# Content Analysis of Persuasion Principles in Mobile Instant Message Phishing

Rufai Ahmad, Sotirios Terzis, Karen Renaud

► To cite this version:

Rufai Ahmad, Sotirios Terzis, Karen Renaud. Content Analysis of Persuasion Principles in Mobile Instant Message Phishing. 17th International Symposium on Human Aspects of Information Security and Assurance (HAISA), Jul 2023, Kent, United Kingdom. pp.324-336, 10.1007/978-3-031-38530-8_26. hal-05462111

HAL Id: hal-05462111

https://inria.hal.science/hal-05462111v1

Submitted on 16 Jan 2026

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
<figure><img src="image_3.png" /></figure>

# Content Analysis of Persuasion Principles in Mobile Instant Message Phishing

Rufai Ahmad<fnref n="1" />,<fnref n="5" />✉, Sotirios Terzis<fnref n="1" />✉, and Karen Renaud<fnref n="1" />,<fnref n="2" />,<fnref n="3" />,<fnref n="4" />✉

**Abstract.** The popularity of Mobile Instant Messaging (MIM) Applications (apps) presents cybercriminals with a new venue for sending deceptive messages, known as ‘Phishing’. MIM apps often lack technical safeguards to shield users from these messages. The first step towards developing anti-phishing solutions to identify phishing messages in any attack vector is understanding the nature of the attacks. However, such understanding is lacking for MIM-enabled phishing. This study provides insights into how phishers apply persuasion principles in MIM phishing. Using the deductive content analysis method and Cialdini’s six principles of persuasion, this study identified and analysed 67 examples of real-world MIM phishing attacks from various online sources. Each phishing example was coded to identify the persuasion techniques used and how they were applied. Findings reveal that the principles of social proof, liking, and authority were most widely used in MIM phishing, followed by scarcity and reciprocity. Furthermore, most of the phishing examples contained three persuasion principles, most often a combination of authority, liking, and social proof. These findings provide insights into how phishers execute phishing in MIM apps and provide a theoretical foundation for future research on the psychological aspects of phishing in MIM apps and the development of anti-phishing solutions to identity phishing in MIM.

**Keywords:** Persuasion Principles · Phishing · Mobile Instant Messaging

## 1 Introduction

Phishing is an attempt by cybercriminals to trick internet users into clicking malicious links or visiting fraudulent websites [1]. The goal of phishing is to trick targets into downloading malware or divulging sensitive information. Phishing commonly occurs via email, where criminals pose as legitimate entities to fool victims into revealing personal information. However, email is not the only phishing medium. Phishers use other media, such as SMS, voice calling, and instant messaging, to propagate phishing campaigns. Recently, the attention of the cybersecurity community has been drawn to

<footnote n="1">¹ Department of Computer and Information Sciences, University of Strathclyde, Glasgow, UK {rufai.ahmad,sotirios.terzis,karen.renaud}@strath.ac.uk</footnote>

<footnote n="2">² Rhodes University, Makhanda, South Africa</footnote>

<footnote n="3">³ University of South Africa, Pretoria, South Africa</footnote>

<footnote n="4">⁴ Abertay University, Dundee, UK</footnote>

<footnote n="5">⁵ Sokoto State University, Sokoto, Nigeria</footnote>
an increase in phishing attacks targeting users of instant messaging applications such as WhatsApp, Telegram and Viber. Cybercriminals pose as well-known brands and use social engineering techniques to lure unsuspecting victims into handing over their data. Such scams can be seen in many giveaway campaigns claiming to come from retail giants [2].

Data from Kaspersky shows that MIM phishing is on the rise, with 91,242 phishing links detected between December 2020 and May 2021 [3]. Most of these links were seen on WhatsApp (89.6%), followed by Telegram (5.6%) and Viber (4.7%). It is important to note that these statistics were based on users of Kaspersky Internet Security for Android only. Thus, numbers can be higher in the real world. Furthermore, despite the study by Kaspersky providing some statistics on MIM phishing, it failed to provide important details, such as the types and categories of companies being impersonated and how phishers implemented the attacks. This knowledge is vital for designing solutions to curb the problem of phishing in MIM apps.

