Phishing and Social Engineering — Ringing the Doorbell Instead of Breaking the Lock

One in Five

There is an experiment where fake emails disguised to look real are secretly sent to people. If the recipient clicks a link or enters information in the email, it is counted as "fooled." When 48 such experiments conducted outside the lab, where people were using email as they normally do, were gathered, the fooled rate averaged 21% (DOI: 10.1109/ecrime47957.2019.9037502). On average, this means about one in five people who received a fake email were fooled. This rate varied greatly depending on what the email was about.

These emails did not try to break the computer. They tried to make the recipient click a link with their own hands and enter information with their own hands. One of the main causes of a security breach is precisely this: the fundamental weakness of humans being fooled (DOI: 10.17705/1jais.00447). Many attacks begin with a single email like this (PMID 36403509), and attacks that fool people often serve as the preceding step for more sophisticated, more damaging attacks (PMID 33101096).

This article follows three questions. What do attacks that fool people look like? What human traits do those tricks target? How far do the defense mechanisms block them? We will also take another look later at what kind of person the one fooled person out of five was.

Ringing the Doorbell Instead of Breaking the Door

There are two ways to enter someone else's house. There is the path of breaking the lock or climbing through a window, and the path of ringing the doorbell to make the person inside open the door. On the second path, how strong the lock is does not matter. That is because the hand opening the door is inside the house.

Social engineering is an attack that digs into people's minds and judgments instead of gaps in machines, making them hand over information themselves or do dangerous things. It is a psychological attack targeting weaknesses in the way people think and make decisions (PMID 33101096). Persuasion and intimidation are topics that psychology has studied for a long time, and extracting information through these means has now become a major method of cyberattacks (DOI: 10.1109/ccwc57344.2023.10099202).

Phishing is a deception that uses messages disguised as coming from a trustworthy source to extract information like passwords or make people open harmful links or files. Phishing is cited as the most immediate threat among various social engineering methods (DOI: 10.28991/esj-2024-08-02-025).

Although the word phishing is common, researchers lacked a shared definition for a while. After collecting and comparing 113 different definitions from literature up to August 2013, a single definition was proposed based on their common skeleton. It states that phishing is a scalable deception that uses impersonation to obtain information from the other party (DOI: 10.1186/s40163-014-0009-y). This definition focuses on the side that obtains information. Mails that trick people into clicking harmful links to download malicious programs are another outcome that phishing targets (DOI: 10.17705/1jais.00447).

Impersonation is pretending to be another person or institution. Phishing mails pretend to be a bank, a delivery company, or a superior at work. The sender's name, logo, and tone of voice can be faked, and the address can be made to differ from the real one by just a letter or two, or in some cases imitated exactly. Pressing a link can also lead to a fake site that mimics the real site (DOI: 10.1145/1754393.1754396).

Phishing does not break the lock; it makes the person inside the house open the door.

Mail, Texts, Phone Calls — And Then the Click

Email remains the most common channel for deceptive messages. It is followed by social media, text messages, and phone calls (DOI: 10.47772/ijriss.2025.907000456, summarizing 49 empirical studies from 2010 to 2025).

Smishing is phishing carried out via text message. (DOI: 10.1145/3577923.3583640) Vishing is phishing carried out via phone voice. This article refers to phone-based phishing as discussed in English-language research, and does not cover the full range of telephone financial fraud broadly called by this term in Korea. On social media, harmful links circulate disguised as fake news, trending videos, or tempting opportunities (PMID 32501314). The channels differ, but the skeleton is the same. They pretend to be someone trustworthy and get the recipient to do something.

What happens after the click falls largely into two categories. One is handing over information. This is like typing your password into a fake login screen. The other is installing a malicious program. Phishing emails trick people into clicking links to download malware or into leaking personal information (DOI: 10.17705/1jais.00447). Malware is a program built to cause harm without the user knowing (from "Security", another piece in this series).

