South Africans’ susceptibility to phishing attacks

No AccessSouth Africans' susceptibility to phishing attacks Mariska C Wannenburg, Annamart Nieman, Blanche Steyn and Daniel G Wannenburg Mariska C Wannenburg1 https://orcid.org/0000-0002-5362-9342 , Annamart Nieman2 https://orcid.org/0000-0002-3145-7316 , Blanche Steyn2 https://orcid.org/0000-0003-0632-6346 and Daniel G Wannenburg3 https://orcid.org/0000-0002-6280-478X Affiliations 1Department Economic and Financial, Sciences, Akademia, Pretoria, South Africa 2Department of Auditing, University of Pretoria, Pretoria, South Africa 3First National Bank, Pretoria, South Africa Published Online:1 Nov 2023https://doi.org/10.54483/sajaar.2023.25.1.4https://hdl.handle.net/10520/ejc-sajaar_v25_n1_a5SectionsPDFView Full Text ToolsAdd to favouritesDownload CitationsTrack Citations ShareShare onFacebookTwitterLinked InRedditGMailOutlookCopy LinkMendeley AboutAbstractPurpose:The purpose of the study is to assess the phishing susceptibility of individuals in South Africa, across industries related to financial services, education, legal services, and fraud- and forensic businesses.Design/Methodology/Approach:This was an empirical, quantitative research study that collected anonymised data on simulated phishing attacks, using a survey. The results were statistically analysed to identify factors that were significantly related to the phishing score generated.Findings:This was the first South African study to develop a phishing susceptibility score. The following demographic categories demonstrated a higher likelihood of phishing susceptibility: the legal industry; Gen Z and Alpha; females; and participants with matric as the highest educational level. The only two variables that were found to be significantly related to the phishing susceptibility score were gender (with females more susceptible) and the variable relating to prior reporting of phishing attacks (rendering such reporters less susceptible).Research Limitations/Implications:The data collected from the online survey represents the perceptions of the individual respondents. The results of this research are valuable, not only to the participants in this study but also to organisations within other industries, as it highlights phishing susceptibility risks.Originality/Value:This study provides insight into factors influencing phishing susceptibility. For future research purposes, this study could be replicated within other industries in South Africa.Abroshan H.Devos J.Poels G.Laermans E.2021 "COVID-19 and phishing: Effects of human emotions, behavior, and demographics on the success of phishing attempts during the pandemic" IEEE Access 9121916121929 DOI: https://doi.org/10.1109/ACCESS.2021.3109091 Google ScholarAfandi N.A.Hamid I.R.A.2021 "Covid-19 phishing detection based on hyperlink using k-nearest neighbor (KNN) algorithm" Applied Information Technology and Computer Science 22287301[Online]. https://publisher.uthm.edu.my/periodicals/index.php/aitcs/article/view/2317/1288Accessed 30 October 2023 Google ScholarAlohali M.Clarke N.Li FFurnell S2018 "Identifying and predicting the factors affecting end-users' risk-taking behavior" Information and Computer Security 263306326 DOI: https://doi.org/10.1108/ICS-03-2018-0037 Google ScholarAshiru A2021 "Identifying phishing as a form of cybercrime in Nigeria" Journal of International Law and Jurisprudence 122176186 Google ScholarAustralian Competition and Consumer Commission2020Targeting scams 2019: A review of scam activity since 2009OnlineACCC https://www.accc.gov.au/publications/targeting-scams-report-on-scam-activity/targeting-scams-2019-a-review-of-scam-activity-since-2009Accessed: 10 September 2022 Google ScholarBerre T.T.Eggemoen V.Haugrud T.D.Le W.H.Sandnes M.2022Phishing awareness among students at NTNUOnlineNTNU https://folk.idi.ntnu.no/baf/eremcis/2022/Group17.pdfAccessed: 