A recent investigation of the presence and effectiveness of technical anti-phishing countermeasures in MIM apps revealed that despite their use in phishing attacks, most MIM apps lack or have ineffective technical countermeasures to protect users [4]. This is surprising considering that some of these platforms (i.e. Snapchat and WhatsApp) claimed that they have some measures in place to protect users from phishing scams [5, 6]. Specifically, Snapchat mentioned using Google Safe Browsing, a blacklisting service, to warn users about suspected phishing sites [5]. However, the research in [4] revealed that ten MIM apps, including Snapchat, failed to detect blacklisted phishing links. The major limitation of blacklisting techniques is that they can only detect known, reported phishing URLs, and are ineffective in detecting zero-day phishing attacks [7, 8]. At the same time, automatic detection of phishing in MIM apps can be challenging due to the use of end-to-end encryption in some of these apps, which suggests that any analysis and classification must be performed on device. Researchers in [14] have shown the potential of on-device classification of spam messages in WhatsApp, indicating the potential of this approach for phishing detection in MIM apps.

Due to the absence of effective technical anti-phishing countermeasures in MIM apps, users must currently function as the first and last line of defence. Consequently, only security-conscious users can protect themselves from these attacks by following the safety tips recommended online. These tips aim to enlighten users about phishing and help them to detect such attacks themselves. For example, the Federal Trade Commission [9] and the Anti-Phishing Working Group [10] frequently publish tips and articles about phishing with information on how users can avoid such attacks. One of the most popular anti-phishing tips is that users should check any link before clicking. However, this advice can only protect users with an understanding of the URL structure. A recent study by [11] has shown that users, including those with technical knowledge, find it difficult to predict the destination of a URL. MIM apps might further complicate the parsing of URLs for users due to the way in which they display URLs with a link preview, which recent findings suggest, can be manipulated [4].

Another frequently given advice is that users should always click on links from known senders. However, communication in MIM apps is often between users who have an offline connection [12]. Thus, users in MIM apps are likely to receive links from
those they know, meaning that trust and the relationship with the sender may play a role in MIM phishing. In addition to this, MIM occurs on mobile devices, and the literature has acknowledged several limitations of mobile devices that can increase user susceptibility to phishing. These limitations include small screen sizes, the inconvenience of user input, and the lack of security indicators [13].

Curbing phishing in MIM apps requires both user awareness and technical countermeasures, both require an understanding of the nature of phishing messages in these applications by investigating the tactics and techniques employed by scammers to defraud users of MIM apps. One of the reasons phishing is successful is that cybercriminals use persuasion techniques to create a situation in which the victim feels comfortable acting in the interest of the criminal [15]. The use of these techniques in both email phishing and voice calling phishing or vishing has been documented in the literature [16, 17]. However, such research is lacking for phishing in MIM apps. Therefore, this study aims to fill this gap.

Adopting the deductive content analysis approach used in [16, 27], 67 images of real-world mobile instant messaging phishing messages from WhatsApp, Telegram and Viber were collected with the Google search engine. These images were analysed and coded based on Cialdini's persuasion principles [22], similar to the approach used in [27]. The results show that most attacks impersonated retail giants, aviation companies and cryptocurrency platforms with most messages about giveaways and fake lotteries. The principles of social proof and liking were most used, followed by authority and scarcity, with reciprocity and commitment and consistency less frequently used. Most phishing messages combined three persuasion principles, often authority, liking, and social proof. Moreover, phishers often implement these principles by using logos and names of well-known organisations for authority, references to famous people or stressing the benefit of visiting fraudulent pages for social proof and exploiting the trust and shared interests between the sender and the recipient for liking. These results can be used to underpin the design of practical solutions to address phishing in MIM apps.

The rest of the paper begins with a survey of previous research on the use of persuasion principles in phishing in the background section. The method section outlines the methodological approach for the study. The results section presents our findings, and it is followed by their discussion including an overview of the limitations of the study. The final section concludes the paper.

## 2 Background

Manipulation and persuasion are essential components of phishing attacks. Cybercriminals use several persuasion techniques to convince targets to do the wrong thing. Persuasion techniques have a root in marketing, where sales professionals use such methods to influence buyers to buy goods and services [18]. Cialdini identified six principles of persuasion that are very effective in marketing. While these principles focused on marketing, researchers have found them widely used in phishing scams [19]. Gragg [20] identified seven psychological triggers that are used in social engineering attacks, including phishing, and more recently, Stajano and Wilson [21] identified seven principles of general scams. However, whilst different authors proposed these principles, a
recent analysis revealed many similarities [17]. Cialdini's six principles of persuasion are currently considered the most widely accepted in the literature [22]. The six principles are authority, commitment and consistency, liking, scarcity, reciprocity and social proof.

