{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,17]],"date-time":"2026-03-17T03:21:18Z","timestamp":1773717678424,"version":"3.50.1"},"reference-count":72,"publisher":"Emerald","issue":"5","license":[{"start":{"date-parts":[[2017,11,13]],"date-time":"2017-11-13T00:00:00Z","timestamp":1510531200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.emerald.com\/insight\/site-policies"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["ICS"],"published-print":{"date-parts":[[2017,11,13]]},"abstract":"<jats:sec>\n<jats:title content-type=\"abstract-subheading\">Purpose<\/jats:title>\n<jats:p>The purpose of this study is to explore how the opening phrase of a phishing email influences the action taken by the recipient.<\/jats:p>\n<\/jats:sec>\n<jats:sec>\n<jats:title content-type=\"abstract-subheading\">Design\/methodology\/approach<\/jats:title>\n<jats:p>Two types of phishing emails were sent to 593 employees, who were asked to provide personally identifiable information (PII). A personalised spear phishing email opening was randomly used in half of the emails.<\/jats:p>\n<\/jats:sec>\n<jats:sec>\n<jats:title content-type=\"abstract-subheading\">Findings<\/jats:title>\n<jats:p>Nineteen per cent of the employees provided their PII in a general phishing email, compared to 29 per cent in the spear phishing condition. Employees having a high power distance cultural background were more likely to provide their PII, compared to those with a low one. There was no effect of age on providing the PII requested when the recipient\u2019s years of service within the organisation is taken into account.<\/jats:p>\n<\/jats:sec>\n<jats:sec>\n<jats:title content-type=\"abstract-subheading\">Practical implications<\/jats:title>\n<jats:p>This research shows that success is higher when the opening sentence of a phishing email is personalised. The resulting model explains victimisation by phishing emails well, and it would allow practitioners to focus awareness campaigns to maximise their effect.<\/jats:p>\n<\/jats:sec>\n<jats:sec>\n<jats:title content-type=\"abstract-subheading\">Originality\/value<\/jats:title>\n<jats:p>The innovative aspect relates to explaining spear phishing using four socio-demographic variables.<\/jats:p>\n<\/jats:sec>","DOI":"10.1108\/ics-03-2017-0009","type":"journal-article","created":{"date-parts":[[2017,10,3]],"date-time":"2017-10-03T19:12:43Z","timestamp":1507057963000},"page":"593-613","source":"Crossref","is-referenced-by-count":45,"title":["Spear phishing in organisations explained"],"prefix":"10.1108","volume":"25","author":[{"given":"Jan-Willem","family":"Bullee","sequence":"first","affiliation":[]},{"given":"Lorena","family":"Montoya","sequence":"additional","affiliation":[]},{"given":"Marianne","family":"Junger","sequence":"additional","affiliation":[]},{"given":"Pieter","family":"Hartel","sequence":"additional","affiliation":[]}],"member":"140","reference":[{"key":"key2020120422583550300_ref001","doi-asserted-by":"publisher","first-page":"362","DOI":"10.1007\/978-3-540-77366-5 33","article-title":"Phishing IQ tests measure fear, not ability","year":"2007","journal-title":"Lecture Notes in Computer Science (Including Subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), 4886 LNCS"},{"key":"key2020120422583550300_ref072","article-title":"Susceptibility of practical phishing attacks in academic fields","year":"2015"},{"issue":"3","key":"key2020120422583550300_ref002","doi-asserted-by":"publisher","first-page":"167","DOI":"10.1007\/s11166 -010-9105-x","article-title":"Risk aversion and physical prowess: prediction, choice and Bias","volume":"41","year":"2010","journal-title":"Journal of Risk and Uncertainty"},{"issue":"2","key":"key2020120422583550300_ref003","doi-asserted-by":"publisher","first-page":"537","DOI":"10.1162\/003355397555280","article-title":"Preference parameters and behavioral heterogeneity: an experimental approach in the health and retirement study","volume":"112","year":"1997","journal-title":"The Quarterly Journal of Economics"},{"key":"key2020120422583550300_ref004","unstructured":"Belmont Report (1979), The Belmont Report: Ethical Principles and Guidelines for the Protection of Human Subjects of Research, The Commission."},{"key":"key2020120422583550300_ref005","volume-title":"Computer Security Handbook","year":"2014","edition":"6th ed."