In a workplace, this single click becomes the entrance into company systems. Phishing emails are a method for sneaking into an organization's system by getting employees to open harmful links or attachments (DOI: 10.1016/j.ijhcs.2018.06.004). One type of malware that enters this way is ransomware. Ransomware is malware that makes files unusable—such as by encrypting them—and then demands money in exchange for unlocking them. (DOI: 10.1109/icdcs.2016.46; DOI: 10.1016/s1353-4858(1630086-1)

When phishing succeeds, it brings lost money, damaged reputation, and identity theft (DOI: 10.1016/j.cose.2023.103387). What opens up with a single stolen password, and the safeguards that reduce that damage, are covered in "Passwords and Passkeys", another piece in this series.

The Moment of Quick Judgment by Appearance

After sending nine types of simulated phishing emails to 62,000 employees of an organization for six weeks, the researchers evaluated whether each email contained cues of authority and urgency. Emails containing cues that seemed to come from an authoritative source made employees more likely to click on suspicious links (DOI: 10.1016/j.ijhcs.2018.06.004).

People do not examine the contents one by one every time they receive an email. They often make quick judgments based on a few surface features such as the sender's name, subject line, and tone. The method of quick judgment by appearance goes hand in hand with falling for internet scams, while the method of examining the contents step by step helps in spotting scams. Researchers generally agree up to this point (PMID 36814645). However, work to confirm this relationship and explain its inner workings is still needed. Because most of these were measured through simulations, there may be a difference from actual harm (PMID 36814645).

Deceptions target the moment when a person makes a quick judgment based on a few surface features. Authority, intimidation, urgency, scarcity, and familiarity are cited as cues that shake that moment (DOI: 10.1109/ccwc57344.2023.10099202).

Authority was used most frequently in the attack scenes in books written by social engineers. When 74 attack scenes were extracted from those four books and broken down step by step, authority was used much more frequently than the other six principles of persuasion (DOI: 10.1002/jip.1482). Even in an experiment where real and fake emails were mixed and participants were asked to identify them, the more sentences that relied on authority and built goodwill, the better people were fooled by fake emails (PMID 32271628).

Urgency operates a bit differently. In the same experiment, the more sentences there were that intimidated and rushed people, the better people actually spotted fake emails (PMID 32271628). Threats or hurried language caught the eye before spelling mistakes, and emails containing threatening language or spelling mistakes were evaluated as the least trustworthy. This is the result of an exploratory study of 22 participants (PMID 32849040).

The situation is different if the recipient is actually pressed for time. Under conditions where time pressure was applied, people were more easily fooled by fraudulent materials. This was especially true for scams shaped like "lose it if you don't do it now," while the effect of time pressure was not clear for scams shaped like "giving a benefit" (PMID 40330294). The two experiments cannot be directly compared because their materials and conditions differ. However, when placed side by side, at least this much is visible. The urgency written in an email and the situation where the recipient is actually rushed are not the same thing.

Emotions also shake judgment. In an experiment where harmless fake emails were sent to 7,225 college students, more students were fooled by emails that played on the fear of losing something precious or the expectation of getting something they wanted (DOI: 10.17705/1jais.00447). People in whom either excited or anxious emotions were actually strongly stirred up in the laboratory had a greater inclination to buy falsely advertised goods. This effect did not differ between younger and older age groups (PMID 29658750). The research team for the emotion experiments suggests that advising people to postpone money-related decisions until their minds settle down can help block such tactics.

Emails That Know Me

When researchers gave the side drafting emails a lot of the recipient’s personal information, recipients were 2.97 times more vulnerable to those emails (PMID 36403509). The more information there was, the better attackers could craft impersonations and stories that fit the recipient's exact situation.

Spear phishing is phishing tailored to a specific person or group after researching them in advance. Making emails like this requires gathering and researching personal information about the target and the people around them. Even though security technology has advanced significantly, this custom fit is why spear phishing continues to work (PMID 36403509). A review paper summarizing studies on persuasion principles also concluded that spear phishing is especially effective because it can be tailored to a target's traits, interests, and weaknesses (DOI: 10.1109/trustcom60117.2023.00222).