The principle of authority states that people tend not to question those in authority because of the fear of losing privileges, condemnation or humiliation. This principle is demonstrated in a recent WhatsApp scam where cybercriminals impersonated the CEO of an organisation and demanded an employee transfer funds to a bank account [23]. Commitment and consistency state that individuals want to be consistent with their previous stand. They want to show an agreement between their words and their actions. For example, an adversary can abuse this by crafting phishing emails that reflect what individuals care about and are passionate about. The principle of liking states that humans are more likely to comply with requests from people they like or with whom they share some similarities. An example is when a user receives a message from their friend asking them to visit a website for a chance to win an item. The principle of scarcity is based on the idea that when things become scarce, their value increases. This principle can be seen in marketing, where statements such as “going out of the market”, “only ten items left”, and “lowest price ever”. Reciprocity is based on humans’ belief that we owe a debt to those who do kind things or give us something we enjoy. An adversary can exploit this notion to lure targets into installing malware on their computer in exchange for a free service or a gift. When humans fear making mistakes, they act according to most other people. The principle of social proof is based on this concept. Cybercriminals can exploit this principle by sharing links to malicious content and indicating that several people have already clicked on those links. Such scams can be seen in phishing surveys that aim to extract users’ personal information [24].

In [25], Akbar investigated how phishers used Cialdini's six principles in phishing emails targeting individuals in the Netherlands. He analysed 207 unique English phishing emails collected from a Netherlands database. His results show that authority was the most used influence technique, followed by scarcity. In [17], the authors investigated the use of persuasion principles in phishing emails by analysing 52 emails written in English. They collected emails from both their mailboxes and the Internet. Their results show that the principle of liking was the most used, followed by scarcity and authority. In [26], the authors analysed persuasion principles used in phishing emails over time. They collected 887 emails from 3 major US universities from January 2010 through June 2015. Their results revealed an increase in the use of principles of commitment/consistency and scarcity over time, whilst a decrease in reciprocation and social proof was observed. Authority and liking show both a decrease and an increase. More recently, Akdemir and Yenal [27] collected and investigated the persuasion principles used in 208 coronavirus-themed phishing emails. The emails were collected as images from 3 search engines, Google, Bing and Yandex, between April 1 and April 16, 2020. The results of this study show that the principle of authority was the most used, followed by commitment/consistency and liking.

The above studies provide solid evidence of persuasion principles in phishing emails. However, the nature of communication in email differs from MIM because email is primarily used in more formal settings. In contrast, MIM is mainly used for informal
communication [28]. Additionally, as instant messaging is mostly among individuals with some offline connection [12], the effectiveness of Cialdini's persuasion principles may differ between the two media. Due to these differences, there is a need for further research to understand how cybercriminals use these principles in MIM phishing. Furthermore, understanding how persuasion principles are used in MIM phishing could help security professionals design effective training materials to educate users on identifying and reacting to phishing scams in such applications. Additionally, analysing the persuasion principles in MIM phishing can aid in designing tools to separate legitimate messages from fraudulent ones automatically without user intervention. Therefore, this study aims to answer the following questions:

**RQ1** How frequently were the various persuasion principles used in MIM phishing attacks?

**RQ2** How many persuasion principles do most phishing messages contain?

**RQ3** What is the highest number of persuasion principles used?

**RQ4** How were the various persuasion principles implemented?

## 3 Method

This study used 67 examples of real-world mobile instant messaging phishing attacks, coded using questions derived from [27, 29, 30] and according to Cialdini's six persuasion principles. Each instance was analysed and coded based on the persuasion principles used, similar to the approach used in [27].

Adopting the deductive content analysis approach used in [16, 27], images of mobile instant messaging phishing messages were collected with the Google search engine between August 8 and August 15, 2022. These were images of MIM phishing scams posted online by users and organisations. The terms “phishing messages”, “phishing frauds”, and “phishing scams” were searched in conjunction with either “WhatsApp”, “Telegram”, or “Viber”. Specifically, the image search section of Google was used to access the actual images of the phishing messages.

