A Survey on the Principles of Persuasion as a Social Engineering Strategy in Phishing

TL;DR

This survey reviews how persuasion principles are employed in phishing attacks, especially spear phishing, emphasizing the need for further research to understand and counteract these social engineering strategies.

Contribution

It systematically summarizes current knowledge on persuasion in phishing and identifies gaps, highlighting the importance of understanding these tactics for better defense.

Findings

Spear phishing is highly effective due to targeted message customization.

Persuasion principles like social proof and authority are commonly exploited.

There is a significant research gap in understanding persuasion's impact in phishing.

Abstract

Research shows that phishing emails often utilize persuasion techniques, such as social proof, liking, consistency, authority, scarcity, and reciprocity to gain trust to obtain sensitive information or maliciously infect devices. The link between principles of persuasion and social engineering attacks, particularly in phishing email attacks, is an important topic in cyber security as they are the common and effective method used by cybercriminals to obtain sensitive information or access computer systems. This survey paper concluded that spear phishing, a targeted form of phishing, has been found to be specifically effective as attackers can tailor their messages to the specific characteristics, interests, and vulnerabilities of their targets. Understanding the uses of the principles of persuasion in spear phishing is key to the effective defence against it and eventually its elimination. This survey paper systematically summarizes and presents the current state of the art in understanding the use of principles of persuasion in phishing. Through a systematic review of the existing literature, this survey paper identifies a significant gap in the understanding of the impact of principles of persuasion as a social engineering strategy in phishing attacks and highlights the need for further research in this area.