The Role of Cue Utilisation and Anxiety on Phishing Email Susceptibility

Abstract

A ‘phishing email’ is an attempt to solicit personal or sensitive information from an unsuspecting user. Phishing emails currently represent a major threat to cybersecurity, and as such, researchers have begun to recognise the importance of identifying various individual differences that might predict phishing email susceptibility. The current study aimed to further understand individual differences and examine the relationship between an individual’s capacity for cue utilisation and levels of state/trait anxiety with phishing email susceptibility. Thirty-two participants completed a lab-based study where they were presented with a series of emails (phishing and genuine) and rated the extent to which they felt it was ‘okay’ to click on a link embedded within the email. Participants were then classified into typologies of cue utilisation and state/trait anxiety. While it was hypothesised that those categorised as having higher cue utilisation would be better able to discriminate between phishing and genuine emails, analyses did not support this prediction. However, it was found that those categorised as having higher levels of trait anxiety were less able to discriminate between phishing and genuine emails compared to their less anxious counterparts. The theoretical findings of the present study could help inform phishing education, training and awareness programs.