The study focused on WhatsApp, Telegram and Viber since their users are currently the most targeted [3]. A backdated search from 2018 was performed because the problem of phishing in MIM apps became widespread during this period [31]. Using the Google image search function, phishing images published within one year were searched using the advanced search operators “Before” and “After”. For example, the search started with the query “phishing scams WhatsApp After: 2018-01-01 before 2019-12-01” to search for all images published between 2018-01-01 and 2019-12-01. This approach was used for subsequent years until August 15, 2022, when the data collection started. The returned images were scanned for every search result, selecting those with phishing content written in English. Some phishing messages were reported by many websites leading to images appearing many times. Thus, the dataset was checked, and duplicates were removed. Furthermore, since this study focuses on phishing and not general social engineering scams, only messages with links were selected. The focus on messages with links was based on the current definition of phishing, where links or attachments are considered essential components of such attacks [1]. This process led to 67 images of phishing messages which the current study is based on.
A coding scheme was developed to determine the presence or absence of each of the six persuasion principles in the messages. The scheme was developed using guidelines and examples presented in [16, 27, 30]. The scheme contained 21 statements, each designed to capture a particular principle of persuasion.

The first author and another coder who is a native English speaker and currently working within the Cybersecurity industry coded each of the 67 phishing examples. For each phishing example, the coders checked the statements in the codebook to see if they apply. If any statement assigned to a principle is deemed true, the principle associated with that statement is marked as present in the phishing example. The value 1 was used to indicate the presence of a principle, and 0 to indicate the absence.

Inter-coder reliability was assessed using Cohen's kappa. Reliability between coders was substantial (k = 0.76), falling within the recommended values [32]. One code set was randomly selected to serve as the final code for analysis. Data analysis was conducted using Python programming language and Jupyter Notebook.

## 4 Results

Out of the 67 phishing images analysed, we found that (29, 43.3%) included a logo. Almost half of the messages contained a link preview (32, 47.8%). Link preview is a feature of MIM apps that adds extra information to web links when they are shared. Information added includes image/logo, hostname, title, and summary of the site content giving users an idea of the site they are visiting.

<table><caption>**Table 1.** Most frequently used words in MIM phishing samples</caption><thead><tr><td>Word</td><td>Frequency</td></tr></thead><tbody><tr><td>Free</td><td>35</td></tr><tr><td>Get</td><td>26</td></tr><tr><td>Click</td><td>17</td></tr><tr><td>Giving</td><td>16</td></tr><tr><td>Anniversary</td><td>16</td></tr><tr><td>Link</td><td>16</td></tr><tr><td>Away</td><td>15</td></tr><tr><td>Please</td><td>15</td></tr><tr><td>Wallet</td><td>15</td></tr><tr><td>Account</td><td>13</td></tr><tr><td>Send</td><td>13</td></tr><tr><td>Ticket</td><td>10</td></tr></tbody></table>

Initial analysis also revealed that (52, 77.6%) of the messages were sent via WhatsApp, followed by Telegram (14, 20.9%), then Viber (1, 1.5%).
Cybercriminals impersonate organisations and individuals in phishing. We found that most attacks impersonated retail giants, aviation companies and cryptocurrency platforms. All the cryptocurrency scams in the dataset were propagated on Telegram. Most messages relate to giveaways and fake lotteries where phishers pretend that messages come from reputable organisations offering giveaways to internet users, often as part of anniversary celebrations.

To find the most frequently used words in the sample phishing scams. This study used a text analysis technique using the NLTK library in Python to extract free text from the images to investigate the word phrases that frequently appeared in the chosen phishing samples. Stop words were eliminated during the pre-processing stage. Table 1 presents the most frequently used words.

*How frequently were the various persuasion principles used in MIM apps phishing attacks?*

The deductive content analysis of the phishing messages revealed that the principle of social proof was the most used in the sample (n = 51, 76.1%), followed by liking (n = 50, 74.6%), authority (n = 37, 55.2%), scarcity (n = 23, 34.3%), reciprocity (n = 11, 16.4%) and commitment and consistency (n = 1, 1.4%) (see Fig. 1).

