IDEAS home Printed from https://ideas.repec.org/p/hal/journl/hal-04325609.html
   My bibliography  Save this paper

Informing, simulating experience, or both : A field experiment on phishing risks

Author

Listed:
  • Aurélien Baillon

    (Erasmus University Rotterdam)

  • Jeroen de Bruin

    (Erasmus University Rotterdam)

  • Aysil Emirmahmutoglu

    (Erasmus University Rotterdam)

  • Evelien van de Veer
  • Bram van Dijk

Abstract

Cybersecurity cannot be ensured with mere technical solutions. Hackers often use fraudulent emails to simply ask people for their password to breach into organizations. This technique, called phishing, is a major threat for many organizations. A typical prevention measure is to inform employees but is there a better way to reduce phishing risks? Experience and feedback have often been claimed to be effective in helping people make better decisions. In a large field experiment involving more than 10,000 employees of a Dutch ministry, we tested the effect of information provision, simulated experience, and their combination to reduce the risks of falling into a phishing attack. Both approaches substantially reduced the proportion of employees giving away their password. Combining both interventions did not have a larger impact.

Suggested Citation

  • Aurélien Baillon & Jeroen de Bruin & Aysil Emirmahmutoglu & Evelien van de Veer & Bram van Dijk, 2019. "Informing, simulating experience, or both : A field experiment on phishing risks," Post-Print hal-04325609, HAL.
    • Handle: RePEc:hal:journl:hal-04325609
    DOI: 10.1371/journal.pone.0224216
    Note: View the original document on HAL open archive server: https://hal.science/hal-04325609
    as

    Download full text from publisher

    File URL: https://hal.science/hal-04325609/document
    Download Restriction: no
    File URL: https://libkey.io/10.1371/journal.pone.0224216?utm_source=ideas
    LibKey link: if access is restricted and if your library uses this service, LibKey will redirect you to where you can use your library subscription to access this item
    ---><---

    References listed on IDEAS

    as
    1. B. B. Gupta & Nalin A. G. Arachchilage & Kostas E. Psannis, 2018. "Defending against phishing attacks: taxonomy of methods, current issues and future directions," Telecommunication Systems: Modelling, Analysis, Design and Management, Springer, vol. 67(2), pages 247-267, February.
    Full references (including those not matched with items on IDEAS)

    Most related items

    These are the items that most often cite the same works as this one and are cited by the same works as this one.
    1. Joakim Kävrestad & Allex Hagberg & Marcus Nohlberg & Jana Rambusch & Robert Roos & Steven Furnell, 2022. "Evaluation of Contextual and Game-Based Training for Phishing Detection," Future Internet, MDPI, vol. 14(4), pages 1-16, March.
    2. Robert Karamagi, 2022. "A Review of Factors Affecting the Effectiveness of Phishing," Computer and Information Science, Canadian Center of Science and Education, vol. 15(1), pages 1-20, February.
    3. Abdul Basit & Maham Zafar & Xuan Liu & Abdul Rehman Javed & Zunera Jalil & Kashif Kifayat, 2021. "A comprehensive survey of AI-enabled phishing attacks detection techniques," Telecommunication Systems: Modelling, Analysis, Design and Management, Springer, vol. 76(1), pages 139-154, January.
    4. Jaime A. Teixeira da Silva & Aceil Al-Khatib & Panagiotis Tsigaris, 2020. "Spam emails in academia: issues and costs," Scientometrics, Springer;Akadémiai Kiadó, vol. 122(2), pages 1171-1188, February.
    5. Dipankar Dasgupta & Zahid Akhtar & Sajib Sen, 2022. "Machine learning in cybersecurity: a comprehensive survey," The Journal of Defense Modeling and Simulation, , vol. 19(1), pages 57-106, January.
    6. Altyeb Taha, 2021. "Intelligent Ensemble Learning Approach for Phishing Website Detection Based on Weighted Soft Voting," Mathematics, MDPI, vol. 9(21), pages 1-13, November.
    7. Aurélien Baillon & Jeroen de Bruin & Aysil Emirmahmutoglu & Evelien van de Veer & Bram van Dijk, 2019. "Informing, simulating experience, or both: A field experiment on phishing risks," PLOS ONE, Public Library of Science, vol. 14(12), pages 1-15, December.

    More about this item

    Statistics

    Access and download statistics

    Corrections

    All material on this site has been provided by the respective publishers and authors. You can help correct errors and omissions. When requesting a correction, please mention this item's handle: RePEc:hal:journl:hal-04325609. See general information about how to correct material in RePEc.

    If you have authored this item and are not yet registered with RePEc, we encourage you to do it here. This allows to link your profile to this item. It also allows you to accept potential citations to this item that we are uncertain about.

    If CitEc recognized a bibliographic reference but did not link an item in RePEc to it, you can help with this form .

    If you know of missing items citing this one, you can help us creating those links by adding the relevant references in the same way as above, for each refering item. If you are a registered author of this item, you may also want to check the "citations" tab in your RePEc Author Service profile, as there may be some citations waiting for confirmation.

    For technical questions regarding this item, or to correct its authors, title, abstract, bibliographic or download information, contact: CCSD (email available below). General contact details of provider: https://hal.archives-ouvertes.fr/ .

    Please note that corrections may take a couple of weeks to filter through the various RePEc services.

    IDEAS is a RePEc service. RePEc uses bibliographic data supplied by the respective publishers.