# Assessing AI-Generated vs. Human-Authored Spear Phishing SMS Attacks: An Empirical Study

arXiv: https://arxiv.org/abs/2406.13049 · HTML: https://mlsanity.com/paper/2406.13049/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 12 of its 60 references that are in the map.
- First posted on arXiv 18 Jun 2024.

## Builds on (most cited first, 12 of 12)

- [Human heuristics for AI-generated language are flawed](https://mlsanity.com/paper/2206.07271/) (2022)
- [Digital Deception: Generative Artificial Intelligence in Social Engineering and Phishing](https://mlsanity.com/paper/2310.13715/) (2023)
- [Devising and Detecting Phishing: Large Language Models vs. Smaller Human Models](https://mlsanity.com/paper/2308.12287/) (2023)
- [From Chatbots to PhishBots? -- Preventing Phishing scams created using ChatGPT, Google Bard and Claude](https://mlsanity.com/paper/2310.19181/) (2023)
- [Lateral Phishing With Large Language Models: A Large Organization Comparative Study](https://mlsanity.com/paper/2401.09727/) (2024)
- [Resistance Against Manipulative AI: key factors and possible actions](https://mlsanity.com/paper/2404.14230/) (2024)
- [Generative Models for Spear Phishing Posts on Social Media](https://mlsanity.com/paper/1802.05196/) (2018)
- [Breaching the Human Firewall: Social engineering in Phishing and Spear-Phishing Emails](https://mlsanity.com/paper/1606.00887/) (2016)
- [Can generative AI and ChatGPT outperform humans on cognitive-demanding problem-solving tasks in science?](https://mlsanity.com/paper/2401.15081/) (2024)
- [Analyzing Social and Stylometric Features to Identify Spear phishing Emails](https://mlsanity.com/paper/1406.3692/) (2014)
- [SoK: Human-Centered Phishing Susceptibility](https://mlsanity.com/paper/2202.07905/) (2022)
- [An empirical analysis of smart contracts: platforms, applications, and design patterns](https://mlsanity.com/paper/1703.06322/) (2017)

## Built on by (most cited first, 1 of 1)

- [Agent Laboratory: Using LLM Agents as Research Assistants](https://mlsanity.com/paper/2501.04227/) (2025)

## Abstract (arXiv)

Personalized phishing is difficult to defend against because messages can be tailored to a target's work, interests, and social context. Large language models may make such tailoring faster and easier, but it remains unclear whether messages produced from simple prompts are more convincing than those written by people. This 25-target pilot study compared personalized smishing messages generated by GPT-4 with messages written by novice student authors working under time constraints. Using the proposed Threshold Ranking Approach for Personalized Deception (TRAPD), participants ranked 12 messages written for them, indicated the point at which they would intend to click, explained their reasoning, and judged whether each message was authored by GPT-4 or a human. GPT-4-generated messages elicited an intention to click more often than student-authored messages (28% versus 21%), although the difference was uncertain. More broadly, our findings suggest that a simple prompt can produce personalized messages that participants found comparably convincing within the uncertainty of this pilot study. Job-related messages were significantly more likely to elicit an intention to click than hobby- or social-media-related messages. When asked whether a message was written by a human or generated by AI, participants identified the source no more accurately than chance, although the two study-specific message sets remained computationally distinguishable based on their text. Together, these findings suggest that accessible AI-assisted personalization may increase the practical scale of social-engineering threats, while also demonstrating both the value and current limitations of TRAPD for controlled and ethical comparison.