<figure><img src="image_4.png" /><figcaption>Fig. 1. Prevalence of persuasion principles across MIM-based phishing examples (n = 67).</figcaption></figure>

*How many persuasion principles do most phishing messages contain?*

As the analysis is based on Python, the Pandas library was used to import the dataset as a Pandas DataFrame. Using this approach, every row of the DataFrame represents a phishing message. A Python script was written to check the number of times the value 1 appears in every row of the Pandas DataFrame whilst saving this value in a list. This approach allowed counting the number of persuasion principles in each message. Using the Python library Scipy, the most frequent score in the list was calculated. Analysis shows that most of the phishing examples (n = 21) contained three persuasion principles, followed by those having two (n = 16). Figure 2 shows that these messages fall within five categories: messages using one, two, three, four and five persuasion principles.
<figure><img src="image_5.png" /><figcaption>Fig. 2. Number of persuasion principles in phishing messages.</figcaption></figure>

Analysis of messages using three persuasion principles revealed that most messages (n = 8) contained authority, liking, and social proof, abbreviated as (ALSp), followed by liking, scarcity, and social proof (n = 7), abbreviated as LSSp (See Fig. 3).

Most messages using two principles (n = 16) contained the liking and social proof principles (n = 8) while (n = 6) used authority and liking, and (n = 2) used authority and social proof. Ten of the messages used four persuasion principles, of which (n = 8) used authority, liking, scarcity and social proof, while (n = 2) were based on authority, liking, reciprocity and social proof.

Some messages (n = 13) used only one persuasion principle to entice their targets. Most of these messages were based on social proof (n = 5), followed by authority (n = 4), liking (n = 2), scarcity (n = 1), and reciprocity (n = 1).

*What is the highest number of persuasion principles used?*

Analysis revealed that phishers used five persuasion principles in 5 example phishing messages. Specifically, it was observed that phishers simultaneously applied the principles of authority, liking, reciprocity, scarcity and social proof in four example messages. Phishers applied the principles of authority, commitment and consistency, liking, scarcity and social proof in one phishing example. All messages containing five persuasion principles were sent to Telegram users and related to cryptocurrency.

*How were the various persuasion principles implemented?*

Analysis of the sample messages shows that phishers enforce authority by using logos and names of well-known organisations, social proof by referencing famous people and stressing the benefit of visiting the fraudulent page. For example, in one cryptocurrency scam, phishers referenced the CEO of Coinbase. In some cases, phishers apply the principle of social proof by portraying to the recipient of the message that the sender has already benefited from complying and, therefore, the receiver should comply by visiting the fraudulent page. For example, phishers included the sentence "I have received mine" in most giveaways and voucher scams. This approach tricks the receiver into believing that the sender has already benefited from complying.
<figure><img src="image_6.png" /><figcaption>Fig. 3. Combinations found in messages with three persuasion principles.</figcaption></figure>

Phishers apply the principle of liking by appearing to be helping the recipient. Scarcity was demonstrated by stressing that the message's recipient must act immediately or risk losing out on offers. Phishers enforce scarcity by including phrases such as "free air tickets to 200 customers". Messages with the reciprocity principle ask users to perform an action in response to a favour. These messages were mainly related to cryptocurrency scams. For example, users were told that they had won a certain amount of BTC and could only claim it after sending a specific amount to a cryptocurrency wallet.

# 5 Discussion and Limitations

This study provides insights into how persuasion principles are used in MIM phishing. The study investigated how phishers use persuasion tactics in MIM phishing by examining the presence of Cialdini's six principles of persuasion in sample MIM phishing attacks. Furthermore, the study examined how frequently these principles were used and whether some occurred more than others. The study also examined how often certain persuasion principles appear together in a typical MIM phishing attack. The findings of this study reveal the prevalent use of persuasion principles in MIM phishing, specifically the principles of authority, liking, and social proof.

The results of this study are the first to indicate that the principles of social proof, liking, and authority were the most widely used in MIM phishing, followed by scarcity, reciprocity and commitment and consistency. Furthermore, most phishing messages have three persuasion principles, often a combination of authority, liking, and social proof. In most cases, phishers enforce authority by using logos and names of well-known organisations. Phishers reference famous people or stress the benefit of visiting fraudulent pages to implement the social proof principle. One of the ways scammers implement the social proof principle is by portraying that other users have acted in this manner in the past, so it is okay for the target to do the same. Most messages with the social proof principle contain the phrase "I have received mine" to deceive users into thinking that those sending the message have acted in the same way. Phishers have
persuaded many users to respond to MIM phishing messages using this approach [33, 34]. Liking is another persuasion principle that is easily implemented in MIM phishing because messages in MIM apps often come from those the recipient likes (i.e. friends or those they share similarities with, such as MIM app group members etc.) and may be accepted as legitimate because of the trust the recipient has with these categories of senders.

