Looking Ahead The Psychology Behind the Persistence of Phishing Special Feature: The Psychology Behind the Persistence of Phishing How Social Engineering and Phishing Works Apart from understanding the effects of instilling fear and provoking emotions, Ms Teo Yi-Ling, Senior Fellow, Centre of Excellence for National Security, S. Rajaratnam School of International Studies there are also some other psychological vulnerabilities that may explain why people continue to be phished. There has been extensive study and research on what psychological vulnerabilities cause people to fall for online scams, and Phishing has emerged during COVID-19 as one of the most prominent these are summarised below:51 delivery methods of cyber compromise, by preying on human emotion and cognitive bias to craft effective lures. Cyber threats are not always • Authority. In the right context, people tend to be very responsive and compliant to assertions of authority. This is even so when the person asserting authority is not physically present; technological in nature — a chain is only as strong as the weakest link, and the human factor remains a distinct vulnerability. Threat actors may hence exploit human behaviour to achieve their aims. • Commitment and consistency. Society places a high value on people being committed to their promises (otherwise you are untrustworthy), and consistent in their behaviour (otherwise you are unpredictable and unreliable); Promoting Logic over Emotions? Fear is one of the most powerful be most susceptible psychologically emotions, and fundamentally, phishing to being phished. Phishing works the taps into the fears people have to least when people are focused on other such a degree that they are unable to urgent tasks at hand, and scam e-mails carefully discern the signs of scam tend to be sent when recipients are e-mails. Such e-mails appear to be from least likely to be preoccupied with other legitimate organisations or authorities matters, and may pay more attention to that possess personal or confidential them. According to research, phishing information of the recipient (banks or activity appears to be high around government agencies, for example), lunch breaks, in the early afternoon, or whose services provide quality and at the end of the work week. It is of life to the recipient (for example, all about trying to catch recipients off those provided by Amazon, Apple, or guard mentally.50 Messages are targeted Netflix). Receiving such an e-mail may to appeal to specific psychological have the effect of triggering fear in the vulnerabilities, the most successful ones Further, there is the phenomenon of people perceiving that they are recipient, and fear, as observed above, linking message with human factors, for reduces the ability to call on his or her example, time-limited communications invulnerable to phishing — people holding the belief that they would be ability for logical thinking. designed to enact peripheral (i.e. 49 • Reciprocation. An established norm of social interaction — when someone gives us (or promises to give us) something, we tend to feel a strong inclination to give something in return; • Liking and similarity. People tend to like people similar to them. Recognition of similar traits or characteristics is a mental shortcut in deciding to regard another person more positively; and • Scarcity. If an item is indicated to be in short or limited supply, people tend to be extremely responsive to such indication, as scarcity is perceived as a threat. Research shows that people desire an item even more when they are given urgent cues that their ability to obtain it, is or may be limited in some way. Also, the perception that others might be competing for the limited supply of the item may increase the person’s desire further. able to spot a scam, and not fall victim to it. This is an example of optimism bias: the notion that people think that others are more vulnerable than they emotional) rather than central The time at which a phishing e-mail is are. This mindset is associated with risk-taking, and the failure to heed information processing (i.e. logic). precautionary advice and warnings. sent is also crucial — cybercriminals choose certain times when people may 49 50 50 Irwin, Luke, “The psychology behind phishing attacks”, IT Governance Blog, 1 August 2019, https://www.itgovernance.co.uk/blog/the-psychology-behind-phishingattacks. Ibid. SINGAPORE CYBER LANDSCAPE 2019 51 Cialdini, Robert B., Influence (Revised Edition 1993). 51