2.1. Phishing in General

Jerry Felix and Chris Hauck first outlined phishing as a strategy in which a third party imitates a genuine source to undertake a malicious operation at an Interex Conference in 1987. However, there does not appear to be a definite understanding of phishing techniques. Phishing has its own set of terminology that appears regularly in the literature. Mass, spam, and blanket phishing are examples of such words. They all have characteristics in common, such as many messages sent, misleading targeted individuals, impersonation of a sender, and data collection via social engineering [11–13].

Studies on phishing attacks’ occurrence and success rate are conducted regularly. Overall, they all show an increasing tendency of phishing attacks [5, 7, 11, 14].

Previous studies have suggested that users are more prone to phishing if they are solicited by known entities in more targeted e-mails [14–17].

2.2. Phishing Susceptibility and Demography

Studies have been conducted to measure the relationship between demographic factors and phishing susceptibilities [14, 17–19] and to identify factors that predict phishing susceptibility [20].

Younger students presented themselves as more vulnerable in Jagatic et al.’s study, in which females became victims in 77% of cases, while males’ proportion was 65% [14]. This study was performed on 487 selected students from Indiana University aged 18–24 years. On the other hand, this study was unique because it used personal information acquired from social media to send phishing messages to a target pretending to be a known friend.

Sheng et al. performed a role-play survey shared with 1001 respondents (only 29% of them were students) to learn more about the relationship between demographics and phishing susceptibility. Their results showed that females were more prone to phishing than males [18]. This is because females had less technical training and technical knowledge than males. Another finding was that participants aged 18–25 years were more susceptible than other groups. The age category of 18–25 years corresponds to the approximate age of university students.

Researchers from Carnegie Mellon University explored different age groups in their empirical phishing experiment. The study was based on the sending of phishing e-mails to a group of 515 participants. Results showed that 62.3% of the users in the age group of 18–25 years fell prey to the phishing e-mail, while 41.1% of the users in the age group of 26 years or older were tricked similarly [21].

Hong et al. explored the behavioural, cognitive, and perceptual attributes that make individuals more vulnerable to phishing. Of 53 respondents, over 92% were somewhat defenceless towards phishing [22]. In this experiment, it was revealed that females were less likely to uncover phishing e-mails.

Diaz et al.’s study conducted in 2019, where phishing e-mails were sent to 450 uninformed students at the University of Maryland, resulted in 60% of participants clicking on the phished e-mail; however, the study discovered no significant correlation between gender and susceptibility [19].

In Broadhurst et al.’s quasi-experimental study, 138 students were exposed to fake e-mails to connect demographic factors to phishing susceptibility. However, no correlation was found. All the variables indicated that international and first-year students were deceived more significantly than domestic and later-year students [17].

Many studies have been conducted over the past few years, mostly based on role-play investigations. This setup allows researchers to assess the effectiveness of phishing attacks without undertaking real-world phishing tests. Users respond to questions using role-playing to examine a possible security situation. The preliminary findings are analysed and summarised to identify potential phishing victims [14, 18].

A controlled phishing experiment was also used, in which individuals were sent an actual phishing e-mail that directed them to a phishing website. The phishing website does not capture or keep any personal data. On the other hand, this website keeps track of the number of victims and perhaps their usernames. The information gathered can be used to measure user security awareness and, in the future, to improve security training [15, 19, 21, 23].

Although all previous studies focused on demography and susceptibility, they used different methods to find out results. None of the above studies explicitly focused on the gender of students and susceptibility to phishing by using phishing simulation. The current study uses the latter technique and concentrates on finding whether females or males in a university setting are more prone to opening a phishing e-mail, and which type of e-mail is opened more often by sending a decoy e-mail to registered participants to help understand the current vulnerability of students of social studies.

3.1. Structural Overview

The aim is to create conditions similar to a real-life environment while maintaining secure surroundings for collaboration, privacy, and dignity in research. We opted for a phishing simulation campaign in which realistic decoy e-mails were sent to students. At the same time, Google Analytics and SalesHandy helped us gather accurate data on the dangers of phishing on social studies faculty – two phishing e-mails were used – one generic, although adjusted to the current situation, and another targeted (spear). The first phase comprised obtaining a list of target identities to experiment on; and the second phase comprised preparing a technical background for an experiment. This was followed by sending decoy phishing e-mails and gathering data.

3.2. Data Collection

The first step was to assemble participants. Participants were not chosen randomly, as mentioned in the literature, but voluntarily through a registration form. The registration form consisted of questions on demographic information (age, gender, studies, year of studies, and language of their studies) and an informed consent. With this, participants had the chance to learn the purpose, benefits, and risks before deciding or declining to participate in the study. Crucial to the experiment was soliciting university e-mail, which was later used as an entrance to complete research. Students were approached in November 2021 through the social network Facebook and Discord; they were able to register until the end of the year. Responses were collected through Enalyzer, a data-gathering and processing platform. Initially, 101 students registered. The number reduced to 68 due to incomplete data in some cases. After collection of all data, participants were assigned numbers to anonymise their identity and keep an overview of the results. The Faculty of Social Studies at Masaryk University had 2804 students. With standard statistical technique [24], it was determined that a sample size of 68 students was applicable for a confidence level of 95% and with ±11.33% margin of error. For characteristics of the whole tested group, see Table 1.

