The influence of experiential and dispositional factors in phishing: An empirical investigation of the deceived

Journal of Management Information Systems

Volumn 27, Issue 1, 2010, Pages 273-303

  Wright, Ryan T ^a   Marett, Kent ^b  

^a UNIVERSITY OF SAN FRANCISCO   (United States)

^b MISSISSIPPI STATE UNIVERSITY   (United States)

Author keywords

computer mediated deception; electronic mail fraud; Internet security; interpersonal deception theory; phishing

Indexed keywords

ANTI-PHISHING; BEHAVIORAL FACTORS; DECEPTION DETECTION; EMPIRICAL INVESTIGATION; FIELD STUDIES; INFORMATION SYSTEMS MANAGERS; INTERNET SECURITY; INTERNET USERS; INTERPERSONAL DECEPTION THEORY; PERSONAL INFORMATION; PHISHING; RESEARCH MODELS; SENSITIVE INFORMATIONS;

COMPUTER CRIME; ELECTRONIC MAIL; INTERNET; RESEARCH;

INFORMATION DISSEMINATION;

EID: 77955042436     PISSN: 07421222     EISSN: None     Source Type: Journal    
DOI: 10.2753/MIS0742-1222270111     Document Type: Conference Paper

References (87)

1. Ahuja, M.K., and Thatcher, J.B. Moving beyond intentions and toward the theory of trying: Effects of work environment and gender on post-adoption information technology use. MIS Quarterly, 29, 3 (2005), 427-459.
2. Bellovin, S.M. Spamming, phishing, authentication, and privacy. Communications of the ACM, 47, 12 (2004), 144.
3. Berghel, H. Phishing mongers and posers. Communications of the ACM, 49, 4 (2006), 21-25.
4. Biros, D.; George, J.; and Zmud, R. Inducing sensitivity to deception in order to improve decision making performance: A field study. MIS Quarterly, 26, 2 (2002), 119-144.
5. Bond, C.F., and DePaulo, B.M. Accuracy of deception judgments. Personality and Social Psychology Review, 10, 3 (2006), 214-234.
6. Brown, T.A. Confirmatory Factory Analysis for Applied Research. New York: Guilford Press, 2006.
7. Buller, D., and Burgoon, J.K. Interpersonal deception theory. Communication Theory, 6, 3 (1996), 203-242.
8. Burgoon, J.; Bonito, J.; and Kam, K. Communication and trust under face-to-face and mediated conditions: Implications for leading from a distance. In S. Weisband and L. Atwater (eds.), Leadership at a Distance. Mahwah, NJ: Lawrence Erlbaum, 2004.
9. Burgoon, J.; Buller, D.; Ebesu, A.; and Rockwell, P. Interpersonal deception: V. Accuracy in deception detection. Communication Monographs, 61, 4 (1994), 303-325.
10. Carlson, J.R., and George, J. Media appropriateness in the conduct and discovery of deceptive communication: The relative influence of richness and synchronicity. Group Decision and Negotiation, 13, 2 (2004), 191-210.
11. Carlson, J.R., and Zmud, R. Channel expansion theory and the experiential nature of media richness perceptions. Academy of Management Review, 42, 2 (1999), 153-170.
12. Carlson, J.R.; George, J.F.; Burgoon, J.K.; Adkins, M.; and White, C.H. Deception in computer-mediated communication. Group Decision and Negotiation, 13, 1 (2004), 5-28.
13. Charki, M., and Josserand, E. Online reverse auctions and the dynamics of trust. Journal of Management Information Systems, 24, 4 (Spring 2008), 175-197.
14. Compeau, D.R., and Higgins, C.A. Application of social cognitive theory to training for computer skills. Information Systems Research, 6, 2 (1995), 118-143.
15. Compeau, D.R., and Higgins, C.A. Computer self-efficacy: Development of a measure and initial test. MIS Quarterly, 19, 2 (1995), 189-211.
16. Cooper, R., and Kahai, S. Exploring the core concepts of media richness theory: The impact of cue multiplicity and feedback immediacy on decision quality. Journal of Management Information Systems, 20, 1 (Summer 2003), 263-299.
17. Dennis, A.R.; Fuller, R.M.; and Valacich, J.S. Media, tasks, and communication processes: A theory of media synchronicity. MIS Quarterly, 32, 3 (2008), 575-600.
18. DePaulo, B.; Lindsay, J.J.; Malone, B.E.; Muhlenbruck, L.; Charlton, K.; and Cooper, H. Cues to deception. Psychological Bulletin, 129, 1 (2003), 74-118.
19. Dhamija, R.; Tygar, J.D.; and Hearst, M. Why phishing works. In R. Grinter, T. Rodden, P. Aoki, E. Cutrell, R. Jeffries, and G. Olson (eds.), Proceedings of the SIGCHI Conference on Human Factors in Computing Systems. New York: ACM Press, 2006, pp. 581-590.
