Can a conventional email phishing nudge help fight SMiShing attacks?

Abstract

Phishing attacks, a common cybersecurity threat, aim to deceive end-users into revealing sensitive information. While Human Factors researchers have extensively examined phishing in the email vector, the emergence of phishing in the SMS vector, known as SMiShing, has presented a new challenge. This study breaks new ground by investigating whether a conventional behavioral nudge intervention designed to combat email phishing can be effectively applied to SMiShing. A reflective nudge was implemented, providing participants with a message to encourage appropriate behavior. They were then tasked to sort email and text messages based on legitimacy. We manipulated the presence of nudge (present or absent) and the platform (email or text). Participants’ performance was measured using Signal Detection Theory, and they were asked to provide confidence ratings for each legitimacy decision. Our key findings revealed that the conventional nudge improved performance for email decisions, although it decreased user confidence. For text messages, the nudge hindered participants’ discrimination ability and did not significantly influence response bias performance or confidence ratings. Unfortunately, the effectiveness of the nudge did not simply transfer to text messages. We reflect on how to redesign the conventional nudge to increase its effectiveness against SMiShing.