3.3. Phishing Web Creation

The following step was to prepare a technological background to capture all feedback. To execute practical experiments, a functional website was needed, ideally similar to a faculty website that somehow counts the activity. For that purpose, the decision was to use the framework Django, a tool developed in the programming language Python. Because the only functionality requested of the website was to appear legitimately and measure visits, a default Django project was created.

The consequent step was obtaining the visual side – which was achieved by using a web browser tool to view the HTML source code of the MUNI newsletter. This source code was copied, slightly adjusted, and set as a visual for the homepage of the Django project. We created one more page to count the hits of a targeted e-mail. The appearance of this page was not significant, so it contained just some simple HTML structures with the statement announcing that the visitor has been phished, it was a part of the experiment, and two useful links to relevant sources: one for the NÚKIB¹ website, and another for MUNI security.

For the last requirement, counting visitors, Django extension called Django-hit count was used. This extension counts webpage hits by analysing the requests sent – website traffic. Later on, it was found that it did not work as needed, so this option was abandoned, and it was decided to look for other options.

The Google Analytics tool was used for the purpose of this experiment. A Google token was generated to make it operative, and HTML to the page’s source code was added. Besides counting the visitors, Google Analytics provided us with much additional helpful information about them, such as operating system, whether participants used mobile or desktop access, and the browser.

The Django project was then ready to be deployed online. Heroku hosting was used for that purpose because it provided simple free hosting for projects written in Django. Heroku also allowed the use of custom domain names, which were essential for the success of this experiment. Because it allowed adjusting the domain, it looked more similar to the MUNI domain (muni.cz).

The domain name we chose for the experiment was muninewsletter.cz, for two simple reasons: it looks identical to MUNI, and it enabled the use of social engineering. The information was obtained to make it look like a credible institution. After doing market research online to find the best offer for this domain, we opted to go with godaddy.com. It simultaneously created an e-mail for this domain suited for the usage. After purchasing the domain name, the only thing remaining was to set it to redirect to Heroku. That was achieved by setting nameservers at godaddy.com to redirect to Heroku nameservers, which then directed the user to our project.

3.4. E-mail Setup

Creating a functionalised e-mail to store all responses was the next step when the website was set up and started working. For this purpose, a tool called SalesHandy was used. The e-mail address was chosen to be as similar as possible to the original. The e-mail address from which the university sends newsletter e-mails is studenti@newsletter.muni.cz. The e-mail address used for this experiment was studenti@newslettermuni.cz. The difference was in one dot. This method is called link manipulation; it is a technical disguise. The link is slightly altered to make the user believe it more and then redirects to the phisher’s website.

After SalesHandy was connected to the e-mail address studenti@newslettermuni.cz, it enabled sending e-mails with tracking and planning the e-mail campaign. The most significant features of this tool were showing who opened, replied, and clicked on the link in the sent e-mail. This facilitated recording participants’ behaviour after the decoy e-mail was sent.

3.5. Phishing E-mail Design

Phishing e-mails were inspired by the phishing archive of Berkeley University of California [25] to copy the usual visualities that real phishing e-mails in the university environment have. Social engineers use different techniques intending to be successful. Phishers are getting more sophisticated; phishing attacks incorporate greater details and context to become more effective and, therefore, more perilous for society [14]. Thus, both e-mails were written in the Czech language, because most registered respondents studied the Czech programme, and the main goal was to make it look real.

Because of that, with the first e-mail, we tried to be as precise as possible. For the first e-mail, the generic one, the decision was to copy the student’s newsletter.

We used e-mail spoofing, where information from a section of the e-mail was falsified, making it appear as if it was coming from a legitimate source – Masaryk University. The second approach is website cloning; with this technique, we copied a legitimate website and an e-mail of the student newsletter and tried to deceive students into clicking on the link. These fake sites usually trick individuals into entering personally identifiable information (PII) or login credentials or attacking directly. For a higher click rate, the current situation was used. Specifically, students were presented with an e-mail in which they could find more information on how Masaryk University is helping with the conflict in Ukraine. This topic was chosen because it is presently happening and attacks human emotions, which is one of the preconditions for successful phishing [9]. After clicking on the link, participants were redirected to the website, which looked like the webpage of Masaryk University but had spelling mistakes. This created space for conscious individuals to report this situation to MUNI IT team. The purpose of the second e-mail was to be more personal; hence, copying of an e-mail which announces the receiving of a document in the information system of Masaryk University. This e-mail was sent with spelling errors, and the link, http://www.newslettermuni.cz/outside/, did not match the e-mail’s subject.

3.6. The Realisation of Experiments

Tryouts were executed before completing the first experiments to ensure that sent e-mails would not be delivered to spam.

The first e-mail was sent out on 2 March 2022. Two days later, the second e-mail type was sent on 4 March 2022. Two-month delay after collecting primary data was due to the waiting period, which was supposed to gain time to prepare the experiment‘s technical background and ensure that participants would not have a fresh memory of signing up for the experiment. E-mails were sent during the campaign, which ensured the delivery of e-mails at approximately the same time. Two days after the last e-mail was sent, the data was downloaded and converted to the .xlxs format for further analysis.