12 September 2022 Google ScholarBhadane AMane S.B.2018 "State of research on phishing and recent trends of attacks" I-Manager's Journal on Computer Science 541435 DOI: https://dx.doi.org/10.26634/jcom.5.4.14608 Google ScholarBidgoli M.Knijnenburg B.P.Grossklags JWardman B2019 "Report now. Report effectively. Conceptualizing the industry practice for cybercrime reporting" Proceedings of the 2019 Anti-Phishing Working Group Symposium on Electronic Crime Research (eCrime)PittsburghNovember 13-15110OnlineIEEE https://ieeexplore.ieee.org/document/9037577Accessed: 5 November 2022 Google ScholarCastillo D2021 "One click from disaster: An exploratory study of the impact of employees' perception of email protection on phishing susceptibility" PhD thesisSt. Thomas UniversityMiami Gardens[Online]. ProQuest. https://www.proquest.com/openview/649284a7f1c7f163a9aa6750e5de75e2/1.pdf?pq-origsite=gscholar&cbl=18750&diss=yAccessed: 28 September 2022 Google ScholarCisco2022What is phishing?OnlineCisco Systems, Inc[Online]. https://www.cisco.com/c/en/us/products/security/email-security/what-is-phishing.html#:~:text=Phishing%20is%20the%20practice%20of,malware%20on%20the%20victim's%20deviceAccessed: 27 August 2022 Google ScholarCosio N2021Are you smarter than a hacker?[Online]. Surfshark. https://surfshark.com/blog/phishing-quizAccessed: 27 August 2022 Google ScholarDaengsi T.Pornpongtechavanich PWuttidittachotti P.2022 "Cybersecurity awareness enhancement: A study of the effects of age and gender of Thai employees associated with phishing attacks" Education and Information Technologies 2747294752 DOI: https://doi.org/10.1007/s10639-021-10806-7 Google ScholarDe Bona M.Paci F.2020 "A real world study on employees' susceptibility to phishing attacks" Proceedings of the 15th International Conference on Availability, Reliability and SecurityDublinAugust 25-28OnlineACM Digital Library https://dl.acm.org/doi/abs/10.1145/3407023.3409179Accessed: 9 September 2022 Google ScholarDiaz A.Sherman A.T.Joshi A.2020 "Phishing in an academic community: A study of user susceptibility and behavior" Cryptologia 4415367 DOI: https://doi.org/10.1080/01611194.2019.1623343 Google ScholarGeorgiadou A.Mouzakitis S.Askounis D.2022 "Working from home during COVID-19 crisis: A cyber security culture assessment survey" Security Journal 35486505 DOI: https://doi.org/10.1057/s41284-021-00286-2 Google ScholarGoogle2022Can you spot when you're being phished?OnlineGoogle https://phishingquiz.withgoogle.com/Accessed: 27 August 2022 Google ScholarHayes A.F.2022Introduction to mediation, moderation, and conditional process analysis. A regression-based approach3rdNew York, NYGuilford Press Google ScholarKhatri K.K.Karki D.2022 "Uses and limitations of quantitative research in English language education" Bouddhik Abhiyan 717075 DOI: https://doi.org/10.3126/bdkan.v7i1.47565 Google ScholarKnowBe42022aPhishing by industry benchmarking reportOnlineKnowBe4 https://www.knowbe4.com/hubfs/2022-Phishing-by-Industry-Benchmarking-Report.pdf?hsCtaTracking=5545cbd3-4d37-4ec2-a8120b2830feefbb%7C753ae012-a008-46ca-ade5-5035e74f6667Accessed: 10 September 2022 Google ScholarKnowBe42022bWho we areOnlineKnowBe4 https://www.knowbe4.com/about-us/Accessed: 29 September 2022 Google ScholarKunnan A.J.Liao C.L.2019 "Modeling relationships among young learners' self-assessment, learning attitude, and language test performance" The Journal of Asia TEFL 162701710 DOI: http://dx.doi.org/10.18823/asiatefl.2019.16.2.18.701 Google ScholarLain D.Kostiainen KCapkun S.2022 "Phishing in organizations: Findings from a large-scale and long-term study" Proceedings of the 2022 IEEE Symposium on Security and PrivacySan FranciscoMay 22-26842859OnlineIEEE https://ieeexplore.ieee.org/abstract/document/9833766Accessed: 7 November 2022 Google ScholarLi W.Lee J.Purl J.Greitzer F.L.Yousefi BLaskey K.B.2020 "Experimental investigation