},{"issue":"1","key":"key2020120422583550300_ref006","doi-asserted-by":"publisher","first-page":"21","DOI":"10.1089\/cpb.2005.8.21","article-title":"Gender and information and communication technologies (ICT) anxiety: male self-assurance and female hesitation","volume":"8","year":"2005","journal-title":"CyberPsychology & Behavior: The Impact of the Internet, Multimedia and Virtual Reality on Behavior and Society"},{"key":"key2020120422583550300_ref007","doi-asserted-by":"publisher","first-page":"107","DOI":"10.3233\/978-1-61499-617-0-107","article-title":"Telephone-based social engineering attacks: an experiment testing the success and time decay of an intervention","year":"2016"},{"issue":"1","key":"key2020120422583550300_ref008","doi-asserted-by":"publisher","first-page":"97","DOI":"10.1007\/s11292-014-9222-7","article-title":"The persuasion and security awareness experiment: reducing the success of social engineering attacks","volume":"11","year":"2015","journal-title":"Journal of Experimental Criminology"},{"key":"key2020120422583550300_ref009","doi-asserted-by":"publisher","article-title":"Perceptions of information security at the workplace: linking information security climate to compliant behaviour","year":"2005","DOI":"10.1016\/j.cose.2012.04.004"},{"key":"key2020120422583550300_ref010","volume-title":"Influence","year":"2009"},{"key":"key2020120422583550300_ref011","volume-title":"Title 45: Public Welfare, Department of Health and Human Services, Part 46: Protection of Human Subjects","author":"Code of Federal Regulations","year":"2005"},{"issue":"4","key":"key2020120422583550300_ref012","doi-asserted-by":"publisher","first-page":"933","DOI":"10.1111\/j.1745-9125.1987.tb00826.x","article-title":"Understanding crime displacement: an application of rational choice theory","volume":"25","year":"1987","journal-title":"Criminology"},{"key":"key2020120422583550300_ref013","doi-asserted-by":"publisher","first-page":"90","DOI":"10.1016\/j.cose.2012.09.010","article-title":"Future directions for behavioral information security research","volume":"32","year":"2013","journal-title":"Computers & Security"},{"issue":"1","key":"key2020120422583550300_ref014","first-page":"4","article-title":"The origins of social engineering","volume":"1","year":"2008","journal-title":"McAffee Security Journal"},{"key":"key2020120422583550300_ref015","unstructured":"Deevy, M., Lucich, S. and Beals, M. (2012), \u201cScams, schemes and swindles a review of consumer financial fraud research\u201d, Technical Report, Financial Fraud Research Centre."},{"key":"key2020120422583550300_ref016","unstructured":"European Social Survey Education Netu (2013), \u201cAdding interaction terms to OLS regression models\u201d, available at: http:\/\/essedunet.nsd.uib.no\/cms\/topics\/multilevel\/ch1\/5.html (accessed 27 June 2016)"},{"key":"key2020120422583550300_ref017","volume-title":"Discovering Statistics Using R","year":"2012"},{"issue":"2","key":"key2020120422583550300_ref018","doi-asserted-by":"publisher","first-page":"178","DOI":"10.1108\/ICS-05-2014-0029","article-title":"Investigating personal determinants of phishing and the effect of national culture","volume":"23","year":"2015","journal-title":"Information & Computer Security"},{"key":"key2020120422583550300_ref019","unstructured":"FNV (2016), \u201cOnzekerheid, werkdruk en veiligheidsrisico\u2019s - een verkennend onderzoek naar de veiligheids- beleving van passagemedewerkers op schiphol (No. 61604)\u201d, available at: www.fnv.nl\/site\/nieuws\/webassistent\/Jose-Kager\/fnvonderzoek-bagage-en-incheckmedewerkers-schiphol-te-weinig-vaste-mensen-voor-veilig-werk-\/onzekerheidwerkdrukenveiligheidsrisicosafhandelingschiphol.pdf (accessed 11 January 2017)."},{"issue":"3","key":"key2020120422583550300_ref020","doi-asserted-by":"publisher","first-page":"10","DOI":"10.1016\/S1361-3723(07)70035-0","article-title":"Phishing: can we spot the signs?","volume":"2007","year":"2007","journal-title":"Computer Fraud and Security"},{"issue":"1","key":"key2020120422583550300_ref021","doi-asserted-by":"publisher","first-page":"83","DOI":"10.1080\/14792779143000033","article-title":"How to make cognitive illusions disappear: beyond \u2018heuristics and biases","volume":"2","year":"1991","journal-title":"European Review of Social Psychology"},{"issue":"2","key":"key2020120422583550300_ref022","doi-asserted-by":"publisher","first-page":"243","DOI":"10.1177\/a017405","article-title":"Virtual criminality: old wine in new bottles?","volume":"10","year":"2001","journal-title":"Social and Legal Studies"},{"key":"key2020120422583550300_ref023","volume-title":"Econometric