{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,9]],"date-time":"2026-04-09T14:42:44Z","timestamp":1775745764546,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":54,"publisher":"ACM","license":[{"start":{"date-parts":[[2024,6,19]],"date-time":"2024-06-19T00:00:00Z","timestamp":1718755200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2024,6,19]]},"DOI":"10.1145\/3626232.3653266","type":"proceedings-article","created":{"date-parts":[[2024,6,10]],"date-time":"2024-06-10T18:20:25Z","timestamp":1718043625000},"page":"55-65","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":3,"title":["Nothing Personal: Understanding the Spread and Use of Personally Identifiable Information in the Financial Ecosystem"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0007-0236-1079","authenticated-orcid":false,"given":"Mehrnoosh","family":"Zaeifi","sequence":"first","affiliation":[{"name":"Arizona State University, Tempe, Arizona, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9581-6269","authenticated-orcid":false,"given":"Faezeh","family":"Kalantari","sequence":"additional","affiliation":[{"name":"Arizona State University, Tempe, Arizona, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4313-3714","authenticated-orcid":false,"given":"Adam","family":"Oest","sequence":"additional","affiliation":[{"name":"Arizona State University, Tempe, Arizona, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6116-8737","authenticated-orcid":false,"given":"Zhibo","family":"Sun","sequence":"additional","affiliation":[{"name":"Drexel University, Philadelphia, Pennsylvania, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4271-1666","authenticated-orcid":false,"given":"Gail-Joon","family":"Ahn","sequence":"additional","affiliation":[{"name":"Arizona State University, Tempe, Arizona, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8832-1789","authenticated-orcid":false,"given":"Yan","family":"Shoshitaishvili","sequence":"additional","affiliation":[{"name":"Arizona State University, Tempe, Arizona, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6424-0001","authenticated-orcid":false,"given":"Tiffany","family":"Bao","sequence":"additional","affiliation":[{"name":"Arizona State University, Tempe, Arizona, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1524-2566","authenticated-orcid":false,"given":"Ruoyu","family":"Wang","sequence":"additional","affiliation":[{"name":"Arizona State University, Tempe, Arizona, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2634-3901","authenticated-orcid":false,"given":"Adam","family":"Doup\u00e9","sequence":"additional","affiliation":[{"name":"Arizona State University, Tempe, Arizona, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2024,6,19]]},"reference":[{"key":"e_1_3_2_1_1_1","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Bohuk Marina Sanusi","year":"2022","unstructured":"Marina Sanusi Bohuk, Mazharul Islam, Suleman Ahmad, Michael Swift, Thomas Ristenpart, and Rahul Chatterjee. 2022. Gossamer: Securely measuring password-based logins. In 31st USENIX Security Symposium (USENIX Security 22). 1867--1884."},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.pmedr.2020.101058"},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1109\/ECRIME.2016.7487944"},{"key":"e_1_3_2_1_4_1","volume-title":"Cyber frauds, scams and their victims","author":"Button Mark","unstructured":"Mark Button and Cassandra Cross. 2017. Cyber frauds, scams and their victims. Taylor & Francis."},{"key":"e_1_3_2_1_5_1","unstructured":"St\u00e9phane Ciolino Simon Parkin and Paul Dunphy. 2019. Of Two Minds about Two-Factor: Understanding Everyday FIDO U2F Usability through Device Comparison and Experience Sampling. In SOUPS."},{"key":"e_1_3_2_1_6_1","volume-title":"Authentication in an internet banking environment. FFIEC gencies (August 2001 Guidance)","author":"Federal Financial Institutions Examination Council","year":"2005","unstructured":"Federal Financial Institutions Examination Council. 