of demographic factors related to phishing susceptibility" Proceedings of the 53rd Hawaii International Conference on System ScienceMaui, 7-10 January 7-1022402249[Online]. University of Hawaiʻi at Mānoa Library. https://scholarspace.manoa.hawaii.edu/items/fd80b2a4-e51d-4704-bd8a-d2377a5d00aaAccessed: 29 September 2022 Google ScholarLin T.Capecci D.E.Ellis D.M.Rocha H.A.Dommaraju S.Oliveira D.S.Ebner N.C.2019 "Susceptibility to spear-phishing emails: Effects of internet user demographics and email content" ACM Transactions on Computer-Human Interaction 265128 DOI: https://doi.org/10.1145/3336141 Google ScholarMannix T.Petric G.Eriksen A.Paglia J.Roer K.2022 "Phishing susceptibility across industries" Schmorrow D.D.Fidopiastis C.M.Augmented cognitionChamSpringer DOI: https://doi.org/10.1007/978-3-031-05457-0_6 Google ScholarMarikyan DPapagiannidis S.2023Protection motivation theory: A reviewOnlineTheoryHub https://open.ncl.ac.uk/theory-library/protection-motivation-theory.pdfAccessed: 12 April 2023 Google ScholarNowitz J2018 "A modern perspective on phishing: An investigation into susceptibility to phishing attacks between mobile and desktop email clients" Master's thesisVictoria University of WellingtonWellingtonOnlineVictoria University of Wellington http://researcharchive.vuw.ac.nz/xmlui/bitstream/handle/10063/7907/thesis_access.pdf?sequence=5Accessed: 26 September 2022 Google ScholarOkpa J.T.Ajah B.O.Igbe J.E.2020 "Rising trend of phishing attacks on corporate organisations in Cross River State, Nigeria" International Journal of Cyber Criminology 142460478 DOI: https://doi.org/10.5281/zenodo.4770111 Google ScholarPósa TGrossklags J.2022 "Work experience as a factor in cyber-security risk awareness: A survey study with university students" Journal of Cybersecurity and Privacy 23490515 DOI: https://dx.doi.org/10.3390/jcp2030025 Google ScholarPowers J2018Test your phishing security knowledge with this quizOnlineTechTarget https://www.techtarget.com/searchenterprisedesktop/quiz/Test-your-phishing-security-knowledge-with-this-quizAccessed: 27 August 2022 Google ScholarQualtrics2022Projects[Online]. Qualtrics. https://qfreeaccountssjc1.az1.qualtrics.com/Q/MyProjectsSectionAccessed: 9 September 2022 Google ScholarRavi R.Shillare A.A.Bhoir P.P.Charumathi K.S.2021 "URL based email phishing detection application" International Research Journal of Engineering and Technology 84355360 Google ScholarSchuetz S.W.Lowry P.B.Pienta D.A.Thatcher J.B.2020 "The effectiveness of abstract versus concrete fear appeals in information security" Journal of Management Information Systems 373723757 DOI: https://doi.org/10.1080/07421222.2020.1790187 Google ScholarShahbaznezhad H.Kolini FRashidirad M.2021 "Employees' behaviour in phishing attacks: What Individual, organizational, and technological factors matter?" Journal of Computer Information Systems 616539550 DOI: https://doi.org/10.1080/08874417.2020.1812134 Google ScholarShaw C2020 "Why phishing works and the detection needed to prevent it" Master's dissertationUtica CollegeUtica[Online]. ProQuest. https://www.proquest.com/docview/2446039541?pq-origsite=gscholar&fromopenview=trueAccessed: 25 June 2022 Google ScholarSmith K.T.Jones A.Johnson LSmith L.M.2019 "Examination of cybercrime and its effects on corporate stock value" Journal of Information, Communication and Ethics in Society 1714260 DOI: https://doi.org/10.1108/JICES-02-2018-0010 Google ScholarSonicWall2022Sonicwall phishing IQ test[Online]. SonicWall. https://www.sonicwall.com/phishing-iq-test-landing/Accessed: 27 August 2022 Google ScholarSumner A.Yuan X.Anwar MMcBride M.2022 "Examining factors impacting the effectiveness of anti-phishing trainings" Journal of Computer Information Systems 625975997 DOI: https://doi.org/10.1080/08874417.2021.1955638 Google ScholarSun Z2022 "In the light and in the shadows: Human-centred analysis in