💻 computer science

Profiling User Vulnerability to Phishing Through Psychological and Behavioral Factors

This study analyzes the Spamley dataset to identify five psychological and behavioral constructs of phishing susceptibility, revealing that a combination of operational maturity, decision-making speed, and cognitive approach—not just technical knowledge—distinguishes vulnerable users and necessitates a shift toward personalized, adaptive cybersecurity training.

Original authors: Valeria Formisano, Danilo Gentile, Gennaro Esposito Mocerino, Michela Ponticorvo, Luigi Gallo, Alessio Botta, Davide Marocco

Published 2026-05-21

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Valeria Formisano, Danilo Gentile, Gennaro Esposito Mocerino, Michela Ponticorvo, Luigi Gallo, Alessio Botta, Davide Marocco

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine your email inbox as a bustling train station. Most of the time, the trains (emails) are legitimate passengers heading to the right destination. But occasionally, a "fake train" disguised as a real one pulls up, hoping to trick you into boarding it and handing over your valuables. This is phishing.

For a long time, cybersecurity experts thought the solution was just building better fences and locks (technology). But this paper argues that the real weak spot isn't the fence; it's the passenger (you). The researchers wanted to figure out: What kind of person is most likely to get on the fake train?

Here is the story of their investigation, broken down simply:

1. The Great Experiment

The researchers gathered a massive group of 1,086 people from all walks of life. They didn't just ask them questions; they put them in a realistic simulation. Imagine a test where you are handed 10 emails that look exactly like real ones you'd get at work or home. Some are safe; some are traps. Your job is to spot the traps.

While you did this, the researchers watched two things:

Did you get it right? (Did you spot the fake?)
How fast did you decide? (Did you click "safe" or "fake" instantly, or did you pause to think?)

2. The Five "Personality Ingredients"

The researchers realized that being good or bad at spotting fakes isn't about just one thing. They used a statistical "smoothie blender" (called Exploratory Factor Analysis) to mix all the data and found five main ingredients that make up a person's digital personality:

Seniority: How old you are and how much work experience you have.
Expertise: How much you know about computers and tech.
Creativity: This is a tricky one. In this study, it didn't mean "good at art." It meant being open to new ideas, outgoing, and willing to take risks.
Stability: How calm and emotionally steady you are.
Vulnerability: How easily you get swayed by tricks like "Authority" (someone yelling at you) or "Scarcity" (a deal that expires in 5 minutes).

3. The Big Discovery: Speed is the Enemy

The most surprising finding was about time.
The researchers found a direct link between impulsivity and speed.

People who admitted they were impulsive (acted without thinking) were the ones who clicked the buttons the fastest.
The Rule: The faster you decide, the more likely you are to fall for the scam.
The Lesson: Being slow and deliberate is a superpower. Taking a moment to think acts like a shield.

4. The Two Types of Passengers

Using the data, the researchers split everyone into two distinct groups, like sorting passengers into two different waiting rooms:

Group A: The "Aware User" (The Careful Traveler)

Who they are: Usually older, with more work experience, and a bit more cautious.
How they act: They take their time. They don't rush. They look at the email, think about it, and check the details.
Result: They are much better at spotting the fake trains. They only fell for the scam about 22% of the time.

Group B: The "High-Risk User" (The Hasty Traveler)

Who they are: This group makes up the majority of people (about 71%). They tend to be younger, have less work experience, and are more "creative" (open, outgoing, and impulsive).
How they act: They are fast. They see an email that looks urgent or comes from a boss, and they react immediately without thinking.
Result: They are the easiest targets. They fell for the scam about 31% of the time.

5. What This Means for You

The paper concludes that you can't just teach people "tech facts" (like how to spot a bad link) and expect them to be safe. Knowing how to use a computer isn't enough.

The real problem is how we think.

If you are the "Hasty Traveler," your brain is wired to act fast and be open to new things, which is great for creativity but dangerous for security.
The scammers know this. They use tricks like "Your account will be closed in 1 hour!" to make you panic and stop thinking.

The Bottom Line:
To stay safe, you don't need to be a computer genius. You just need to slow down. If you feel that urge to click immediately because of urgency or fear, that is your brain's "danger signal." The best defense is to pause, take a breath, and think before you act. The paper suggests that future security training shouldn't just be a generic lecture for everyone; it should be tailored to help the "Hasty Travelers" learn how to hit the brakes.

Technical Summary: Profiling User Vulnerability to Phishing Through Psychological and Behavioral Factors

Problem Statement
Phishing remains a pervasive cybersecurity threat that bypasses technological defenses by targeting human cognitive and psychological factors. While traditional research has cataloged various predictive variables, there is a critical need for an integrated, multidimensional approach to accurately identify profiles of vulnerable versus resilient individuals. Current "one-size-fits-all" training programs often fail to address the specific psycho-behavioral traits that drive susceptibility. This study addresses the research question: What human factors and combinations of psycho-behavioral variables best describe a user's vulnerability to phishing?

