An analysis of social engineering principles in effective phishing

Phishing is a widespread practice and a lucrative business. It is invasive and hard to stop: a company needs to worry about all emails that all employees receive, while an attacker only needs to have a response from a key person, e.g., a finance or human resources' responsible, to cause a lot of damages. Some research has looked into what elements make phishing so successful. Many of these elements recall strategies that have been studied as principles of persuasion, scams and social engineering. This paper identifies, from the literature, the elements which reflect the effectiveness of phishing, and manually quantifies them within a phishing email sample. Most elements recognised as more effective in phishing commonly use persuasion principles such as authority and distraction. This insight could lead to better automate the identification of phishing emails and devise more appropriate countermeasures against them.

I. Introduction

Phishing emails are both a scam and a business. If an attacker manages to have his/her phishing email hook a key person in an organization, s/he can gain access to a myriad of sensitive services and data. Such an event is not unlikely since there is evidence showing that employees in Human Resources or Accounting and Finance are no better than other colleagues in recognising phishing emails [1]. Further, the likelihood of clicking on a poisoned link is higher when an individual spends more time on the Internet, independently of his/her technical literacy [2], [3].