The power of personalization is also evident in the field. In the first simulated drill conducted at a large Italian hospital with over 6,000 employees, 64% of employees did not open an email that could have been sent to anyone. Only 38% did not open an email tailored to the hospital's situation, and noticeably more employees clicked links in the personalized email group (PMID 35321019). Whether a message worked depended on how well it was tailored to what was happening there at the time. However, this drill could not proceed as planned because issues were raised within the hospital (PMID 35321019).

For attackers targeting a company, a single person's reply can be enough. A company has to worry about every email every employee receives, but attackers can cause massive damage by getting a reply from just one key figure in charge of finance or human resources (DOI: 10.1109/stast.2015.10). When this tailored attack targets a company's financial pipeline, it gets a separate name. Business email compromise is a scam where emails sent by pretending to be a business partner or company superior, or by hijacking their actual email account, trick a company into sending money or handing over sensitive information. (DOI: 10.1016/j.cose.2025.104630)

Emails that know the target and are custom-crafted work better. The material for this is the personal information that can be gathered about that person.

Who Falls for It

At one US medical institution, 5,416 employees received twenty simulated phishing emails in total. Over that period, 975 people, or 17.9%, never clicked once, while 3,565 people (65.3%) clicked twice or more (PMID 30861069). This means roughly eight out of ten people clicked at least once.

In the review bringing together forty-eight field experiments we saw earlier, out of 140 relationships checked by the researchers, 116 were about the recipient, and most of those showed no statistically clear differences. On the other hand, warning mechanisms, how tailored the email was, training, and known tricks changed the percentage of people falling for it, and the success rates seemed to differ by orders of magnitude depending on the type of scam (DOI: 10.1109/ecrime47957.2019.9037502). Looking at this review alone, the characteristics of the recipient showed no clear differences in most cases, whereas how the email was dressed up changed the percentage of people falling for it. However, the authors noted that many results had limitations in controls and samples. The fact that no clear difference was visible does not mean there is no difference, as the employees at the medical institution who clicked often kept clicking more until the end (PMID 30861069).

Age does not point in just one direction either. Among 158 people who received fake emails every day for twenty-one days, 43% fell for them, and older women were the most vulnerable (PMID 32508486). In another experiment with 515 participants, 18- to 25-year-olds were more vulnerable than older participants throughout the experiment (DOI: 10.1145/1572532.1572536). In a study that had people spot fake emails, scam text messages, and fake news headlines, age did not predict detection performance (PMID 37127397).

Spotting them in the first place is also difficult. In three experiments where participants had to tell real from fake while varying the volume of email and the proportion mixed with phishing, phishing detection was close to random guessing in all experiments. Participants overly trusted their own judgment and did not feel the emails were dangerous (PMID 33835881). In a 2006 experiment where twenty-two people had to spot fake websites, 23% did not look at the address bar and security indicators at all, leading them to get 40% wrong. Certain visual tricks fooled even the most seasoned users (DOI: 10.1145/1124772.1124861). The padlock picture in the address bar only guarantees the security of the connection, not that the site is honest ("Keys and Locks — Why a Public Key Is Safe to Publish").

There are also individual differences. The lower the ability to handle digital devices and the weaker the tendency to think things through, the worse people were at spotting fake emails, scam text messages, and fake news alike. A person weak against one trick was weak against other tricks as well (PMID 37127397). People who knew about email scams were less likely to reply to scam emails (DOI: 10.1109/tpc.2012.2208392).

Falling for scams cannot be dismissed as something that happens only to a few careless people. Many people click at least once, and what arrives, when, and how heavily shifts that probability.

