Phishing in the Dark: Dark Personality is Associated with Phishing Susceptibility Due to Decreased Social Awareness

Abstract

Phishing attacks account for a sizable number of data breaches and are costly to individuals and organizations. A burgeoning literature is developing on how individual differences predict people’s susceptibility to phishing attacks. Within this literature, an intriguing idea has been proffered: People higher (vs. lower) in the Dark Triad (DT) constructs (narcissism, Machiavellianism, and psychopathy)–best known for victimizing others–may be more susceptible to phishing attacks. Nonetheless, the relationship between DT constructs and phishing susceptibility is rarely studied and remains poorly understood. We proposed that the relationship between DT constructs and phishing susceptibility could be due to these constructs being associated with deficiencies in the social awareness aspect of social-cognitive intelligence. College participants (N = 461) completed multi-faceted measures of DT constructs and measures of their social awareness, cognitive reflectiveness, and social information processing ability. Participants were exposed to various phishing emails, and we measured their susceptibility to respond to them. Generally, each DT facet related to greater susceptibility to phishing due to the facet’s association with lower social awareness (controlling for cognitive reflectiveness and social information processing); only an agentic aspect of narcissism related to enhanced phishing susceptibility apart from its association with social awareness, cognitive reflectiveness, and social information processing. Broadly, the findings offer initial insight into how the DT may relate to phishing susceptibility and may help inform efforts to better understand who is vulnerable to phishing scams.