The Individual Differences in Cue Utilisation, Decision Making, and Time Pressure on Phishing Susceptibility

Abstract

Phishing attacks rely on human error to successfully scam individuals. To avoid being scammed, individuals must identify features of an email which indicate that the email is not genuine. These features include spelling and grammatical mistakes, suspicious URL links, and unrecognisable sender addresses. Through repeated exposure, relationships between these features are developed and stored in long-term memory as cues. Cue utilisation is the individual difference in the capacity to identify and apply cues. Additionally, time constraints and decision-making preferences (rational vs intuitive) may impact phishing email detection. The current study investigates the role of individual differences in phishing susceptibility by examining the relationships between phishing detection and cue utilisation, time pressure, and decision-making preferences. Undergraduate psychology students (N = 200) were tested on their ability to detect phishing emails. Participants were randomly assigned to either a short (7-second) or long (15-second) time condition and were presented with 60 emails (50 genuine and 10 phishing). After each email was presented, participants sorted the email into one of ten categories. They were then asked about how safe they thought it would be to click on the link. Participants also completed an email version of the decision-making preference scale and a software to measure cue utilisation in the domain of phishing emails. Results revealed higher cue utilisation, a preference for rational decision-making, and lower time pressure all predicted greater detection of phishing emails. Outcomes of this study may help organisations with the development of cybersecurity training that aims to reduce phishing susceptibility.