Filtering Technology, Teaching Education, and Informing People

Phishing is difficult to stop with technology alone. This is because humans are ultimately the ones using the technology (PMID 27562565). Because phishing emails are massive in volume and designed to deceive in the first place, filtering them out with technology has limits, leaving human judgment as the final line of defense (PMID 33078362). Measures that rely solely on technology are insufficient, and human capabilities must be considered together when designing defenses (DOI: 10.1016/j.cose.2023.103387).

Even so, filtering devices and warnings are effective. Warnings attached to emails proved effective (DOI: 10.1109/sp46214.2022.9833766), and technical warning mechanisms changed the rate at which people are deceived (DOI: 10.1109/ecrime47957.2019.9037502). Placing automated detection as the first line of defense and using user training as its complement is the conclusion of the researchers who created the educational tool (DOI: 10.1145/1754393.1754396).

Security awareness training is education and training that teaches people to recognize and cope with deceptions. Its effectiveness varies greatly depending on the method. In a meta-analysis pooling the results of 19 experiments and 23,146 people, some training had a huge effect, while other training had no effect at all. High-intensity training was more effective than low-intensity training, and narrowly focused training was more effective than broadly focused training (DOI: 10.1108/ics-07-2019-0078).

The approach of teaching at the exact moment someone clicks a link in a fake phishing email yields mixed results. In an experiment with 515 participants, the content learned this way remained even after 28 days, though it did not go so far as to make them avoid links in real emails. This is an experiment by the researchers who created this training tool (DOI: 10.1145/1572532.1572536). However, in an experiment involving over 14,000 employees of a company for 15 months, a similar approach of inserting education during simulated phishing training failed to make employees more resilient to phishing, and could unexpectedly lead to side effects where they were deceived more easily (DOI: 10.1109/sp46214.2022.9833766). At the U.S. healthcare organization seen earlier, click rates dropped while mock emails were repeated, but mandatory training assigned separately to employees who clicked frequently did not significantly change click rates (PMID 30861069).

The effects of training may not last long. Training raises detection capabilities for a short period, but the evidence that behavior changes for a long time remains weak (DOI: 10.47772/ijriss.2025.91100611; DOI: 10.1177/0093650215627483). There is also a trade-off to training. As people are taught to spot threats, they easily tend to also mistakenly view non-threatening emails as threats (DOI: 10.1145/1754393.1754396).

How much help simulated phishing training provides depends on how it is taught. A literature review comparing training studies noted that while researchers' answers converge on many questions, conflicting factors like age remain (DOI: 10.1186/s13673-020-00237-7). The teaching method at the moment of clicking a link and how long the effect lasts still have divided answers.

People can also stand on the blocking side. In the 15-month experiment from earlier, the company installed a button in the email program to report suspicious emails. By pooling reports from multiple employees, new phishing attacks could be found quickly, the workload for the organization was manageable, and employees reported consistently over a long period (DOI: 10.1109/sp46214.2022.9833766).

Neither filtering technology nor education is complete on its own, and the two fill each other's empty spaces.

An Afternoon at the End of the Month, an Email

Now let us follow one person's afternoon. On an afternoon at the end of the month, an accountant at a company has dozens of emails piled up in their inbox. One of them arrives in the name of the CEO, asking to send money to a client within today. The email knows the exact name of an ongoing transaction. It might even have come from a real account.

This single email overlaps several of the clues we saw earlier. The CEO's name is a cue of authority, and emails containing cues of authority made employees more likely to click links (DOI: 10.1016/j.ijhcs.2018.06.004). This result was measured by the act of clicking links. Knowing the transaction name is a cue of personalization, and people were 2.97 times more vulnerable to emails crafted with a lot of the recipient's information held by the lab (PMID 36403509). This email, which arrived for a person holding the purse strings, is the shape of business email compromise.

The urging words "within today" might actually invite suspicion. There is an experiment where the more urging and frightening sentences there were, the better people spotted fakes (PMID 32271628). However, if the accountant is actually pressed for an end-of-month deadline, the situation can be different. In one experiment, people rushed for time believed fraudulent materials as real much better, especially in frauds of the form "lose it if you don't do it now" (PMID 40330294). The fact that the fake is just one among dozens also plays a part. Under conditions where phishing was rarely mixed in, people spotted phishing less (PMID 33835881).

