Phishing is a persistent organizational threat, yet most empirical work emphasizes post-exposure susceptibility rather than the confidence judgments that shape behavior when suspicious messages arrive. This study examines predictors of phishing-detection confidence in a professional sample of U.S. defense-industry engineers (N = 97). Participants completed a validated survey capturing email comfort, perceived Internet proficiency, Self-Reported Phishing-Cue Knowledge, cue-checking frequency, use of sanctioned confirmation channels, and Big Five personality traits. Multiple linear models with standardized coefficients and multicollinearity checks estimate each factor’s unique contribution. Three predictors show the largest and most consistent associations with detection confidence: email comfort, perceived Internet proficiency, and Self-Reported Phishing-Cue Knowledge. Emotional stability and openness contribute at smaller magnitudes, while cue-checking frequency and use of a confirmation channel exhibit secondary effects. Years of experience and recent training volume are not reliable drivers once core skills and knowledge are included. Findings support a confidence-mediated account of phishing decisions and suggest practical interventions: hands-on practice that improves email fluency and web problem-solving, explicit instruction on cue schemas, and low-friction confirmation workflows. Limitations include a single occupational context and reliance on retrospective confidence; implications for replication and program design are discussed.
References
[1]
Verizon (2025) 2025 Data Breach Investigations Report (DBIR). Verizon. https://www.verizon.com/business/resources/reports/dbir/
[2]
Anti-Phishing Working Group (APWG) (2025) Phishing Activity Trends Report, 4th Quarter 2024. https://docs.apwg.org/reports/apwg_trends_report_q4_2024.pdf
[3]
Dhamija, R., Tygar, J.D. and Hearst, M. (2006). Why Phishing Works. Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, Montréa, 22-27 April 2006, 581-590. https://doi.org/10.1145/1124772.1124861
[4]
Jagatic, T.N., Johnson, N.A., Jakobsson, M. and Menczer, F. (2007) Social Phishing. CommunicationsoftheACM, 50, 94-100. https://doi.org/10.1145/1290958.1290968
[5]
Wright, R.T. and Marett, K. (2010) The Influence of Experiential and Dispositional Factors in Phishing: An Empirical Investigation of the Deceived. JournalofManagementInformationSystems, 27, 273-303. https://doi.org/10.2753/mis0742-1222270111
[6]
Bandura, A., Freeman, W.H. and Lightsey, R. (1999) Self-Efficacy: The Exercise of Control. JournalofCognitivePsychotherapy, 13, 158-166. https://doi.org/10.1891/0889-8391.13.2.158
[7]
Rhee, H., Kim, C. and Ryu, Y.U. (2009) Self-efficacy in Information Security: Its Influence on End Users’ Information Security Practice Behavior. Computers&Security, 28, 816-826. https://doi.org/10.1016/j.cose.2009.05.008
[8]
Parsons, K., McCormac, A., Butavicius, M., Pattinson, M. and Jerram, C. (2014) Determining Employee Awareness Using the Human Aspects of Information Security Questionnaire (HAIS-Q). Computers&Security, 42, 165-176. https://doi.org/10.1016/j.cose.2013.12.003
[9]
Brickley, J.C. (2022) What Drives User Retrospective Confidence Levels Towards Phishing Detection Behavior. Ph.D. Thesis, New Jersey City University.
[10]
Souppaya, K. and Scarfone, K. (2013) Guide to Malware Incident Prevention and Handling for Desktops and Laptops. NIST Special Publication 800-83 Rev. 1, National Institute of Standards and Technology.
[11]
Cichonski, P., Millar, T., Grance, T. and Scarfone, K. (2012) Computer Security Incident Handling Guide. NIST Special Publication 800-61 Rev. 2, National Institute of Standards and Technology.
[12]
Li, N. and Wu, D. (2005) A Framework for Secure Electronic Commerce Transactions. Decision Support Systems, 39, 271-283.
[13]
Alseadoon, I. (2014) Phishing Detection Behavior: A User-Centered Model. Ph.D. Thesis, University of New South Wales.
[14]
Wu, M., Miller, R.C. and Garfinkel, S.L. (2006) Do Security Toolbars Actually Prevent Phishing Attacks? Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, Montréal, 22-27 April 2006, 601-610. https://doi.org/10.1145/1124772.1124863
[15]
Pandove, G., Maity, R. and Sharma, S. (2010) E-Mail Spoofing: Techniques and Countermeasures. ProceedingsofICCCT, Guangxi, 13-14 October 2010, 394-398.
[16]
Akbar, M. (2014) Phishing E-Mails and Cialdini’s Principles of Persuasion. Master’s Thesis, University of Twente.
[17]
Cialdini, R.B. (2009) Influence: Science and Practice. 5th Edition, Pearson.
[18]
Jansen, J. and Leukfeldt, R.E. (2016) Phishing and Malware Attacks on Online Banking Customers in the Netherlands: A Qualitative Analysis of Factors Leading to Victimization. InternationalJournalofCyberCriminology, 10, 79-91.
[19]
Workman, M. (2008) A Test of Intervention for Security Threats: Decision Biases in Computer Security. DecisionSciences, 39, 615-643.
[20]
Guéguen, N., Pascual, A. and Dagot, J.L. (2010) Similarity and Compliance to a Request: A Field Study on Pedestrians. SocialBehaviorandPersonality, 38, 453-458.
