Persuasion: How phishing emails can influence users and bypass security measures

Key finding

Merging Cialdini, Gragg and Stajano & Wilson into one set of social-engineering persuasion principles, the authors found authority, strong affect, integrity and reciprocation were the most common in phishing subject lines. Strong-affect and authority emails leaned on 'you/your' wording, reciprocation on 'we/us/our'.

Why it matters

Provides an evidence-based catalogue of the persuasion tactics attackers actually use, including emotional arousal, which grounds tactic-focused training.

Informs

• Pauses when a message pushes them to act fast supports
• Questions requests that lean on authority supports
• Confirms identity before helping context

Cite

Ferreira, A., & Teles, S. (2019). Persuasion: How phishing emails can influence users and bypass security measures. International Journal of Human-Computer Studies. https://doi.org/10.1016/j.ijhcs.2018.12.004