The study results show that the principles of reciprocity, commitment and consistency were used less frequently. It may be challenging for phishers to implement the elements of these principles. For example, it may be difficult for phishers to demonstrate an individual's previous commitment or consistency with a previous situation in MIM phishing unless the attack is targeted where trust has already been established between the phisher and the target through past interactions. Similarly, reciprocity may be easier to implement in a targeted attack since this principle requires the phisher to establish some trust with the target. For example, one of the questions for assessing reciprocity is, "Does the content of the message state or imply that the victim has already committed to helping them?" this question seems more appropriate for a targeted attack as it relies on past interaction between the phisher and the target.

Finally, this study shows that retail giants, aviation companies, and cryptocurrency platforms were the most targeted in MIM phishing. These results contradict earlier studies on email phishing, where education and health institutions were impersonated the most [26, 27]. Furthermore, the findings of this study revealed that most phishing examples include manipulated link previews that can deceive users into thinking they are visiting the right page. Authors in [4] have raised concerns about the potential of using link previews to deceive users into visiting fraudulent pages. This study confirms phishers' exploitation of link previews to direct users to fraudulent pages. The primary function of a link preview is to give users an idea of the webpage they are visiting. However, most of the components of the link preview can be manipulated, making it a tool that can support deception [4].

The literature on email phishing revealed that social proof was not widely used [17]; however, this study showed that social proof was the most used in MIM phishing, suggesting a potential difference between the two vectors. Although similar to [16], the study discovered that phishers rely heavily on stressing the benefit of complying in accordance with the social proof principle. For example, giveaway scams tend to emphasise why the targets should act quickly to prevent the risk of being left out.

Investigating which persuasion principles are used in MIM phishing could aid in designing appropriate phishing training tools to support users in detecting such scams. The results of this study show that phishers target everyday internet users in MIM phishing. Yet, some users may not know how to differentiate legitimate from fraudulent messages [34]. Recent findings have shown that current anti-phishing training materials focus on email [35], neglecting other vectors such as MIM apps. With phishing moving to MIM apps, existing training materials should be updated to reflect MIM phishing. For example, training materials should encourage users not to rely on the link preview as proof of legitimacy. In addition, phishing training approaches should emphasise the need for users to critically evaluate information shared by others during communication in MIM apps. They need to understand that not all information others share is legitimate and
that phishers may abuse their trust in their contacts to lure them into divulging personal information. A unique feature of MIM-based phishing is the ability of cybercriminals to appear to be people the victim knows and trusts as, in most cases, users get these messages from their unsuspecting contacts, who themselves lack the knowledge to evaluate the legitimacy of such messages. Furthermore, with various methods to hack MIM app accounts, phishing messages can be forwarded from hacked accounts. Users should be aware of the possibility of this and should always think before responding.

The findings of this study could be useful in developing automatic detection tools to curb the problem of phishing in MIM apps. Currently, most MIM apps do not have technical countermeasures for detecting phishing. Some MIM apps, such as Snapchat, rely on phishing blacklists, but this approach is ineffective. More advanced tools that use Artificial Intelligence to detect phishing in MIM apps should be developed. The findings in this study could be used by these tools. For example, recent research by [36] has shown that incorporating persuasion cues in phishing detection models improves accuracy. Thus, future phishing detection tools for MIM phishing should include relevant social proof cues for better performance. Elements could include whether the message indicates that the receiver will be left out in some way, whether the message portrays the risk associated with responding are shared with other people and whether the message portrays there is a benefit to complying. These elements can be captured by checking for the most frequently used words in MIM phishing, as shown in this study.

There are a few limitations that apply to this study. First, the sample phishing messages were taken from public websites via the Google search engine. As such, we may not have captured all the phishing emails circulated within the selected period. However, as phishing in MIM apps is a new trend, there are no verified databases of such scams, leaving us with the current approach as our only option. We also acknowledge the relatively small sample size used in our study, which we attribute to the emerging nature of MIM phishing. However, our sample falls within the range used in the literature [16].