Analysis","year":"2011"},{"issue":"1","key":"key2020120422583550300_ref024","doi-asserted-by":"publisher","first-page":"1","DOI":"10.2307\/2678130","article-title":"Demography of risk aversion","volume":"68","year":"2001","journal-title":"The Journal of Risk and Insurance"},{"issue":"5","key":"key2020120422583550300_ref025","doi-asserted-by":"publisher","first-page":"471","DOI":"10.1002\/(SICI)1099-1468(199609)","article-title":"Smoking, seat belts, and other risky consumer decisions: differences by gender and race","volume":"17","year":"1996","journal-title":"Managerial and Decision Economics"},{"key":"key2020120422583550300_ref026","volume-title":"Culture\u2019s Consequences: International Differences in Work-Related Attitudes","year":"1980"},{"key":"key2020120422583550300_ref027","volume-title":"Culture\u2019s Consequences: Comparing Values, Behaviors, Institutions, and Organizations across Nations","year":"2001"},{"key":"key2020120422583550300_ref028","volume-title":"Cultures and Organizations: Software of the Mind, Third Edition","year":"2010"},{"key":"key2020120422583550300_ref029","doi-asserted-by":"publisher","first-page":"357","DOI":"10.1109\/EDOCW.2014.59","article-title":"An empirical investigation of the effect of target-related information in phishing attacks","year":"2014"},{"issue":"1","key":"key2020120422583550300_ref030","doi-asserted-by":"publisher","first-page":"74","DOI":"10.1145\/2063176.2063197","article-title":"The state of phishing attacks","volume":"55","year":"2012","journal-title":"Communications of the ACM"},{"issue":"1","key":"key2020120422583550300_ref031","doi-asserted-by":"publisher","first-page":"1012","DOI":"10.1177\/1541931213571226","article-title":"Keeping up with the joneses: assessing phishing susceptibility in an email task","volume":"57","year":"2013","journal-title":"Proceedings of the Human Factors and Ergonomics Society Annual Meeting"},{"issue":"2","key":"key2020120422583550300_ref032","first-page":"94","article-title":"Length of service and commitment of nurses in hospitals of social security organization (SSO) in Tehran","volume":"5","year":"2014","journal-title":"Caspian Journal of Internal Medicine"},{"issue":"10","key":"key2020120422583550300_ref033","doi-asserted-by":"publisher","first-page":"94","DOI":"10.1145\/1290958.1290968","article-title":"Social phishing","volume":"50","year":"2007","journal-title":"Communications of the ACM"},{"key":"key2020120422583550300_ref034","doi-asserted-by":"publisher","first-page":"75","DOI":"10.1016\/j.chb.2016.09.012","article-title":"Priming and warnings are not effective to prevent social engineering attacks","volume":"66","year":"2017","journal-title":"Computers in Human Behavior"},{"key":"key2020120422583550300_ref035","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1109\/ISSA.2014.6950509","article-title":"Considering the influence of human trust in practical social engineering exercises","year":"2014"},{"key":"key2020120422583550300_ref036","unstructured":"Kennedy, D. (2011), \u201cThere\u2019s something \u201chuman\u201d to social engineering\u201d, available at: http:\/\/magazine.thehackernews.com\/article-1.html"},{"issue":"1","key":"key2020120422583550300_ref037","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1186\/s40163-014-0009-y","article-title":"Achieving a consensual definition of phishing based on a systematic review of the literature","volume":"3","year":"2014","journal-title":"Crime Science"},{"issue":"4","key":"key2020120422583550300_ref038","doi-asserted-by":"publisher","first-page":"685","DOI":"10.1177\/014920630002600405","article-title":"Power-distance, gender and organizational justice","volume":"26","year":"2000","journal-title":"Journal of Management"},{"issue":"1","key":"key2020120422583550300_ref039","doi-asserted-by":"publisher","first-page":"70","DOI":"10.1111\/j.1745-6606.1997.tb00827.x","article-title":"Consumer vulnerability to fraud: influencing factors","volume":"31","year":"1997","journal-title":"Journal of Consumer Affairs"},{"issue":"3","key":"key2020120422583550300_ref040","doi-asserted-by":"publisher","first-page":"1","DOI":"10.4018\/irmj.2011070101","article-title":"Social engineering: the neglected human factor","volume":"24","year":"2011","journal-title":"Information Resources Management Journal"},{"issue":"4\/5","key":"key2020120422583550300_ref041","doi-asserted-by":"publisher","first-page":"257","DOI":"10.1007\/s10611-007-9059-3","article-title":"Transnational