The effects of personal values and message values on vulnerability to phishing

Phishing messages are designed to establish believability in the recipients, and to make them feel that the message is authentic. The current study examines the effect of personal values and of the values associated with the presumed sender on perceived authenticity of phishing messages. We tested two alternative hypotheses: (a) the value-congruency hypothesis contends that when the recipient's values match the underlying value of the message, the perception of authenticity increases; (b) the socially-shared values hypothesis suggests that messages that reflect the social image of the sender increase perception of authenticity. We further hypothesized that trust propensity moderates the effect of values on perception of phishing messages. Study 1 (N = 624) investigated and validated the values conveyed by bank messages. Study 2 (N = 309) tested the main hypotheses. Results supported the socially-shared values hypothesis. Trust propensity did not predict perceived authenticity of messages, and did not moderate the effect of the message value on perceived authenticity. The findings suggest that messages that fit the presumed sender's attributed values may be more risky, regardless of the receiver's values.