Filtering devices can miss this email. Emails crafted with personalization continued to work even after security technology improved (PMID 36403509). Still, if a warning message is attached, that warning is effective, and if the accountant presses the report button, reports from multiple people gather to find new attacks quickly (DOI: 10.1109/sp46214.2022.9833766).

If the accountant eventually sent the money, authority, personalization, time pressure, and a pile of emails were together at that moment. These are the conditions that each leaned toward being deceived in the previous studies. However, what those studies measured was clicking a link, being deceived in a lab, believing fraudulent material, and sorting emails, and there is no evidence measuring the act of sending money. How much more dangerous it is when these conditions overlap all at once was not measured by the studies gathered in this article either. The doorbell rang at the time when the person inside the house was busiest, with the name they trusted most.

Where to Read Next

In this article, malware was only briefly touched upon by recalling its definition. What security aims to protect and why multiple layers of defense are necessary are covered in "Security", another part of this series.

What passwords stolen through phishing unlock, and verification methods that do not rely on a single password, can be found in "Passwords and Passkeys", another part of this series.

The material for spear phishing is personal information left exposed outside. The paths through which our information leaks are traced in "Personal Data and Anonymization", another part of this series.

What the padlock icon in the address bar guarantees and does not guarantee is covered in "Keys and Locks — Why a Public Key Is Safe to Publish".

When the deceiving counterpart is an AI model, sentences written by others moving the model can be seen in "When Someone Else's Sentence Becomes Your Instruction — Prompt Injection".

There is not yet an article that directly tackles the conflicting research regarding the effectiveness of simulated phishing training.

