# Breaching the Human Firewall: Social engineering in Phishing and Spear-Phishing Emails

arXiv: https://arxiv.org/abs/1606.00887 · HTML: https://mlsanity.com/paper/1606.00887/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 28 May 2016.

## Built on by (most cited first, 7 of 7)

- [Analysis and prevention of AI-based phishing email attacks](https://mlsanity.com/paper/2405.05435/) (2024)
- [Prompted Contextual Vectors for Spear-Phishing Detection](https://mlsanity.com/paper/2402.08309/) (2024)
- [New Benchmarks for Asian Facial Recognition Tasks: Face Classification with Large Foundation Models](https://mlsanity.com/paper/2310.09756/) (2023)
- [SEAR: A Multimodal Dataset for Analyzing AR-LLM-Driven Social Engineering Behaviors](https://mlsanity.com/paper/2505.24458/) (2025)
- [Assessing AI-Generated vs. Human-Authored Spear Phishing SMS Attacks: An Empirical Study](https://mlsanity.com/paper/2406.13049/) (2024)
- [The Psychology of Falsehood: A Human-Centric Survey of Misinformation Detection](https://mlsanity.com/paper/2509.15896/) (2025)
- [Assessing Spear-Phishing Website Generation in Large Language Model Coding Agents](https://mlsanity.com/paper/2602.13363/) (2026)

## Abstract (arXiv)

We examined the influence of three social engineering strategies on users' judgments of how safe it is to click on a link in an email. The three strategies examined were authority, scarcity and social proof, and the emails were either genuine, phishing or spear-phishing. Of the three strategies, the use of authority was the most effective strategy in convincing users that a link in an email was safe. When detecting phishing and spear-phishing emails, users performed the worst when the emails used the authority principle and performed best when social proof was present. Overall, users struggled to distinguish between genuine and spear-phishing emails. Finally, users who were less impulsive in making decisions generally were less likely to judge a link as safe in the fraudulent emails. Implications for education and training are discussed.