[21]
Guadagno, R.E., Muscanell, N.L., Rice, L.M. and Roberts, N. (2013) Social Influence Online: The Impact of Social Validation and Likability on Compliance. Psychology of Popular Media Culture, 2, 51-60. https://doi.org/10.1037/a0030592
[22]
Lawson, P., Pearson, C.J., Crowson, A. and Mayhorn, C.B. (2020) Email Phishing and Signal Detection: How Persuasion Principles and Personality Influence Response Patterns and Accuracy. AppliedErgonomics, 86, Article ID: 103084. https://doi.org/10.1016/j.apergo.2020.103084
[23]
Xun, D., Clark, J.A. and Jacob, J. (2008) Modelling User-Phishing Interaction. 2008 Conference on Human System Interaction, Krakow, 25-27 May 2008, 627-632. https://doi.org/10.1109/HSI.2008.4581513
[24]
Aburrous, M., Hossain, M.A., Dahal, K. and Thabtah, F. (2010) Intelligent Phishing Detection System for E-Banking Using Fuzzy Data Mining. ExpertSystemswithApplications, 37, 7913-7921. https://doi.org/10.1016/j.eswa.2010.04.044
[25]
Vishwanath, A., Herath, T., Chen, R., Wang, J. and Rao, H.R. (2011) Why Do People Get Phished? Testing Individual Differences in Phishing Vulnerability within an Integrated, Information Processing Model. DecisionSupportSystems, 51, 576-586. https://doi.org/10.1016/j.dss.2011.03.002
[26]
Petty, R.E. and Cacioppo, J.T. (1986) Communication and Persuasion: Central and Peripheral Routes to Attitude Change. Springer.
[27]
Grazioli, S. (2004) Where Did They Go Wrong? An Analysis of the Failure of Knowledgeable Internet Consumers to Detect Deception over the Internet. MISQuarterly, 28, 387-422.
[28]
Higgins, E.T. (1996) Knowledge Activation: Accessibility, Applicability, and Salience. In: Higgins, E.T. and Kruglanski, A.W., Eds., SocialPsychology: HandbookofBasicPrinciples, Guilford, 133-168.
[29]
Rietbergen, A. (2015) An Eye-Tracking Study on What Receives Attention in E-Mails in an Intercultural Context. Master’s Thesis, Radboud University.
[30]
Jain, A.K. and Gupta, B.B. (2017) Phishing Detection: Analysis of Visual Similarity Based Approaches. SecurityandCommunicationNetworks, 2017, Article ID: 5421046. https://doi.org/10.1155/2017/5421046
[31]
Ho, S.Y. and Bodoff, D. (2014) The Effects of Web Personalization on User Attitude and Behavior: An Integration of the Elaboration Likelihood Model and Consumer Search Theory. MISQuarterly, 38, 497-520. https://doi.org/10.25300/misq/2014/38.2.08
[32]
Wang, J., Li, Y. and Rao, H.R. (2016) Overconfidence in Phishing Email Detection. JournaloftheAssociationforInformationSystems, 17, 759-783. https://doi.org/10.17705/1jais.00442
[33]
Fazio, R.H. and Zanna, M.P. (1978) On the Predictive Validity of Attitudes: The Roles of Direct Experience and Confidence. JournalofPersonality, 46, 228-243. https://doi.org/10.1111/j.1467-6494.1978.tb00177.x
[34]
Moore, D.A. and Healy, P.J. (2008) The Trouble with Overconfidence. PsychologicalReview, 115, 502-517. https://doi.org/10.1037/0033-295x.115.2.502
[35]
Berger, I.E. (1992) The Nature of Attitude Accessibility and Attitude Confidence: A Triangulated Experiment. JournalofConsumerPsychology, 1, 103-123. https://doi.org/10.1016/s1057-7408(08)80052-6
[36]
Berger, I.E. and Mitchell, A.A. (1989) The Effect of Advertising on Attitude Accessibility, Attitude Confidence, and the Attitude-Behavior Relationship. JournalofConsumerResearch, 16, 269-279. https://doi.org/10.1086/209213
[37]
Busey, T.A., Tunnicliff, J., Loftus, G.R. and Loftus, E.F. (2000) Accounts of the Confidence-Accuracy Relation in Recognition Memory. PsychonomicBulletin&Review, 7, 26-48. https://doi.org/10.3758/bf03210724
[38]
Stone, D.N. (1994) Overconfidence in Initial Self-Efficacy Judgments: Effects on Decision Processes and Performance. OrganizationalBehaviorandHumanDecisionProcesses, 59, 452-474. https://doi.org/10.1006/obhd.1994.1069
[39]
Moores, T.T. and Chang, J.C. (2009) Self-Efficacy, Overconfidence, and the Negative Effect on Subsequent Performance: A Field Study. Information&Management, 46, 69-76. https://doi.org/10.1016/j.im.2008.11.006
[40]
Cramer, R.J., Neal, T.M.S. and Brodsky, S.L. (2009) Self-Efficacy and Confidence: Theoretical Distinctions and Implications for Trial Consultation. ConsultingPsychologyJournal: PracticeandResearch, 61, 319-334. https://doi.org/10.1037/a0017310
[41]
Alseadoon, I., Othman, M.H., Chan, A. and Foo, S. (2017) Typology of Phishing Victims Based on Personality Traits and Other Factors. ComputersinHumanBehavior, 66, 1-13.
[42]
Srivastava, S., John, O.P., Gosling, S.D. and Potter, J. (2003) Development of Personality in Early and Middle Adulthood: Set Like Plaster or Persistent Change? JournalofPersonalityandSocialPsychology, 84, 1041-1053. https://doi.org/10.1037/0022-3514.84.5.1041
