When a clever phishing message or phone call happens to be delivered to a person at the right moment, it is possible that the target follows the instructions given by cyber criminals. A recent research discovered that up to 30 percent of people may fall for phishing attempts if they go on long enough. This and other bits of valuable information is available in the research paper Phishing in Organizations: Findings from a Large-Scale and Long-Term Study by the ETH Zurich University, Switzerland.
If 30 percent (32.10% to be exact) seems like a high number for people who fall for phishing attempts, it is. According to the research, the reason is that when people are exposed long enough to phishing attempts, even the sharpest internet user may fail to avoid the trap. This is what makes the Zurich study exceptional: the researchers had agreed with the leaders of a large multi-industry company that they could run their experiment with 14,733 participants over a 15-month period. The researchers selected their phishing targets from a large variety of employee groups, ages and experience level.
25.43% of users followed phishing instructions, and performed a harmful action that simulated what cyber criminals would have wanted.
In addition, a number of employees learned nothing but fell for the phishing attempts multiple times. Out of those who clicked a phishing message, about 30% did it more than once.
Age groups that were most likely to fall for phishing were the youngest and the oldest employees. People who have experience with computers, who have encountered phishing earlier, or are higher up in the organizational hierarchy were the least likely to fall for phishing.
Methods to prevent phishing
So, are we doomed? Phishing is the technique ransomware criminals typically use to get into an organization’s computer systems. Phishing is also used by attackers who, for instance, want to install a spy software or a program that silently runs cryptomining for them on your computer. It doesn’t look promising if a third of computer users can be relatively easily misled to do harmful actions.
Fortunately, the report Phishing in Organizations gives us some hints for measures that can help prevent phishing.
Short warnings about potential problems inserted into messages help avoid phishing. Phishing messages that didn’t include a warning were followed three times more often than messages that had a warning. The researchers probably inserted warnings in messages manually, but some day, spam filter programs and artificial intelligence can be applied to do the same as well. The warnings in the experiment were inserted in the beginning of messages: “Be careful! This message might be trying to steal your personal information.”
Crowdsourcing is a potential method to increase detection of phishing attempts. People who actually receive potentially harmful messages and phone calls can easily report ongoing attacks. Large organizations have the resources to manage the process of reporting phishing, performing counter measures, and keeping the organization up-to-date on the situation.
The research doesn’t give high hopes for training. Especially, online courses that employees can simply view and answer some questions, wasn’t an effective way to improve awareness. Active training, such as game-like simulations that show what actually happens during an attack are more effective.