20. Dinev, T., and Hart, P. Internet privacy concerns and social awareness as determinants of intention to transact. International Journal of Electronic Commerce, 10, 2 (Winter 2005-2006), 7-29.
21. Downs, J.; Holbrook, M.; and Cranor, L. Decision strategies and susceptibility to phishing. In L.F. Cranor (ed.), Proceedings of the Second Symposium on Usable Privacy and Security (SOUPS). New York: ACM Press, 2006.
22. Ekman, P.; O'Sullivan, M.; Friesen, W.; and Scherer, K. Face, voice, and body in detecting deceit. Journal of Nonverbal Behavior, 15, 2 (1991), 125-135.
23. Everard, A., and Galletta, D.F. How presentation flaws affect perceived site quality, trust, and intention to purchase from an online store. Journal of Management Information Systems, 22, 3 (2005), 55-95.
24. Evers, J. Security expert: User education is pointless. CNET News, 2009 (available at http://news.cnet.com/2100-7350-3-6125213.html).
25. Featherman, M.S., and Pavlou, P.A. Predicting e-services adoption: A perceived risk facets perspective. International Journal of Human-Computer Studies, 59, 4 (2003), 451-474.
26. Fornell, C., and Larcker, D.F. Evaluating structural equations models with unobservable variables and measurement error. Journal of Marketing Research, 18, 1 (1981), 39-50.
27. Fu, A.Y.; Wenyin, L.; and Deng, X.T. Detecting phishing Web pages with visual similarity assessment based on earth mover's distance (EMD). IEEE Transactions on Dependable and Secure Computing, 3, 4 (2006), 301-311.
28. Gabrieal, I.J., and Nyshadham, E. A cognitive map of people's online risk perceptions and attitudes: An empirical study. In R.H. Sprague (ed.), Proceedings of the 41st Annual Hawaii International Conference on System Sciences. Los Alamitos, CA: IEEE Computer Society Press, 2008 (available at www.computer.org/portal/web/csdl/doi/10.1109/HICSS.2008.6).
29. Gartner survey shows phishing attacks escalated in 2007; More than $3 billion lost to these attacks. Press Release Gartner, Stamford, CT, December 17, 2007 (available at www .gartner.com/it/page.jsp?id=565125).
30. Gefen, D.; Benbasat, I.; and Pavlou, P. A research agenda for trust in online environments. Journal of Management Information Systems, 24, 4 (Spring 2008), 275-286.
31. Gefen, D.; Straub, D.; and Boudreau, M. Structural equation modeling and regression: Guidelines for research practice. Communications of the AIS, 4, 7 (2000), 1-77.
32. George, J.F., and Carlson, J.R. Group support systems and deceptive communications. In R.H. Sprague (ed.), Proceedings of the 32nd Annual Hawaii International Conference on System Sciences. Los Alamitos, CA: IEEE Computer Society Press, 1999, pp. 1-10.
33. Goldsmith, J., and Wu, T. Who Controls the Internet? Illusions of a Borderless World. New York: Oxford University Press, 2006.
34. Gone phishing . . . A brief on anti-phishing exercise. New York State Office of Cyber Security & Critical Infrastructure Coordination, New York, 2005.
35. Goth, G. Phishing attacks rising, but dollar losses down. IEEE Security & Privacy, 3, 1 (2005), 8.
36. Grazioli, S., and Jarvenpaa, S. Perils of Internet fraud: An empirical investigation of deception and trust with experienced Internet consumers. IEEE Transactions on System, Man, and Cybernetics, 30, 4 (2000), 395-410.
37. Grazioli, S., and Jarvenpaa, S. Consumer and business deception on the Internet: Content analysis of documentary evidence. International Journal of Electronic Commerce, 7, 4 (Summer 2003), 93-118.
38. Greenberg, J. The college sophomore as guinea pig: Setting the record straight. Academy of Management Review, 12, 1 (1987), 157-159.
39. Gretzel, U., and Fesenmaier, D.R. Persuasion in recommender systems. International Journal of Electronic Commerce, 11, 2 (Winter 2006-2007), 81-100.
40. Gulati, R., and Gargiulo, M. Where do interorganizational networks come from? American Journal of Sociology, 104, 1 (1999), 1439-1493.
41. Hair, J.F., Jr.; Anderson, R.E.; Tatham, R.L.; and Black, W.C. Multivariate Data Analysis with Readings. Englewood Cliffs, NJ: Prentice Hall, 1998.