2005. Authentication in an internet banking environment. FFIEC gencies (August 2001 Guidance) (2005)."},{"key":"e_1_3_2_1_7_1","unstructured":"Lyle Daly. 2020. have i been pwned? https:\/\/haveibeenpwned.com\/."},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.5555\/1881151.1881152"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978313"},{"key":"e_1_3_2_1_10_1","volume-title":"New Data Shows FTC Received 2.8 Million Fraud Reports from Consumers","author":"Federal Trade Commission","year":"2021","unstructured":"Federal Trade Commission. 2022. New Data Shows FTC Received 2.8 Million Fraud Reports from Consumers in 2021. https:\/\/www.ftc.gov\/news-events\/news\/press-releases\/2022\/02\/new-data-shows-ftc-received-28-million-fraud-reports-consumers-2021-0."},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1002\/mde.2991"},{"key":"e_1_3_2_1_12_1","unstructured":"Maximilian Golla Grant Ho Marika Lohmus Monica Pulluri and Elissa M Redmiles. 2021. Driving 2FA Adoption at Scale: Optimizing Two-Factor Authentication Notification Design Patterns. In USENIX Security."},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1109\/ECRIME.2017.7945053"},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2013.09.032"},{"key":"e_1_3_2_1_15_1","unstructured":"Identity Guard. 2020. Identity Guard. https:\/\/www.identityguard.com."},{"key":"e_1_3_2_1_16_1","unstructured":"ID.me. 2022. The Digital Wallet that Puts You in Control. https:\/\/www.id.mei."},{"key":"e_1_3_2_1_17_1","volume-title":"Sukanya Vaddepalli, Vijayanand Banahatti, Sachin Premsukh Lodha, and Sankalp Suneel Pandit.","author":"Jayakrishnan Gokul Chettoor","year":"2020","unstructured":"Gokul Chettoor Jayakrishnan, Gangadhara Reddy Sirigireddy, Sukanya Vaddepalli, Vijayanand Banahatti, Sachin Premsukh Lodha, and Sankalp Suneel Pandit. 2020. Passworld: A serious game to promote password awareness and diversity in an enterprise. In SOUPS."},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.2478\/orga-2018-0007"},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10693-015-0218-x"},{"key":"e_1_3_2_1_20_1","volume-title":"Unleash the Simulacrum: Shifting Browser Realities for Robust Extension-Fingerprinting Prevention. In 31st USENIX Security Symposium (USENIX Security 22)","author":"Karami Soroush","year":"2022","unstructured":"Soroush Karami, Faezeh Kalantari, Mehrnoosh Zaeifi, Xavier J Maso, Erik Trickel, Panagiotis Ilia, Yan Shoshitaishvili, Adam Doup\u00e9 , and Jason Polakis. 2022. Unleash the Simulacrum: Shifting Browser Realities for Robust Extension-Fingerprinting Prevention. In 31st USENIX Security Symposium (USENIX Security 22). 735--752."},{"key":"e_1_3_2_1_21_1","unstructured":"Sowmya Karunakaran Kurt Thomas Elie Bursztein and Oxana Comanescu. 2018. Data breaches: User comprehension expectations and concerns with handling exposed data. In SOUPS."},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.13089\/JKIISC.2015.25.3.627"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCCI50826.2021.9457015"},{"key":"e_1_3_2_1_24_1","volume-title":"Identity Lockdown: Your Step-By-Step Guide to Identity Theft Protection. Lulu. com.","author":"LaPiedra James R","year":"2016","unstructured":"James R LaPiedra et al. 2016. Identity Lockdown: Your Step-By-Step Guide to Identity Theft Protection. Lulu. com."},{"key":"e_1_3_2_1_25_1","volume-title":"An Empirical Study of Wireless Carrier Authentication for SIM Swaps. In Sixteenth Symposium on Usable Privacy and Security SOUPS","author":"Lee Kevin","year":"2020","unstructured":"Kevin Lee, Benjamin Kaiser, Jonathan Mayer, and Arvind Narayanan. 2020. An Empirical Study of Wireless Carrier Authentication for SIM Swaps. In Sixteenth Symposium on Usable Privacy and Security SOUPS 2020). 61--79."