organised cyber crime: distinguishing threat from reality","volume":"46","year":"2006","journal-title":"Crime, Law and Social Change"},{"key":"key2020120422583550300_ref042","volume-title":"Applying Regression and Correlation: A Guide for Students and Researchers","year":"2001"},{"issue":"4","key":"key2020120422583550300_ref043","doi-asserted-by":"crossref","first-page":"408","DOI":"10.1037\/0021-9010.63.4.408","article-title":"An evaluation of precursors of hospital employee turnover","volume":"63","year":"1978","journal-title":"The Journal of Applied Psychology"},{"key":"key2020120422583550300_ref044","doi-asserted-by":"publisher","first-page":"31","DOI":"10.1109\/EISIC.2013.12","article-title":"How digital is traditional crime?","year":"2013"},{"issue":"22","key":"key2020120422583550300_ref045","first-page":"181","article-title":"A comparison of technical and vocational acquired skills differences based on gender in Tvet institutions, Uasin Gishu County, Kenya","volume":"4","year":"2013","journal-title":"Journal of Education and Practice"},{"key":"key2020120422583550300_ref046","unstructured":"Neve, R. and Hulst, R.V.D. (2008), \u201cHigh-tech Crime: inventarisatie van literatuur over Soorten criminaliteit en hun daders\u201d, Technical Report No. 978-90-5454-998-7, WODC."},{"issue":"3","key":"key2020120422583550300_ref047","doi-asserted-by":"publisher","first-page":"213","DOI":"10.1108\/03068290010286546","article-title":"Is length of service related to the level of job satisfaction?","volume":"27","year":"2000","journal-title":"International Journal of Social Economics"},{"key":"key2020120422583550300_ref048","volume-title":"Spss Survival Manual: A Step by Step Guide to Data Analysis Using SPSS","year":"2010"},{"key":"key2020120422583550300_ref049","doi-asserted-by":"publisher","first-page":"366","DOI":"10.1007\/978-3-642-39218-4 27","article-title":"Security and privacy protection in information processing systems","year":"2013"},{"issue":"12","key":"key2020120422583550300_ref050","doi-asserted-by":"publisher","first-page":"1373","DOI":"10.1016\/S0895-4356(96)00236-3","article-title":"A simulation study of the number of events per variable in logistic regression analysis","volume":"49","year":"1996","journal-title":"Journal of Clinical Epidemiology"},{"issue":"1","key":"key2020120422583550300_ref051","doi-asserted-by":"publisher","first-page":"104","DOI":"10.1016\/j.jesp.2005.04.002","article-title":"Consistency-based compliance across cultures","volume":"43","year":"2007","journal-title":"Journal of Experimental Social Psychology"},{"issue":"1","key":"key2020120422583550300_ref052","doi-asserted-by":"publisher","first-page":"67","DOI":"10.2307\/41165170","article-title":"Organizational demography: implications for management","volume":"28","year":"1985","journal-title":"California Management Review"},{"issue":"8","key":"key2020120422583550300_ref053","doi-asserted-by":"publisher","first-page":"816","DOI":"10.1016\/j.cose.2009.05.008","article-title":"Self-efficacy in information security: its influence on end users\u2019 information security practice behavior","volume":"28","year":"2009","journal-title":"Computers & Security"},{"issue":"6","key":"key2020120422583550300_ref054","doi-asserted-by":"publisher","first-page":"32","DOI":"10.2469\/faj.v48.n6.32","article-title":"Asset allocation and individual risk aversion","volume":"48","year":"1992","journal-title":"Financial Analysts Journal"},{"issue":"4","key":"key2020120422583550300_ref055","doi-asserted-by":"publisher","first-page":"427","DOI":"10.1177\/1745691614535935","article-title":"Contrary to psychological and popular opinion, there is no compelling evidence that older adults are disproportionately victimized by consumer fraud","volume":"9","year":"2014","journal-title":"Perspectives on Psychological Science"},{"issue":"7","key":"key2020120422583550300_ref056","doi-asserted-by":"publisher","first-page":"745","DOI":"10.1108\/02683940310502421","article-title":"The relationships of age and length of service with job satisfaction: an examination of hotel employees in Thailand","volume":"18","year":"2003","journal-title":"Journal of Managerial Psychology"},{"key":"key2020120422583550300_ref057","volume-title":"Secrets & Lies: Digital Security in a Networked World","year":"2000","edition":"1st ed."