4.1. General Observations

Altogether, 136 e-mails were sent. Participants were most susceptible to thespear-phishing e-mail, which announced the delivery of a document to the IS of MUNI. This e-mail was tailored for the students of Masaryk University because it informs the recipient from the second-person point of view. Of all participants, 74% opened this e-mail, and 96% of those who opened it also clicked on the link. This was noticeably different in the case of the first e-mail, which was opened by 34% of respondents, and on the link clicked by 52% of those who had opened the e-mail. Overall, there appeared to be an increasing trend concerning scam and scam susceptibility in normalised proportions, with increasing success for more individualised and tailored scam rather than the generic one.

4.2. The First E-mail

The first e-mail was not opened by 66% of respondents. 34% of participants opened the e-mail, and 52% also clicked on the link contained in the e-mail. This e-mail aimed to be general but slightly adjusted for the attention of university students, so the e-mail domain fits the perspective. Regarding the male–female ratio, of 45 people who did not open the e-mail, 18 were males, 26 were females and one other. While this first e-mail was mainly ignored by females, the ratio was equivalent when opening the e-mail. Of 23 people who opened the e-mail, 12 were males and 11 were females. More females clicked on the link, but the difference was minimal; the male–female ratio was 5:7. This thesis focuses on ’male‘s and ’female‘s susceptibility to phishing; however, participants marked other demographic information in the registration form.For the whole list of characteristics, see Table 2. Data that were insignificant due to the low number of responses captured are excluded from the table. The success rate of this first e-mail was 18%.

4.3. The Second E-mail

The second e-mail brought different results. Only 18 participants did not open the e-mail, while 50 users opened it. From that, 48 people clicked on the link in the e-mail, making for a 96% clicking rate. In the case of the second e-mail, two persons alerted the CSIRT² MUNI team. Of 18 people who did not open the e-mail, 7 were males, and 11 were females. The e-mail was opened by 19 male respondents, 30 female respondents and one other. Further, 17 male and 30 female respondents clicked on the link, showing higher susceptibility to phishing in females. The sample of respondents consists of a more significant proportion of females than males, and the reason for this is that it reflects more female students at the FSS; the male–female ratio was 30:37. The success rate of the second e-mail was 71%.

After clicking on the link, participants were directed to the page announcing that they were phished and linked to useful links to learn more about phishing attacks from the NÚKIB or MUNI security team.

The last e-mail of this type was sent on 4 March 2022 at 22:15. Approximately 24 h later, on 5 March 2022, respondents numbered 16 and 54 started a debate on the suspicious e-mail on the FSS virtual campus on discord. Participants discussed whether it was part of a training or a real security threat. After exchange of short messages, they concluded that the best would be to report it to the CSIRT MUNI. And so they did; both participants communicated this information to the relevant team, who told them that this was part of a research for thesis. For further data concerning the second e-mail, see Table 3.

4.4. Comparison

From the results listed above, it is clear that the second targeted e-mail was more successful; however, what was the difference? We examined the effect of gender on participants to see whether gender differences exist in responding to phishing susceptibility.

In the case of the first e-mail, the opening of an e-mail was comparable between genders. The results showed that 12 males and 11 females opened it.

Numbers almost doubled when it came to the targeted e-mail. The second e-mail was opened more times by females, even though the number of participants in both groups was roughly the same (30 males and 37 females were registered for this study).

It was found that the first type of phishing attack equally deceived female and male subjects. However, in the second type of phishing, almost 63% were female compared to 36% male victims, which was in accordance with the study of Jagatic et al. [14] and Sheng et al. [18], where the authors found that females were more susceptible to the spear-phishing risk.

A low percentage of subjects clicking on the link (18%) suggests that the more targeted the e-mail, the more significant the threat. From the second e-mail, it was clear that males were less susceptible to falling prey to phishing attacks than females. The results also indicated that females were more likely to click on phishing links.

4.5. Google Analytics – Profile of the User

Google Analytics provides additional information about the operating system and the browser through which users accessed the phishing site. This information helped to more accurately define the user profile of those who were victimised by phishing in this research and provided a framework for developing a new hypothesis in future research related to the factors that make users vulnerable to phishing attacks.

Because the first e-mail demonstrated a success rate of 18% for susceptibility to phishing, to create a profile of a student of FSS susceptible to phishing, the data obtained by the second decoy e-mail was used.

Females clicked on the link in the e-mail with a ratio of 30:17, thus making them user‘s first attribute. The highest click rate was in the age category of 21–25 years. However, this may be negligible due to the disproportion of the sample in this category. Across different university year groups, the sample was divided comparably. Students reached the highest susceptibility in the third year. From the perspective of studies, the highest number occurred for students of International Relations, followed by students of Psychology. Provided by Google Analytics, most users used Windows as their operating system and entered the web page from their desktop, specifically from the Google Chrome browser. Table 4 summarises all the factors connected with susceptibility to phishing attacks in the present research.