“I don’t really give them piece of mind”: User Perceptions of Social Engineering Attacks

How do end users understand social engineering attacks, and how do their perceptions of these attacks differ from reality? To investigate, we proposed a new social engineering attack framework, and ran two studies to examine exactly how and when users are misunderstanding social engineering attacks. In our first study, we conducted 30 qualitative interviews asking people about their understanding of, and experiences with social engineering attacks. We found that confidence and accuracy are the two main factors affecting users’ knowledge of social engineering attacks. In our second study, we quantified how confidence and accuracy impact users’ perceptions at different stages of an attack. We found that users tend to be overconfident in their ability to understand social engineering attacks, but hold inaccurate beliefs. Participants had major misconceptions of what constitutes social engineering, and the risks of these attacks. Based on our results, we propose educational and design opportunities to match social engineering mitigation strategies to user perceptions of social engineering.