},{"key":"e_1_3_2_1_26_1","volume-title":"Razieh Nokhbeh Zaeem, and K Suzanne Barber","author":"Liau David","year":"2020","unstructured":"David Liau, Razieh Nokhbeh Zaeem, and K Suzanne Barber. 2020. A Survival Game Analysis to Common Personal Identity Protection Strategies. (2020)."},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1145\/3308558.3313489"},{"key":"e_1_3_2_1_28_1","volume-title":"29th USENIX Security Symposium (USENIX Security 20)","author":"Oest Adam","year":"2020","unstructured":"Adam Oest, Penghui Zhang, Brad Wardman, Eric Nunes, Jakub Burgis, Ali Zand, Kurt Thomas, Adam Doup\u00e9, and Gail-Joon Ahn. 2020. Sunrise to Sunset: Analyzing the End-to-end Life Cycle and Effectiveness of Phishing Attacks at Scale. In 29th USENIX Security Symposium (USENIX Security 20)."},{"key":"e_1_3_2_1_29_1","unstructured":"Federal Bureau of Investigation. 2022. Criminals Increasing SIM Swap Schemes to Steal Millions of Dollars from US Public. https:\/\/www.ic3.gov\/Media\/Y2022\/PSA220209."},{"key":"e_1_3_2_1_30_1","unstructured":"U.S. Department of Labor. 2020. Guidance on the Protection of Personal Identifiable Information. https:\/\/www.dol.gov\/general\/ppii."},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1145\/2987443.2987475"},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1145\/3329786"},{"key":"e_1_3_2_1_33_1","volume-title":"cost of a data breach study: Global overview. Benchmark research sponsored by IBM Security Independently conducted by Ponemon Institute LLC","author":"Ponemon I","year":"2018","unstructured":"I Ponemon. 2018. cost of a data breach study: Global overview. Benchmark research sponsored by IBM Security Independently conducted by Ponemon Institute LLC (2018)."},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1080\/01639625.2019.1612980"},{"key":"e_1_3_2_1_35_1","volume-title":"Fifteenth Symposium on Usable Privacy and Security (SOUPS","author":"Reese Ken","year":"2019","unstructured":"Ken Reese, Trevor Smith, Jonathan Dutson, Jonathan Armknecht, Jacob Cameron, and Kent Seamons. 2019. A Usability Study of Five Two-Factor Authentication Methods. In Fifteenth Symposium on Usable Privacy and Security (SOUPS 2019). 357--370."},{"key":"e_1_3_2_1_36_1","unstructured":"Federal Reserve. 2022. Federal Reserve Statistical Release. www.federalreserve.gov\/releases\/lbr\/current\/."},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.procs.2019.01.007"},{"key":"e_1_3_2_1_38_1","volume-title":"Financial Frauds and Scams. Encyclopedia of Gerontology and Population Aging","author":"Salvin Paul","year":"2019","unstructured":"Paul Salvin and Nimkit Lepcha. 2019. Financial Frauds and Scams. Encyclopedia of Gerontology and Population Aging (2019), 1--7."},{"key":"e_1_3_2_1_39_1","volume-title":"Custom Search--Discover more:: A Complete Guide to Google Programmable Search Engines","author":"Shamaeva Irina","unstructured":"Irina Shamaeva and David Galley. 2021. Custom Search--Discover more:: A Complete Guide to Google Programmable Search Engines. Chapman and Hall\/CRC."},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2016.09.009"},{"key":"e_1_3_2_1_41_1","volume-title":"Having Your Cake and Eating It: An Analysis of Concession-Abuse-as-a-Service. In 30th USENIX Security Symposium (USENIX Security 21)","author":"Sun Zhibo","year":"2021","unstructured":"Zhibo Sun, Adam Oest, Penghui Zhang, Carlos Rubio-Medrano, Tiffany Bao, Ruoyu Wang, Ziming Zhao, Yan Shoshitaishvili, Adam Doup\u00e9, Gail-Joon Ahn, et al. 2021. Having Your Cake and Eating It: An Analysis of Concession-Abuse-as-a-Service. In 30th USENIX Security Symposium (USENIX Security 21). 4169--4186."},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1145\/3292006.3300036"},{"key":"e_1_3_2_1_43_1","unstructured":"Kurt Thomas Danny Huang David Wang Elie Bursztein Chris Grier Thomas J Holt Christopher Kruegel Damon McCoy Stefan Savage and Giovanni Vigna. 2015. Framing dependencies introduced by underground commoditization. (2015)."