# 6 Conclusion

Users of MIM apps have been the subject of phishing attacks in recent years. Yet, these apps currently lack countermeasures to effectively protect users from phishing scams. This paper offers insight into the use of persuasion principles in MIM phishing scams. Our study reveals that most phishing examples used the principle of social proof to fool unsuspecting users. This is different from email phishing, where social proof was used only in a few attacks. However, in a typical phishing attack, phishers do not use persuasion principles alone. Instead, they combine them with other tactics. Our study provides the first step towards building automated solutions to identify phishing messages in MIM apps using persuasion cues. This approach has been shown to have some promise in detecting phishing emails [36]. Furthermore, the results of this study could help inform the development of future training programs to improve user awareness of MIM phishing.

In future work, we intend to collect more sample phishing messages and perform a more in-depth analysis of these attacks and create a taxonomy of phishing attacks in MIM phishing. Furthermore, we aim to investigate how effective persuasion principles are in MIM phishing by experimenting with users to determine their susceptibility.
**Acknowledgement.** This work is part of a PhD research sponsored by the Petroleum Technology Development Fund (PTDF)-Nigeria. There were no conflicts of interest in this study.

## References

1. NCSC. https://www.ncsc.gov.uk/guidance/phishing. Accessed 25 Jan 2021

2. Mendoza, M.Á.: https://www.welivesecurity.com/2022/06/30/costco-40th-anniversary-scam-targets-whatsapp-users/. Accessed 13 Mar 2023

3. Kaspersky. https://www.kaspersky.com/about/press-releases/2021_phishing-in-messenger-apps-whats-new. Accessed 04 Jan 2022

4. Stivala, G., Pellegrino, G.: Deceptive previews: a study of the link preview trustworthiness in social platforms. In: 27th Annual Conference: NDSS Network and Distributed Systems Security Symposium, San Diego (2020)

5. Snapchat. How Snapchat Uses Google Safe Browsing. https://helpOIYSnapchatOHcyhc/en-us/artIcles/7012345182356-How-Snapchat-Uses-Google-Safe-Browsing. Accessed 27 May 2023

6. WhatsApp. https://faq.whatsapp.com/2286952358121083. Accessed 27 May 2023

7. Sheng, S., Wardman, B., Warner, G., Cranor, L.F., Hong, J., Zhang, C.: An empirical analysis of phishing blacklists. In: 6th Conference in Email and Anti-Spam ser. CEAS 2009 Mountain view, California (2009)

8. Smadi, S., Aslam, N., Zhang, L.: Detection of online phishing email using dynamic evolving neural network based on reinforcement learning. Decis. Support Syst. **107**, 88–102 (2018). https://doi.org/10.1016/j.dss.2018.01.001

9. FTC. https://www.consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams. Accessed 16 Mar 2020

10. APWG. Phishing Activity Trends Report Retrieved (2019)

11. Albakry, S., Vaniea, K., Wolters, M.K.: What is this URL’s destination? Empirical evaluation of users’ URL reading. In: 2020 CHI Conference on Human Factors in Computing Systems, pp. 1–12. ACM, Honolulu (2020). https://doi.org/10.1145/3313831.3376168

12. Ahmad, R., Terzis, S.: Understanding phishing in mobile instant messaging: a study into user behaviour toward shared links. In: Clarke, F., Steven, F. (eds.) International Symposium on Human Aspects of Information Security and Assurance. HAISA 2022. IFIP Advances in Information and Communication Technology, vol. 658, pp. 197–206. Springer, Cham (2022). https://doi.org/10.1007/978-3-031-12172-2_15

13. Goel, D., Jain, A.K.: Mobile phishing attacks and defence mechanisms: State of the art and open research challenges. Comput. Secur. **73**, 519–544 (2018)

14. Agarwal, P., Raman, A., Ibosiola, D., Sastry, N., Tyson, G., Garimella, K.: Jettisoning junk messaging in the era of end-to-end encryption: a case study of WhatsApp. In: The ACM Web Conference 2022, pp. 2582–2591. ACM, Virtual Event, Lyon France (2022)

15. Hadnagy, C.: Social Engineering: The Science of Human Hacking, 2nd edn. Wiley, Canada (2018)

16. Jones, K.S., Armstrong, M.E., Tornblad, M.K., Namin, A.S.: How social engineers use persuasion principles during vishing attacks. Inf. Comput. Secur. **29**(2), 314–331 (2020). https://doi.org/10.1108/ICS-07-2020-0113