},{"key":"key2020120422583550300_ref058","doi-asserted-by":"publisher","first-page":"373","DOI":"10.1145\/1753326.1753383","article-title":"Who falls for phish? A demographic analysis of phishing susceptibility and effectiveness of interventions","year":"2010"},{"issue":"1","key":"key2020120422583550300_ref059","doi-asserted-by":"publisher","first-page":"123","DOI":"10.1093\/sf\/71.1.123","article-title":"Organizational demography and inequality","volume":"71","year":"1992","journal-title":"Social Forces"},{"key":"key2020120422583550300_ref060","first-page":"77","article-title":"Values","volume-title":"Handbook of Cross-Cultural Psychology: Social Behavior and Applications","year":"1997"},{"key":"key2020120422583550300_ref061","unstructured":"Sparshott, M. (2014), \u201cThe psychology of phishing\u201d, available at:www.helpnetsecurity.com\/2014\/07\/23\/the-psychology-of-phishing\/ (accessed 26 May 2016)"},{"issue":"1","key":"key2020120422583550300_ref062","doi-asserted-by":"publisher","first-page":"e145","DOI":"10.1542\/peds.2010-2105","article-title":"Low-dose, high-frequency CPR training improves skill retention of in-hospital pediatric providers","volume":"128","year":"2011","journal-title":"Pediatrics"},{"key":"key2020120422583550300_ref063","doi-asserted-by":"publisher","first-page":"37","DOI":"10.1109\/STAST.2013.10","article-title":"American and indian conceptualizations of phishing","year":"2013"},{"issue":"1","key":"key2020120422583550300_ref064","doi-asserted-by":"publisher","first-page":"54","DOI":"10.1177\/0011128795041001004","article-title":"Victimization of persons by fraud","volume":"41","year":"1995","journal-title":"Crime & Delinquency"},{"issue":"4157","key":"key2020120422583550300_ref065","doi-asserted-by":"publisher","first-page":"1124","DOI":"10.1007\/978-94-010-1834-0 8","article-title":"Judgment under uncertainty: heuristics and biases","volume":"185","year":"1974","journal-title":"Science"},{"key":"key2020120422583550300_ref066","article-title":"Social engineering and its countermeasures","volume-title":"Handbook of Research on Social and Organizational Liabilities in Information Security","year":"2009"},{"issue":"2","key":"key2020120422583550300_ref067","doi-asserted-by":"publisher","first-page":"163","DOI":"10.1007\/BF02887448","article-title":"Fraud victimization: risky business or just bad luck?","volume":"21","year":"1997","journal-title":"American Journal of Criminal Justice"},{"key":"key2020120422583550300_ref068","doi-asserted-by":"publisher","first-page":"164","DOI":"10.1038\/533164a","article-title":"How to hack the hackers: the human side of cybercrime","volume":"533","year":"2016","journal-title":"Nature"},{"issue":"1","key":"key2020120422583550300_ref069","doi-asserted-by":"publisher","first-page":"57","DOI":"10.1111\/j.1744-6570.1976.tb00401.x","article-title":"Estimates of future tenure, satisfaction, and biographical variables as predictors of termination","volume":"29","year":"1976","journal-title":"Personnel Psychology"},{"issue":"2","key":"key2020120422583550300_ref070","doi-asserted-by":"publisher","first-page":"385","DOI":"10.1287\/isre.2014.0522","article-title":"Influence techniques in phishing attacks: an examination of vulnerability and resistance","volume":"25","year":"2014","journal-title":"Information Systems Research"},{"issue":"3\/4","key":"key2020120422583550300_ref071","doi-asserted-by":"publisher","first-page":"193","DOI":"10.1080\/08961530.2011.578059","article-title":"Measuring Hofstede\u2019s five dimensions of cultural values at the individual level: development and validation of CV scale","volume":"23","year":"2011","journal-title":"Journal of International Consumer Marketing"}],"container-title":["Information &amp; Computer Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.emerald.com\/insight\/content\/doi\/10.1108\/ICS-03-2017-0009\/full\/xml","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/www.emerald.com\/insight\/content\/doi\/10.1108\/ICS-03-2017-0009\/full\/html","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,7,25]],"date-time":"2025-07-25T01:22:44Z","timestamp":1753406564000},"score":1,"resource":{"primary":{"URL":"http:\/\/www.emerald.com\/ics\/article\/25\/5\/593-613\/189093"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2017,11,13]]},"references-count":72,"journal-issue":{"issue":"5","published-print":{"date-parts":[[2017,11,13]]}},"alternative-id":["10.1108\/ICS-03-2017-0009"],"URL":"https:\/\/doi.org\/10.1108\/ics-03-2017-0009","relation":{},"ISSN":["2056-4961"],"issn-type":[{"value":"2056-4961","type":"print"}],"subject":[],"published":{"date-parts":[[2017,11,13]]}}}