},{"key":"e_1_3_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134067"},{"key":"e_1_3_2_1_45_1","volume-title":"Luca Invernizzi, Borbala Benko, Tadek Pietraszek, Sarvar Patel, Dan Boneh, et al.","author":"Thomas Kurt","year":"2019","unstructured":"Kurt Thomas, Jennifer Pullman, Kevin Yeo, Ananth Raghunathan, Patrick Gage Kelley, Luca Invernizzi, Borbala Benko, Tadek Pietraszek, Sarvar Patel, Dan Boneh, et al. 2019. Protecting accounts from credential stuffing with password breach alerting. In USENIX Security."},{"key":"e_1_3_2_1_46_1","volume-title":"Identifying and Categorizing Malicious Content on Paste Sites: A Neural Topic Modeling Approach. In 2021 IEEE International Conference on Intelligence and Security Informatics (ISI). IEEE, 1--6.","author":"Vahedi Tala","year":"2021","unstructured":"Tala Vahedi, Benjamin Ampel, Sagar Samtani, and Hsinchun Chen. 2021. Identifying and Categorizing Malicious Content on Paste Sites: A Neural Topic Modeling Approach. In 2021 IEEE International Conference on Intelligence and Security Informatics (ISI). IEEE, 1--6."},{"key":"e_1_3_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1177\/1477370818773610"},{"key":"e_1_3_2_1_48_1","volume-title":"Bram Klievink, Nicolas Christin, and Michel Van Eeten.","author":"Wegberg Rolf Van","year":"2018","unstructured":"Rolf Van Wegberg, Samaneh Tajalizadehkhoob, Kyle Soska, Ugur Akyazi, Carlos Hernandez Ganan, Bram Klievink, Nicolas Christin, and Michel Van Eeten. 2018. Plug and prey? measuring the commoditization of cybercrime via online anonymous markets. In 27th USENIX security symposium (USENIX security 18). 1009--1026."},{"key":"e_1_3_2_1_49_1","volume-title":"Slobodan Risti\u0107, and Katarina Prlji\u0107.","author":"Zoran Vuvc","year":"2018","unstructured":"Zoran Vuvc kovi\u0107 , Dragan Vukmirovi\u0107 , Marina Jovanovi\u0107 Milenkovi\u0107 , Slobodan Risti\u0107, and Katarina Prlji\u0107. 2018. Analyzing of e-commerce user behavior to detect identity theft. Physica A: Statistical Mechanics and its Applications , Vol. 511 (2018), 331--335."},{"key":"e_1_3_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1109\/SMARTCOMP.2017.7947016"},{"key":"e_1_3_2_1_51_1","unstructured":"Ke Coby Wang and Michael K Reiter. 2020. Detecting Stuffing of a User's Credentials at Her Own Accounts. In USENIX Security."},{"key":"e_1_3_2_1_52_1","volume-title":"The Free Encyclopedia. https:\/\/en.wikipedia.org\/w\/index.php?title=List_of_online_payment_service_providers&oldid=1123747838 [Online","author":"Wikipedia","year":"2022","unstructured":"Wikipedia contributors. 2022. List of online payment service providers -- Wikipedia, The Free Encyclopedia. https:\/\/en.wikipedia.org\/w\/index.php?title=List_of_online_payment_service_providers&oldid=1123747838 [Online; accessed 6-December-2022]."},{"key":"e_1_3_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.1111\/joca.12191"},{"key":"e_1_3_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.1145\/3313831.3376570"}],"event":{"name":"CODASPY '24: Fourteenth ACM Conference on Data and Application Security and Privacy","location":"Porto Portugal","acronym":"CODASPY '24","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the Fourteenth ACM Conference on Data and Application Security and Privacy"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3626232.3653266","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3626232.3653266","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,22]],"date-time":"2025-08-22T19:48:22Z","timestamp":1755892102000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3626232.3653266"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,6,19]]},"references-count":54,"alternative-id":["10.1145\/3626232.3653266","10.1145\/3626232"],"URL":"https:\/\/doi.org\/10.1145\/3626232.3653266","relation":{},"subject":[],"published":{"date-parts":[[2024,6,19]]},"assertion":[{"value":"2024-06-19","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}