Search papers, labs, and topics across Lattice.
This study investigates the effectiveness of various social engineering (SE) attack types in relation to specific psychological factors (PFs) by conducting a laboratory experiment with 12 participants exposed to 25 different stimuli. The findings reveal that spear-phishing is the most effective SE attack type when leveraging authority, trust, and greed, with the strongest combination being spear-phishing paired with the psychological factor of greed. Conversely, pop-ups, smishing, and vishing were found to be ineffective when using authority and curiosity, highlighting the nuanced interplay between psychological factors and SE techniques.
Spear-phishing exploiting greed outperforms all other social engineering tactics, revealing critical insights into psychological manipulation.
Phishing is a well-known social engineering (SE) type used to trick individuals into revealing personal information or performing desired actions, like downloading and installing malware. Other SE types, like vishing and smishing, have emerged and are increasingly being used. As SE continues to successfully persuade victims into actions, the questions arise of which SE attack types are most effective for specific psychological factors (PFs) and, conversely, which PFs are most effective for particular attack types. To answer these questions, we conducted a laboratory study with n=12 participants, in which each participant was shown all 25 stimuli (five PFs and five SE types). The results of this exploratory study show that the most effective SE attack type for authority, trust, and greed was spear-phishing. The most successful combination of PF and attack type was spear-phishing using greed. The least successful combinations were pop-ups using authority, smishing using authority, and vishing using curiosity, each having had no success at all.