cybercrime" PhD thesisArizona State UniversityPhoenix[Online]. ASU Library. https://keep.lib.asu.edu/items/168600Accessed: 2 October 2022 Google ScholarTaib R.Yu K.Berkovsky S.Wiggens MBayl-Smith P.2019 "Social engineering and organisational dependencies in phishing attacks" Proceedings of the 17th IFIP Conference on Human-Computer InteractionPaphosSeptember 2-6564584OnlineSpringer Nature https://link.springer.com/chapter/10.1007/978-3-030-29381-9_35Accessed: 25 September 2022 Google ScholarTian C.Jensen M.L.Durcikova A2018 "Phishing susceptibility across industries: The differential impact of influence techniques" Proceedings of the 13th Pre-ICIS Workshop on Information Security and PrivacySan FranciscoDecember 13116[Online]. AIS eLibrary. https://aisel.aisnet.org/wisp2018/25/Accessed: 1 October 2022 Google ScholarUnchit P.Das S.Kim ACamp L.J.2020 "Quantifying susceptibility to spear phishing in a high school environment using signal detection theory" Proceedings of the 14th International Symposium on Human Aspects of Information Security and AssuranceLesbosJuly 8-10109120OnlineCornell University https://arxiv.org/pdf/2006.16380.pdfAccessed: 8 September 2022 Google ScholarYang R.Zheng K.Wu B.Li D.Wang Z.Wang X.2022 "Predicting user susceptibility to phishing based on multidimensional features" Computational Intelligence and NeuroscienceJanuary111 DOI: https://doi.org/10.1155/2022/7058972 Google ScholarVerizon2022Data breach investigations report[Online]. Verizon. https://www.verizon.com/business/resources/reports/dbir/Accessed: 10 September 2022 Google ScholarVolkamer M.Sasse M.A.Boehm F.2020 "Analysing simulated phishing campaigns for staff" Proceedings of the 25th European Symposium on Research in Computer SecurityGuildfordSeptember 14-18116 DOI: https://doi.org/10.1007/978-3-030-66504-3_19 Google ScholarWarda ASamaddar J.2022 "A primary study on user perception of phishing in the banking sector" SJCC Management Research Review 1215979 Google ScholarWokabi F.M.2019 "Employee awareness on social engineering threats in the financial sector" Master's dissertationStrathmore UniversityNairobi[Online]. Strathmore University. http://su-plus.strathmore.edu/handle/11071/6784Accessed: 7 November 2022 Google ScholarYeoh W.Huang H.Lee W.S.Al Jafari F.Mansson R.2022 "Simulated phishing attack and embedded training campaign" Journal of Computer Information Systems 624802821 DOI: https://doi.org/10.1080/08874417.2021.1919941 Google ScholarZhuo S.Biddle R.Koh Y.S.Lottridge D.Russello G.2022 "SoK: Human-centered phishing susceptibility" ArxivFebruary118 DOI: https://doi.org/10.48550/arXiv.2202.07905 Google Scholar Previous article Next article FiguresReferencesRelatedDetails Volume 25, Issue 1 | Nov 2023 Downloaded 0 times AccreditationDepartment of Higher Education and Training (DHET)LanguagesAfrikaansEnglish InformationCopyright © 2023, Southern African Institute of Government Auditors (SAIGA):All rights reservedKeywordsPhishing susceptibilitydemographic informationphishing trainingphishing awarenessphishing reportingindustrygenerationsgendereducational levelsimulated phishing trainingPDF download Disclosure The authors confirm that the manuscript has been read and approved by all named authors and that there are no other persons who satisfied the criteria for authorship but are not listed. The authors confirm that they have given due consideration to the protection of intellectual property associated with this work and that there are no impediments to publication, including the timing of publication, with respect to intellectual property. Ethical conduct of research The authors state that they have obtained appropriate institutional review board outlined in the Declaration of Helsinki for all human or animal experimental investigations. A signed informed consent document has been obtained from all participants included in the study.