17. Ferreira, A., Coventry, L., Lenzini, G.: Principles of persuasion in social engineering and their use in phishing. In: Tryfonas, T., Askoxylakis, I. (eds.) HAS 2015. LNCS, vol. 9190, pp. 36–47. Springer, Cham (2015). https://doi.org/10.1007/978-3-319-20376-8_4

18. Cialdini, R.B.: Influence: the psychology of persuasion, revised edition. New York, William Morrow (2006)
19. Uebelacker, S., Quiel, S.: The social engineering personality framework. In: 8th Workshop on Socio-Technical Aspects in Security and Trust (STAST 2014), pp. 24–30. IEEE, Australia, (2014). https://doi.org/10.1109/STAST.2014.12

20. Gragg, D.: A multi-level defense against social engineering. SANS Read. Room **13**, 1–21 (2003)

21. Stajano, F., Wilson, P.: Understanding scam victims: seven principles for systems security. Commun. ACM **54**(3), 70–75 (2011). https://doi.org/10.1145/1897852.1897872

22. Butavicius, M., Parsons, K., Pattinson, M., McCormac, A.: Breaching the human firewall: social engineering in phishing and spear-phishing emails. In: Proceedings of the Australasian Conference on Information Systems, Adelaide (2015). arXiv Prepr. arXiv 1606.00887

23. The Quint. https://www.thequint.com/news/india/fraudsters-dupe-over-rs-1-crore-from-serum-institute-by-posing-as-ceo-adar-poonawalla-whatsapp. Accessed 29 Apr 2023

24. Boddy, M. https://nakedsecurity.sophos.com/2018/04/04/free-virgin-atlantic-tickets-no-its-a-WhatsApp-scam. Accessed 31 May 2022

25. Akbar, N.: Analysing persuasion principles in phishing emails. University of Twente (2014)

26. Zielinska, O.A., Welk, A.K., Mayhorn, C.B., Murphy-Hill, E.: A temporal analysis of persuasion principles in phishing emails. In: Proceedings of the Human Factors and Ergonomics Society Annual Meeting, vol. 60, no. 1, pp. 765–769 (2016)

27. Akdemir, N., Yenal, S.: How phishers exploit the coronavirus pandemic: a content analysis of COVID-19 themed phishing emails. SAGE Open **11**(3), 21582440211031880 (2021). https://doi.org/10.1177/21582440211031879

28. O'Hara, K., Massimi, M., Harper, R., Rubens, S., Morris, J.: Everyday dwelling with WhatsApp. In: 17th ACM Conference on Computer Supported Cooperative Work & Social Computing, pp. 1131–1143. ACM, Maryland USA (2014). https://doi.org/10.1145/2531602.2531679

29. Ferreira, A., Coventry, L., Lenzini, G.: Principles of persuasion in social engineering and their use in phishing: In: Tryfonas, T., Askoxylakis, I. (eds.) Human Aspects of Information Security, Privacy, and Trust: Third International Conference, HAS 2015. Lecture Notes in Computer Science, vol. 9190, pp. 36–47. Springer, Cham (2015). https://doi.org/10.1007/978-3-319-20376-8_4

30. Ferreira, A., Jakobsson, M.: Persuasion in Scams. In: Jakobsson, M. (eds.) Understanding social Engineering Based Scams, pp. 29–47, Springer, New York (2016). https://doi.org/10.1007/978-1-4939-6457-4_4

31. Windels, J. https://www.wandera.com/malware-family-whatsapp/. Accessed 20 Nov 2020

32. McHugh, M.L.: Interrater reliability: the kappa statistic. Biochem. Medica **22**(3), 276–282 (2012)

33. ActionFraud https://www.facebook.com/actionfraud/posts/this-latest-adidas-whatsapp-scam-is-another-example-of-a-clever-homograph-attack/2021054694578900/. Accessed 30 May 2023

34. iRadio. https://m.facebook.com/thisisiradio/posts/1927459280648472/?comment_id=1927565900637810. Accessed 30 May 2023

35. Mossano, M., Vaniea, K., Aldag, L., Düzgün, R., Mayer, P., Volkamer, M.: Analysis of publicly available anti-phishing webpages: contradicting information, lack of concrete advice and very narrow attack vector. In: 2020 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), pp. 130–139 (2020)

36. Valecha, R., Mandaokar, P., Rao, H.R.: Phishing email detection using persuasion cues. IEEE Trans. Dependable Secur. Comput. **19**(2), 747–756 (2021)