Phishing email difficulty varies widely (15–85% correct) while mean confidence varies little (80–90%), leaving some victims unaware they were fooled¶

Claim · All claims
Evidence · 1 study · associational r2 · q3
Currency · newest study 2019 · not yet checked against its sources · not reviewed by a person

Subclaims¶

q3 i? Proportion correctly identifying phishing emails ranged from 15% to 85%, while mean confidence ranged only from 80 to 90% across individual emails in both categories. → Casey Inez Canfield & Baruch Fischhoff & Alex Davis 2019

Evidence¶

Casey Inez Canfield & Baruch Fischhoff & Alex Davis 2019¶

Casey Inez Canfield & Baruch Fischhoff & Alex Davis. (2019). Better beware: comparing metacognition for phishing and legitimate emails. Metacognition and Learning. https://doi.org/10.1007/s11409-019-09197-5

q3 · i? · associational · r2

Item-level analysis (Fig. 3a) plotting each email's actual difficulty against perceived difficulty across both experiments. The article concludes some phishing emails fooled participants while leaving them unaware they were being fooled.

"for the phishing emails, the proportion correctly identified ranged from 15% to 85%. Thus, some were much more deceptive than others. There was little variance in participants ' mean confidence when evaluating individual emails, in either category (ranging from 80 to 90% confident)."

Discussion¶

Related Claims¶

• Calibration is worse and resolution better for phishing emails than for legitimate emails — related
• Future anti-phishing interventions should measure both performance and metacognition, aiming to shift the phishing calibration curve toward the legitimate-email pattern — related
• Participants are consistently overconfident for phishing emails but relatively well calibrated for legitimate emails except at 100% confidence — related
• Email-detection confidence judgments show good calibration but poor resolution, with aggregate overconfidence of 18% — a broader claim this one bears on