The purpose of this research study was set to address the problem of cyberattacks, such as phishing delivered via short message service (SMS) or SMiShing, targeted towards senior citizens. In 2023, they lost over $36m to such attacks. Phishing success increases when attackers use persuasion principles that bypass logical decision-making and rely on heuristics. Security education, training, and awareness (SETA) programs can reduce susceptibility, yet little research investigated SETA programs that incorporate these principles.
This research was conducted in three phases, beginning with Subject Matter Experts’ evaluation of SMiShing messages operationalizing these persuasion principles for use in this study’s instrument. The next phase was a pilot study. The third phase was the main data collection and analysis phase. This research employed a pretest-posttest design to evaluate the efficacy of its novel SETA program. The SETA program used Behavioral Skills Training methodology with 118 senior citizens from South Florida and Central Massachusetts.
The experimental results indicated a statistically significant mean difference between pretest and posttest group scores (F = 6.604, df = 5, p = 0.011) in identifying SMiShing messages that operationalize the principles of persuasion used in social engineering. Specifically, the pretest group’s mean score was 73.62, and the posttest group’s mean score was 79.28. The calculated effect size (η2 = 0.054) nears the threshold for a medium effect (η2 = 0.06).
Recognizing persuasion in SMiShing messages helped senior citizens better detect these cyberattacks. Practical implications include incorporating persuasion principles into the SETA framework to address evolving cyberattacks (e.g. deepfakes, vishing) that are being enhanced by generative artificial intelligence.
As a group, senior citizens have lost millions to cyberattacks. SETA programs that incorporate principles of persuasion appear to help reduce the financial losses this group incurs from cyberattacks and may also improve senior citizens’ confidence and reduce fear when using communication technology.
This research’s original contribution is the integration of persuasion principles into cybersecurity training programs, helping senior citizens quickly recognize the malicious intent of SMiShing messages, which apply psychological pressures to achieve the attacker’s goals.
