please see our help page How do I view content?

To request a reprint or corporate permissions for this article, please click on the relevant link below:

Academic Permissions

Please note: Selecting permissions does not provide access to the full text of the article, please see our help page How do I view content?

Obtain permissions instantly via Rightslink by clicking on the button below:

If you are unable to obtain permissions via Rightslink, please complete and submit this Permissions form. For more information, please visit our Permissions help page.