42. Hess, T.; Fuller, M.; and Mathew, J. Involvement and decision-making performance with a decision aid: The influence of social multimedia, gender, and playfulness. Journal of Management Information Systems, 22, 3 (Winter 2005-2006), 15-54.
43. Hoffman, D., Novak, T., and Peralta, M. Building consumer trust online. Communications of the ACM, 42, 4 (1999), 80-85.
44. Hsieh, J.J.P.-A.; Rai, A.; and Keil, M. Understanding digital inequality: Comparing continued use behavioral models of the socio-economically advantaged and disadvantaged. MIS Quarterly, 32, 1 (2008), 97-126.
45. Hughes, C., and Gibson, M.L. Students as surrogates for managers in a decision-making environment: An experimental study. Journal of Management Information Systems, 8, 2 (Fall 1991), 153-166.
46. Jagatic, T.N.; Johnson, N.A.; Jakobsson, M.; and Menczer, F. Social phishing. Communications of the ACM, 50, 10 (2007), 94-100.
47. Jarvenpaa, S.L., and Todd, P. Consumer reactions to electronic shopping on the World Wide Web. International Journal of Electronic Commerce, 2, 1 (Fall 1997), 59-88.
48. Jarvenpaa, S.L.; Tractinsky, N.; and Saarinen, L. Consumer trust in an Internet store: A cross-cultural validation. Journal of Computer-Mediated Communication, 5, 2 (2000), 45-71.
49. Jessup, L., and Valacich, J. Information Systems Today. Upper Saddle River, NJ: Pearson Prentice Hall, 2005.
50. Kacmar, M.; Ratcliff, S.; and Ferris, G. Employment interview research: Internal and external validity. In R.W. Eeder and G.R. Ferris (eds.), The Employment Interview: Theory, Research, and Practice. Newbury Park, CA: Sage, 1989, 32-42.
51. Kline, T. Psychological Testing: A Practical Approach to Design and Evaluation. London: Sage, 2005.
52. Kumaraguru, P.; Rhee, Y.; Acquisti, A.; Cranor, L.; Hong, J.; and Nunge, E. Protecting people from phishing: The design and evaluation of an embedded training email systems. In B. Begole, S. Payne, E. Churchill, R. St. Amant, D. Gilmore, and M.B. Rosson (eds.), Proceedings of the SIGCHI Conference on Human Factors in Computing Systems. New York: ACM Press, 2007.
53. Larcom, G., and Elbirt, A.J. Gone phishing. IEEE Technology and Society Magazine, 25, 3 (2006), 52-55.
54. Lewicki, R.; McAllister, D.; and Bies, R. Trust and distrust: New relationships and realities. Academy of Management Review, 23, 3 (1998), 438-458.
55. Liu, W.; Deng, X.; Huang, G.; and Fu, A.Y. An antiphishing strategy based on visual similarity assessment. IEEE Internet Computing, 10, 2 (2006), 58-65.
56. Malhotra, N.K.; Kim, S.S.; and Agarwal, J. Internet users' information privacy concerns (IUIPC): The construct, the scale, and a causal model. Information Systems Research, 15, 4 (2004), 336-355.
57. Mayer, R.C.; Davis, J.H.; and Schoorman, F.D. An integrative model of organizational trust. Academy of Management Review, 20, 3 (1995), 709-734.
58. McKnight, D.H., and Chervany, N. What trust means in e-commerce customer relationships: An interdisciplinary conceptual typology. International Journal of Electronic Commerce, 6, 2 (Winter 2001-2002), 35-59.
59. McKnight, D.H.; Choudhury, V.; and Kacmar, C. Developing and validating trust measures for e-commerce: An integrative typology. Information Systems Research, 13, 3 (2002), 334-359.
60. McKnight, D.H.; Kacmar, C.; and Choudhury, V. Dispositional trust and distrust distinctions in predicting high- and low-risk Internet expert advice site perceptions. e-Service Journal, 3, 2 (2004), 35-58.
61. McKnight, D.H.; Kacmar, C.; and Choudhury, V. Whoops . . . Did I use the wrong construct to predict e-commerce trust? Modeling the risk-related effects of trust versus distrust concepts. In R.H. Sprague (ed.), Proceedings of the 36th Annual Hawaii International Conference on System Sciences. Los Alamitos, CA: IEEE Computer Society Press, 2003 (available at www .hicss.hawaii.edu/ HICSS36/HICSSpapers/INCRM04.pdf).
62. McKnight, H.; Cummings, L.L.; and Chervany, N. Initial trust formation in new organizational relationships. Academy of Management Review, 23, 3 (1998), 473-490.
63. Miller, G.R., and Stiff, J.B. Deceptive Communication. London: Sage, 1993.
64. Mitnick, K.D., and Simon, W. The Art of Intrusion. Indianapolis: Wiley, 2005.
