Despite improved spam filtering technology, phishing continues to be a prevalent threat for college students. The current study found that approximately 4-in-10 of the students surveyed (N = 462) indicate they do not know what phishing is and the threat it poses. Students also report initially overestimating their confidence to successfully recognize phishing attempts, and underestimating their susceptibility to being the victim of an attack. By completing an interactive online phishing quiz, which explained what to look for in both counterfeit and legitimate email messages, students’ self-efficacy to identify phishing attempts increased, as did their perceived susceptibility to phishing attacks, their perceptions of the severity of phishing, their intentions to learn more about the topic, and their intentions to discuss phishing with others. These results indicate that a simple, interactive online phishing quiz could be used as an effective teaching tool to supplement existing educational attempts regarding phishing on college campuses.
AjzenI. (2011) The theory of planned behavior: Reactions and reflections. Psychology and Health26: 1113–1127.
2.
AlsharnoubyM.AlacaF.ChiassonS. (2015) Why phishing still works: User strategies for combating phishing attacks. International Journal of Human-Computer Studies82: 69–82.
3.
Anandpara, V., Dingman, A., Jakobsson, M., Liu, D., & Roinestad, H. (2007). Phishing IQ tests measure fear, not ability. In S. Dietrich & R. Dhamija (Eds.), Lecture Notes in Computer Science – Volume 4886: Financial Cryptography and Data Security (pp. 362–366). Heidelberg, Germany: Springer. doi:10.1007/978-3-540-77366-5_33.
4.
AtkinC. K. (1972) Anticipated communication and mass media information-seeking. Public Opinion Quarterly36(2): 188–199.
Carman, A. (2015). New Windows 10 phishing scam spotted, complete with faked antivirus scan message. Retrieved from: www.scmagazine.com.
8.
CaseC. J.KingD. L. (2008) Phishing for undergraduate students. Research in Higher Education Journal1: 100–106.
9.
CaseC. J.KingD. L. (2016) Phishing: Are undergraduates at risk and prepared?Issues in Information Systems17: 80–88.
10.
HarleyD.LeeA. (2007) Phish phodder: Is user education helping or hindering?17th Virus Bulletin Conference Proceedings, Vienna, Austria. 1–7.
11.
Hubbard, R. (2015). Imposters bilk Omaha’s Scholar Co. out of $17.2 million. Retrieved from: www.omaha.com.
12.
Johnston, N. (2014). Google docs users targeted by sophisticated phishing scam. Retrieved from: www.symantec.com/connect.
13.
KatsinasS. G.D’AmicoM. M.FriedelJ. N.AdairJ. L.WarnerJ. L.MalleyM. S. (2016) After the great recession: Higher education’s new normal, Tuscaloosa, AL: Education Policy Center—The University of AlabamaRetrieved from http://uaedpolicy.ua.edu/uploads/2/1/3/2/21326282/sdr_2016.pdf.
14.
KulikJ. A.KulikC. L. C. (1988) Timing of feedback and verbal learning. Review of Educational Research58(1): 79–97.
15.
KumaraguruP.CranshawJ.AcquistiA.CranorL.HongJ.BlairM. A.PhamT. (2009, July) School of phish: A real-world evaluation of anti-phishing training. Proceedings of the 5th Symposium on Usable Privacy and Security. ACM, p. 3. doi:10.1145/1572532.1572536.
16.
KumaraguruP.RheeY.ShengS.HasanS.AcquistiA.CranorL. F.HongJ. (2007, October) Getting users to pay attention to anti-phishing education: Evaluation of retention and transfer. Proceedings of the anti-phishing working group’s 2nd annual eCrime researchers summit. ACM, 70–81. doi:10.1145/1299015.1299022.
17.
KumaraguruP.ShengS.AcquistiA.CranorL. F.HongJ. (2010) Teaching Johnny not to Fall for Phish. ACM Transactions on Internet Technology (TOIT)10(2): 7, doi:10.1145/1754393.1754396.
VishwanathA.HerathT.ChenR.WangJ.RaoH. R. (2011) Why do people get phished? Testing individual differences in phishing vulnerability within an integrated information processing model. Decision Support Systems51: 576–586.
22.
WernerL. A.CourteJ. (2010) Analysis of an anti-phishing lab activity. Information Systems Education Journal8: 3–8.
23.
WitteK. (1992) Putting the fear back into fear appeals: The extended parallel process model. Communication Monographs59: 329–349.
24.
WitteK. (1994) Generating effective risk messages: How scary should your risk communication be? In: BurlesonB. R. (ed.) Communication yearbookVol. 18, Thousand Oaks, CA: Sage, pp. 229–254.
25.
WitteK.AllenM. (2000) A meta-analysis of fear appeals: Implications for effective public health campaigns. Health Education and Behavior27: 591–615.
26.
WitteK.CameronK. A.McKeonJ. K.BerkowitzJ. M. (1996) Predicting risk behaviors: Development and validation of a diagnostic scale. Journal of Health Communication1: 317–341.
