Users really do respond to smishing
Muhammad Lutfor Rahman, Daniel Timko, Hamid Wali, and Ajaya Neupane

TL;DR
This study demonstrates that a significant portion of mobile users respond to smishing attacks, highlighting the effectiveness of social engineering tactics in mobile security breaches.
Contribution
The paper provides empirical evidence on smishing attack efficacy and identifies user response patterns, extending prior research on social engineering attacks to mobile text messaging.
Findings
16.92% of participants responded to smishing messages
12.82% responded again in repeat attacks
Response likelihood increases with REPLY and CLICK actions
Abstract
Text phish messages, referred to as Smishing is a type of social engineering attack where fake text messages are created, and used to lure users into responding to those messages. These messages aim to obtain user credentials, install malware on the phones, or launch smishing attacks. They ask users to reply to their message, click on a URL that redirects them to a phishing website, or call the provided number. Thousands of mobile users are affected by smishing attacks daily. Drawing inspiration by the works of Tu et al. (USENIX Security, 2019) on Robocalls and Tischer et al. (IEEE Symposium on Security and Privacy, 2016) on USB drives, this paper investigates why smishing works. Accordingly, we designed smishing experiments and sent phishing SMSes to 265 users to measure the efficacy of smishing attacks. We sent eight fake text messages to participants and recorded their CLICK, REPLY,…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsSpam and Phishing Detection · Advanced Malware Detection Techniques · Privacy, Security, and Data Protection