Methodology
The study analyzed data from the Spamley dataset, a publicly available resource involving 1,086 participants from diverse socio-professional backgrounds. The methodology comprised three primary phases:

Data Collection and Preprocessing:
- Participants completed a structured questionnaire covering sociodemographic, psychological (e.g., Big Five traits, impulsivity, risk perception), and behavioral variables.
- Participants underwent a realistic phishing detection simulation using the Spamley web application, which presented ten emails (legitimate and fraudulent) in an interface mimicking standard email clients.
- Filtering: Data was rigorously cleaned. Incomplete sessions were excluded. An attention check item (requiring the input of "3") was used to filter out inattentive users. Response times were analyzed to ensure sufficient engagement (filtering out users who completed the task in under 2 minutes). Users receiving fewer than three phishing emails were excluded to ensure statistical relevance.
Statistical Analysis:
- Descriptive and Bivariate Analysis: Spearman correlations were calculated to identify associations between variables (e.g., age, experience, personality traits) and the ability to correctly identify phishing emails (recall rate).
- Impulsivity Validation: The study validated self-reported impulsivity by analyzing its correlation with behavioral response times.
- Exploratory Factor Analysis (EFA): Using the Minimum Residual method with Oblimin oblique rotation, the study extracted latent constructs from the observed variables. Parallel analysis determined the number of factors to retain.
- Clustering: A K-Means clustering algorithm was applied to segment the sample. The algorithm utilized two specific latent factors (Seniority and Creativity) for partitioning, selected based on the optimization of the Silhouette Coefficient. The remaining factors were integrated post-clustering as descriptive variables to characterize the resulting groups.

Key Results

Latent Constructs: The EFA identified five distinct latent factors:
1. Seniority: Composed of age, job experience, and education level.
2. Expertise: Composed of computer science knowledge and anti-phishing course history.
3. Creativity: Composed of openness, extroversion, and risk propensity.
4. Stability: Composed of emotional stability and conscientiousness.
5. Vulnerability: Composed of susceptibility to social engineering triggers (authority, scarcity, social proof).
Behavioral Validation: A significant negative correlation ( $r = -0.177, p < 0.001$ ) was found between self-reported impulsivity and response times. Furthermore, a statistically significant difference ( $t = -4.198, p < 0.001$ ) existed between "victims" and "resilient" individuals, with victims exhibiting significantly faster decision-making speeds.
User Profiling (K-Means): The analysis yielded two distinct user profiles:
- High-Risk User (71.4% of sample): Characterized by low Seniority (younger, less experience), positive Creativity (high openness/extroversion), and negative Expertise/Stability. This group exhibited the lowest recall rate (68.8%) and the fastest average reaction times (21.4s). They showed a positive score on the Vulnerability factor, indicating susceptibility to psychological triggers.
- Aware User (28.6% of sample): Characterized by high Seniority (older, more experienced), negative Creativity (lower impulsivity), and positive Expertise/Stability. This group achieved a higher recall rate (78.3%) and slower reaction times (23.6s), indicating a more analytical and cautious approach.

Key Contributions and Significance
The paper claims to provide a robust empirical basis for moving beyond generic security training by:

Defining Vulnerability via Interaction: The study demonstrates that technical knowledge alone is insufficient for resilience. Instead, vulnerability is determined by the interaction between operational maturity (Seniority), decision-making speed (linked to impulsivity), and cognitive approach (Creativity).
Identifying the "High-Risk" Majority: The research highlights that the majority of users (approx. 71%) fall into a High-Risk profile characterized by hasty evaluation processes and lower critical analysis, driven by a structural lack of maturity and high impulsivity.
Behavioral Validation of Impulsivity: By correlating self-reported impulsivity with objective response times, the study confirms that faster decision-making is a distinct behavioral marker of vulnerability, distinguishing it from resilient users who employ slower, deliberative processing.
Strategic Implications: The findings suggest that effective countermeasures must shift from standardized training to personalized, adaptive programs. Specifically, interventions for the High-Risk cluster should focus on cognitive de-biasing, slowing down decision-making, and mitigating susceptibility to authority and social proof.

Limitations
The authors acknowledge several limitations: the reliance on self-reported measures (subject to bias), the use of a simulated environment which may not fully replicate real-world cognitive load and stress, the lack of systematic control over geographic origin (limiting cross-cultural generalizability), and the cross-sectional design which prevents definitive causal inferences.