65. Muthen, B. Goodness of fit with categorical and other non-normal variables. In K.A. Bollen and J.S. Long (eds.), Testing Structural Equation Models. Newbury Park, CA: Sage, 1993, 205-243.
66. Muthen, L.K., and Muthen, B. Mplus User's Guide. Los Angeles: Muthen & Muthen, 2007.
67. Nicholson, D.; Nicholson, J.; Parboteeah, V.; and Valacich, J. Using distraction-conflict theory to measure the effects of distractions on individual task performance in a wireless mobile environment. In R.H. Sprague (ed.), Proceedings of the 38th Annual Hawaii International Conference on System Sciences. Los Alamitos, CA: IEEE Computer Society Press, 2005 (available at www.computer.org/portal/web/csdl/doi/10.1109/HICSS.2005.657).
68. Nunnally, J.C., and Bernstein, I.H. Psychometric Theory. New York: McGraw-Hill, 1994.
69. Park, H.S.; Levine, T.; McCornack, S.; Morrison, K.; and Ferrara, M. How people really detect lies. Communication Monographs, 69, 2 (2002), 144-157.
70. Phishing activity trends report. Anti-Phishing Working Group. Chicago, 2006.
71. Protecting against phishing by implementing strong two-factor authentication. White Paper, RSA Security, Bedford, MA, 2008.
72. Rao, S., and Lim, J. The impact of involuntary cues on media effects. In R.H. Sprague (ed.), Proceedings of the 33rd Annual Hawaii International Conference of System Sciences. Los Alamitos, CA: IEEE Computer Society Press, 2000.
73. Santhanam, R.; Sasidharan, S.; and Webster, J. Using self-regulatory learning to enhance e-learning-based information technology training. Information Systems Research, 19, 1 (2008), 26-47.
74. Sheng, S.; Magnien, B.; Kumaraguru, P.; Acquisti, A.; Cranor, L.F.; Hong, J.; and Nunge, E. Anti-phishing Phil: The design and evaluation of a game that teaches people not to fall for phish. In L.F. Cranor (ed.), Proceedings of the Third Symposium on Usable Privacy and Security (SOUPS). New York: ACM Press, 2007.
75. Sitkin, S., and Pablo, A. Reconceptualizing the determinants of risk behavior. Academy of Management Review, 17, 1 (1992), 9-38.
76. Sitkin, S., and Weingart, L. Determinants of risky decision-making behavior: A test of the mediating role of risk perceptions and propensity. Academy of Management Journal, 38, 6 (1995), 1573-1592.
77. Spurling, P. Promoting security awareness and commitment. Information Management & Computer Security, 3, 2 (1995), 20-26.
78. Stanton, J.M.; Stam, K.R.; Mastrangelo, P.; and Jolton, J. Analysis of end user security behaviors. Computers & Security, 24, 2 (2005), 124-133.
79. Straub, D.W. Effective IS security: An empirical study. Information Systems Research, 1, 2 (1990), 255-277.
80. Straub, D.W., and Welke, R.J. Coping with systems risk: Security planning models for management decision making. MIS Quarterly, 22, 4 (1998), 441-469.
81. Vrij, A. Detecting Lies and Deceit: The Psychology of Lying and the Implications for Professional Practice. Chichester, UK: John Wiley & Sons, 2000.
82. Weber, E., and Milliman, R. Perceived risk attitudes: Relating risk perception to risky choice. Management Science, 43, 2 (1997), 123-145.
83. Webster, J., and Ahuja, J.S. Enhancing the design of web navigation systems: The influence of user disorientation on engagement and performance. MIS Quarterly, 30, 3 (2006), 661-678.
84. Wu, M.; Miller, R.C.; and Garfinkel, S.L. Do security toolbars actually prevent phishing attacks? In R. Grinter, T. Rodden, P. Aoki, E. Cutrell, R. Jeffries, and G. Olson (eds.), Proceedings of the SIGCHI Conference on Human Factors in Computing Systems. New York: ACM Press, 2006.
85. Yao, M.Z.; Rice, R.E.; and Wallis, K. Predicting user concerns about online privacy. Journal of the American Society for Information Science & Technology, 58, 5 (2007), 710-722.
86. Zhou, L. An empirical investigation of deception behavior in instant messaging. IEEE Transactions on Professional Communication, 48, 2 (2005), 147-160.
87. Zhou, L.; Burgoon, J.K.; Twitchell, D.P.; Qin, T.; and Nunamaker, J.R., Jr. A comparison of classification methods for predicting deception in computer-mediated communication. Journal of Management Information Systems, 20, 4 (Spring 2004), 139-166.