Telephone-based social engineering attacks: An experiment testing the success and time decay of an intervention

TitleTelephone-based social engineering attacks: An experiment testing the success and time decay of an intervention
Publication TypeConference Paper
Year of Publication2016
AuthorsBullee J.H, Montoya L., Junger M., Hartel P.H
Conference NameSingapore Cyber Security R&D Conference (SG-CRC), Singapore, Singapore
PublisherIOS Press
Conference LocationAmsterdam
KeywordsAwareness, Decay, Retention, Scam, social engineering, Telephone, Time, Training
Abstract

The objective of this study is to get insight into the effectiveness of an information campaign to counter a social engineering attack via the telephone. Four different offenders phoned 48 employees and made them believe that their PC was distributing spam emails. Targets were told that this unfortunate situation could be solved by downloading and executing software from a website (i.e. an untrusted one). A total of 46.15 % of the employees not exposed to the intervention followed the instructions of the offender. This was significantly different to those exposed to an intervention 1 week prior to the attack (9.1%); however there was no effect for those exposed to an intervention 2 weeks prior to the attack (54.6%). This research suggests that scam awareness-raising campaigns reduce vulnerability only in the short term.