Despite technical and non-technical countermeasures, humans continue to be tricked by phishing emails. How users make email response decisions is a missing piece in the puzzle to identifying why people still fall for phishing emails. We conducted an empirical study using a think-aloud method to investigate how people make 'response decisions' while reading emails. The grounded theory analysis of the in-depth qualitative data has enabled us to identify different elements of email users' decision-making that influence their email response decisions. Furthermore, we developed a theoretical model that explains how people could be driven to respond to emails based on the identified elements of users' email decision-making processes and the relationships uncovered from the data. The findings provide deeper insights into phishing email susceptibility due to people's email response decision-making behavior. We also discuss the implications of our findings for designers and researchers working in anti-phishing training, education, and awareness interventions
@article{arxiv.2401.13199,
title = {Why People Still Fall for Phishing Emails: An Empirical Investigation into How Users Make Email Response Decisions},
author = {Asangi Jayatilaka and Nalin Asanka Gamagedara Arachchilage and Muhammad Ali Babar},
journal= {arXiv preprint arXiv:2401.13199},
year = {2024}
}