Attempting to reduce susceptibility to fraudulent computer pop-ups using malevolence cue identification training

Morgan, Phillip L. ORCID: https://orcid.org/0000-0002-5672-0758, Soteriou, Robinson, Williams, Craig and Zhang, Qiyuan 2019. Attempting to reduce susceptibility to fraudulent computer pop-ups using malevolence cue identification training. Presented at: AHFE 2019: International Conference on Applied Human Factors and Ergonomics, Washington, DC, USA, 24-28 July 2019. Published in: Ahram, Tareq and Karwowski, Waldemar eds. Advances in Human Factors in Cybersecurity: Proceedings of the AHFE 2019 International Conference on Human Factors in Cybersecurity, July 24-28, 2019, Washington D.C., USA. Advances in Intelligent Systems and Computing. , vol.960 Springer Verlag, pp. 3-15. 10.1007/978-3-030-20488-4_1

Preview

PDF - Accepted Post-Print Version Download (579kB) | Preview

Abstract

People accept a high number of computer pop-ups containing cues that indicate malevolence when they occur as interrupting tasks during a cognitively demanding memory-based task [1, 2], with younger adults spending only 5.5–6-s before making an accept or decline decision [2]. These findings may be explained by at least three factors: pressure to return to the suspended task to minimize forgetting; adopting non-cognitively demanding inspection strategies; and, having low levels of suspicion [3]. Consequences of such behavior could be potentially catastrophic for individuals and organizations (e.g., in the event of a successful cyber breach), and thus it is crucial to develop effective interventions to reduce susceptibility. The current experiment (N = 50) tested the effectiveness of malevolence cue identification training (MCIT) interventions. During phase 1, participants performed a serial recall task with some trials interrupted by pop-up messages with accept or cancel options that either contained cues (e.g., missing company name, misspelt word) to malevolence (malevolent condition) or no cues (non-malevolent condition). In phase 2, participants were allocated to one of three groups: no MCIT/Control, non-incentivized MCIT/N-IMCIT, or incentivized MCIT/IMCIT. Control group participants only had to identify category-related words (e.g., colors). Participants in intervention conditions were explicitly made aware of the malevolence cues in Phase 1 pop-ups before performing trying to identify malevolence cues within adapted passages of text. The N-IMCIT group were told that their detection accuracy was being ranked against other participants, to induce social comparison. Phase 3 was similar to phase 1, although 50% of malevolent pop-ups contained new cues. MCIT did lead to a significant reduction in the number of malevolent pop-ups accepted under some conditions. Incentivized training did not (statistically) improve performance compared to non-incentivized training. Cue novelty had no effect. Ways of further improving the MCIT training protocol used, as well as theoretical implications, are discussed.

Item Type:	Conference or Workshop Item (Paper)
Date Type:	Published Online
Status:	Published
Schools:	Schools > Psychology
Publisher:	Springer Verlag
ISBN:	9783030204877
ISSN:	2194-5357
Date of First Compliant Deposit:	9 July 2019
Date of Acceptance:	4 July 2019
Last Modified:	04 Dec 2024 03:45
URI:	https://orca.cardiff.ac.uk/id/eprint/123913

Actions (repository staff only)

Edit Item