A Large-Scale Study of Device and Link Presentation in Email Phishing Susceptibility

Sijie Zhuo, Robert Biddle, Lucas Betts, Nalin A. G. Arachchilage, Yun Sing Koh, Danielle M. Lottridge, Giovanni Russello

Abstract: Phishing is one of the most prevalent social engineering attacks that targets both organisations and individuals. It is crucial to understand how email presentation impacts users’ reactions to phishing attacks. We hypothesised that device type and email presentation could potentially play a role, particularly in how links are displayed, which might influence susceptibility. In collaboration with the IT Services unit of a large organisation for a phishing training exercise, we conducted a study to explore the effects of device type and link presentation. Our findings revealed no significant difference in users’ susceptibility to phishing when using mobile devices versus computers. However, the masking of phishing links as buttons or hypertext appeared to be influential in shaping users’ behaviour. More specifically, users were significantly more likely to click on phishing links when masked as hypertext. These findings suggest that link presentation plays a significant role in users’ susceptibility to phishing attacks.