Gone phishin': CyLab exposes how our ability to spot phishing emails is far from perfect

https://www.eurekalert.org/pub_releases/2016-10/coec-gpc100316.php

Public Release: 3-Oct-2016
Gone phishin': CyLab exposes how our ability to spot phishing emails is far from perfect
College of Engineering, Carnegie Mellon University

-Each year, tens of millions of phishing emails make it to your inbox, uncaught by your email client's spam filter. Of those, millions more slide past our own judgment and are clicked and opened. A recent study out of Carnegie Mellon's CyLab Security and Privacy Institute has revealed just how likely we are to take the bait.

"Despite the fact that people were generally cautious, their ability to detect phishing emails was poor enough to jeopardize computer systems," says Casey Canfield, a CyLab researcher from Carnegie Mellon's Department of Engineering and Public Policy.

•••••

On average, participants were only able to correctly identify just over half of the phishing emails presented to them. Fortunately, participants displayed a little more caution when it came to their behavior: roughly three-quarters of the phishing links were left un-clicked.

"Some users were able to identify a vast majority of the phishing emails, but only because they were biased to think everything was a phishing attack," Canfield says. "So they didn't necessarily have a high ability to tell the difference between phishing and legitimate emails."

What's more, participants' confidence levels were not always calibrated with their ability.

"When making decisions about phishing emails, people were more cautious when they were unconfident and perceived very negative consequences of opening a phishing email," Canfield says. "Unfortunately, they were often overconfident so they would still fall for phishing attacks."

Based on the results, the authors of the study suggest interventions such as providing users with feedback on their abilities and emphasizing the consequences of phishing attacks. One effective training method that companies commonly use, Canfield explains, is sending out fake phishing emails and teaching a user about phishing emails if they open the email. This training method, called "embedded training," was originally developed by the CyLab Usable Privacy and Security Lab.

"It seems like those trainings may not always be making people better at telling the difference, but it's probably making them more cautious," Canfield says. "Helping people tell the difference may not be as useful as just encouraging them to be more cautious."

Other authors on the phishing study included Engineering and Public Policy professors Baruch Fischhoff and Alex Davis.