Remedies to reduce user susceptibility to phishing attacks

Abstract

Organisations have been compelled to embrace digitisation, increasing their dependence on the internet and computer systems rather than on in-person interactions. These organisations have had to adjust to new societal norms of teleworking and social distancing. The new adjustments were because of the total nationwide lockdown enacted in response to the global Corona Virus disease (COVID-19) pandemic. Many organisations have adopted teleworking to become more agile, but in the face of escalating cybercrime, it has also exposed them to increased security vulnerabilities. The study's ultimate purpose was to report phishing attacks on financial institutions and offer remedial solutions that can be implemented to reduce user susceptibility. To answer the study's main objectives, a qualitative approach was adopted. Semi-structured interviews and interview schedules were used for data collection. The research discussed the two main theories governing the study: Routine activity and Rational choice theories. The rational choice theory describes the reasoning and motivations that underlie the choices made by offenders, whereas the routine activities theory explains the necessary conditions that must be present for a crime to happen. Thematic analysis was used to better understand the data by using codes to uncover commonalities or themes in the responses of the participants. Additionally, thematic data analysis enabled the researcher to report on solutions that met the objectives of the study. The patterns that emerged laid the groundwork for the discussion and allowed the researcher to make references and substantiate with literature from existing studies. The study revealed that users tend to disregard established protocols when engaging with systems, leading to an increased likelihood of organisations being successfully phished. Based on the findings, the recommendations focused on human centric approaches to effectively reducing the success rate of phishing attacks through coordinated efforts with close engagement between employees and Information Technology personnel.