Source Papers

• "A meta-analysis of field experiments on phishing susceptibility" (2019) — DOI: 10.1109/ecrime47957.2019.9037502 — Meta-analysis of 48 field experiments. Average deception rate of 21%. Of 140 recipient variable tests, 116 were mostly insignificant. Warning devices, personalization, training, and known methods alter rates, with orders-of-magnitude differences depending on scam type. Control and sample limitations.
• "Got Phished? Internet Security and Human Vulnerability" (2017) — DOI: 10.17705/1jais.00447 — The primary cause of security breaches is the human vulnerability of being deceived. Phishing leads users to download malware or give up information. 7,225 college students; fear of loss and expectation of gain amplify deception.
• "Personalized persuasion: Quantifying susceptibility to information exploitation in spear-phishing attacks." (2023) — PMID 36403509 — Many attacks start with spear-phishing emails. Creation requires target research, and personalization keeps them working. High-information conditions in the laboratory are 2.97 times more vulnerable.
• "Human Cognition Through the Lens of Social Engineering Cyberattacks." (2020) — PMID 33101096 — Social engineering is a psychological attack targeting cognitive vulnerabilities and often serves as a precursor to sophisticated and destructive attacks.
• "Social Engineering Incidents and Preventions" (2023) — DOI: 10.1109/ccwc57344.2023.10099202 — Techniques to obtain information through persuasion, threats, and coercion, moving from psychology to cyber attack techniques. Principles: authority, threats, urgency, scarcity, and familiarity.
• "Common Techniques, Success Attack Factors and Obstacles to Social Engineering: A Systematic Literature Review" (2024) — DOI: 10.28991/esj-2024-08-02-025 — The most imminent threat in social engineering is phishing.
• "Achieving a consensual definition of phishing based on a systematic review of the literature" (2014) — DOI: 10.1186/s40163-014-0009-y — Literature up to August 2013, analyzing 113 definitions. "A scalable deception that obtains information from a target through impersonation."
• "Teaching Johnny not to fall for phish" (2010) — DOI: 10.1145/1754393.1754396 — Luring targets with websites mimicking real ones. Difficulty of education (motivation, secondary tasks, misjudging non-threats). Automated detection is the first line of defense, with education as a supplement.
• "Phishing Susceptibility through Theoretical Lenses: A Systematic Literature Review" (2025) — DOI: 10.47772/ijriss.2025.907000456 — 49 empirical studies from 2010–2025. Emails dominate, followed by social media, smishing, and vishing. Urgency, fear, and authority.
• "Susceptibility to phishing on social network sites: A personality information processing model." (2020) — PMID 32501314 — Harmful links disguised as fake news or trending videos on social media. Fast (heuristic) processing increases deception.
• "Exploring susceptibility to phishing in the workplace" (2018) — DOI: 10.1016/j.ijhcs.2018.06.004 — Phishing emails infiltrate organizational systems through harmful links and attachments. 62,000 employees, 6 weeks, 9 simulation emails; authority cues increase click probability.
• "Mitigation strategies against the phishing attacks: A systematic literature review" (2023) — DOI: 10.1016/j.cose.2023.103387 — Consequences of phishing include financial loss, reputation damage, and identity theft. Technology-centric solutions alone are insufficient; human capabilities must be factored into design.
• "Theoretical basis and occurrence of internet fraud victimisation: Based on two systems in decision-making and reasoning." (2023) — PMID 36814645 — Broad consensus that heuristic processing is associated with fraud susceptibility, while systematic processing is linked to detection. Further verification and explanation needed, along with bridging the gap between simulations and reality.
• "On the anatomy of social engineering attacks—A literature‐based dissection of successful attacks" (2017) — DOI: 10.1002/jip.1482 — 74 scenarios from 4 social engineering books. Authority is by far the most frequently used persuasion principle. Social countermeasures as well as technical ones are needed.
• "Persuasive Appeals Predict Credibility Judgments of Phishing Messages." (2020) — PMID 32271628 — More authority and liking appeals increase deception, while more fear and urgency appeals make detection easier and reduce deception.
• "Understanding Phishing Email Processing and Perceived Trustworthiness Through Eye Tracking." (2020) — PMID 32849040 — Exploratory study of 22 participants. Threat and urgency markers are noticed before spelling errors. Emails with spelling errors and threat phrasing receive the lowest trust.
• "The impact of time pressure and type of fraud on susceptibility to online fraud." (2025) — PMID 40330294 — Time pressure increases deception. Effective only in loss-avoidance fraud, not significant in gain-based fraud.
• "Emotional arousal may increase susceptibility to fraud in older and younger adults." (2018) — PMID 29658750 — Both positive and negative high arousal increase the intention to purchase fake ads, with no age differences. Educating people to postpone financial decisions until they are calm can help.
• "A Survey on the Principles of Persuasion as a Social Engineering Strategy in Phishing" (2023) — DOI: 10.1109/trustcom60117.2023.00222 — Spear phishing is particularly effective because it can be tailored to the target.
