Social Engineering Aspects of Email Phishing: an Overview and Taxonomy
Igor Tomičić · 2023
Numerous online resources and reports are pointing to the growing effectiveness of email phishing techniques, with some indicating that 85% of IT breaches involve the human element, and that 96% or social attacks arrive via email. Phishing is a common occurrence, and a significantly successful one. While most of the available research on phishing involves phishing detection, prevention, filtering, anti-phishing tools, techniques and countermeasures, the remaining body of research is tackling phishing and social engineering in (too) generic and broad contexts. This paper will propose a focused effort to identify the specific groups of techniques that attackers are using in email phishing and the principles running “behind the scenes” that make these attacks successful. Thus, the goal of this paper is threefold: (1) to propose a taxonomy of the observed email phishing techniques, (2) to associate the principles and factors of influence with observed techniques and shed light behind their effectiveness, and (3) to raise awareness and lay the groundwork for working on the model of human resilience against these manipulative forms of cyber attacks.