Casey Canfield|Baruch Fischhoff|Alexander Davis
Better beware: comparing metacognition for phishing and legitimate emails
Missouri University of Science and Technology|Carnegie Mellon University|Carnegie Mellon University
every electronic message poses threat phishing attack recipients underestimate threat expose connected identity theft ransom malware worse recipients overestimate threat incur needless costs perhaps reducing willingness ability respond time two experiments examined appropriateness individuals confidence judgments whether email messages legitimate phishing using calibration resolution metacognition metrics experiments found participants reasonable calibration poor resolution reflecting weak correlation confidence knowledge patterns differed legitimate phishing emails participants better calibrated legitimate emails except expressing complete confidence judgments consistently overconfident phishing emails second experiment compared performance laboratory task individuals actual vulnerability found participants better resolution less likely malicious files home computers comparison raised general questions design antiphishing training providing feedback essential selfregulated learning