• "Phishing simulation exercise in a large hospital: A case study." (2022) — PMID 35321019 — Hospital with over 6,000 employees. General emails unclicked 64% vs. tailored emails unclicked 38%, with tailored ones receiving more clicks. Could not run as planned. Effectiveness depends on tailoring to local events.
• "An analysis of social engineering principles in effective phishing" (2015) — DOI: 10.1109/stast.2015.10 — Companies must worry about all emails, but attackers need a response from just one key finance or HR person.
• "Evaluation of a mandatory phishing training program for high-risk employees at a US healthcare system." (2019) — PMID 30861069 — 5,416 employees, 20 sessions. 975 people (17.9%) clicked 0 times, 3,565 people (65.3%) clicked 2 or more times. Repetition decreases click rates, but mandatory training for high-risk groups has no major impact.
• "Susceptibility to Spear-Phishing Emails: Effects of Internet User Demographics and Email Content." (2019) — PMID 32508486 — 158 participants, 21 days. 43% were deceived, with older women being the most vulnerable.
• "School of phish" (2009) — DOI: 10.1145/1572532.1572536 — 515 participants. Built-in training persists even after 28 days, but real link clicks do not decrease. Ages 18–25 are more vulnerable.
• "Who Gets Caught in the Web of Lies?: Understanding Susceptibility to Phishing Emails, Fake News Headlines, and Scam Text Messages." (2024) — PMID 37127397 — People weak against one deception are weak against others. Low digital literacy and low deliberative tendency predict poor discrimination, while age does not.
• "So Many Phish, So Little Time: Exploring Email Task Factors and Phishing Susceptibility." (2022) — PMID 33835881 — High email volume decreases accuracy, and rare phishing decreases sensitivity. Discrimination is at the level of guessing, with overconfidence.
• "Why phishing works" (2006) — DOI: 10.1145/1124772.1124861 — 22 participants, 20 websites. 23% did not look at the address bar or security indicators, leading to 40% wrong answers. Visual deceptions fool even experienced users.
• "Research Article Phishing Susceptibility: An Investigation Into the Processing of a Targeted Spear Phishing Email" (2012) — DOI: 10.1109/tpc.2012.2208392 — Survey of 321 actual spear-phishing targets. Knowledge of email scams directly lowers the likelihood of responding.
• "Quantifying Phishing Susceptibility for Detection and Behavior Decisions." (2016) — PMID 27562565 — As long as technology is operated by humans, technology alone cannot prevent phishing.
• "The Phishing Email Suspicion Test (PEST) a lab-based task for evaluating the cognitive mechanisms of phishing detection." (2021) — PMID 33078362 — High volume and deceptive design mean pure technical solutions have limits, making human judgment the final line of defense.
• "Phishing in Organizations: Findings from a Large-Scale and Long-Term Study" (2022) — DOI: 10.1109/sp46214.2022.9833766 — Over 14,000 people, 15 months. Email warnings work well. Built-in training fails to make users stronger and has side effects. The report button group detection is fast, manageable in burden, and secures long-term employee participation.
• "How effective are social engineering interventions? A meta-analysis" (2020) — DOI: 10.1108/ics-07-2019-0078 — 19 papers, 37 effects, 23,146 participants. Highly effective interventions and ineffective interventions coexist. High intensity and narrow focus are more effective.
• "Psychological Effects of Phishing Email Exposure: A Review" (2025) — DOI: 10.47772/ijriss.2025.91100611 — Fear, anxiety, stress, and heuristic processing increase vulnerability. Training increases short-term detection, but evidence for sustained behavioral change is weak.
• "CryptoLock (and Drop It): Stopping Ransomware Attacks on User Data" (2016) — DOI: 10.1109/icdcs.2016.46 — Ransomware is malware that encrypts user files and holds the decryption key until a ransom is paid. Proposes early detection based on behavioral indicators.
• "Ransomware attacks: detection, prevention and cure" (2016) — DOI: 10.1016/s1353-4858(1630086-1 — Ransomware is malicious software that restricts access to important information and demands a fee for release. The most common restriction method is encryption.
• "Business email compromise: A systematic review of understanding, detection, and challenges" (2025) — DOI: 10.1016/j.cose.2025.104630 — BEC is a broad fraud targeting businesses and individuals to gain financial profit and access sensitive data. Summarizes detection and prevention techniques.
• "Suspicion, Cognition, and Automaticity Model of Phishing Susceptibility" (2016) — DOI: 10.1177/0093650215627483 — Evidence that people fall back into email usage habits and training effects fade within a short period. Suspicion, Cognition, and Automaticity Model (SCAM).
• "Don’t click: towards an effective anti-phishing training. A comparative literature review" (2020) — DOI: 10.1186/s13673-020-00237-7 — While researchers converge on many questions regarding the usefulness and effectiveness of training, results for some factors like age are mixed.
• "Users Really Do Respond To Smishing" (2023) — DOI: 10.1145/3577923.3583640 — Smishing is a social engineering attack that tricks users into responding via fake text messages (credential theft, malware installation). Experiment with 265 participants.