Perceived versus Actual Phishing Detection

Sammanfattning

This study investigates the relationship between students’ perceived confidence in handling phishing emails and their responses to simulated phishing attempts, with a particular focus on differences between IT and non-IT students. Using a primarily quantitative survey consisting of seven simulated email scenarios, the study examines how students distinguish between legitimate and potentially malicious emails. The findings indicate that participants generally adopted cautious behavior, often choosing to ignore or report suspicious messages. However, unsafe behaviors remained present across all groups. A notable finding was the mismatch between confidence and decision accuracy, as several participants expressed high certainty in decisions that were objectively unsafe, suggesting the presence of overconfidence bias. The results also revealed only limited differences between IT and non-IT students, indicating that technical background alone does not eliminate phishing susceptibility. In addition, situational factors such as perceived urgency and personal relevance were found to influence participant behavior. The study concludes that phishing susceptibility is shaped by a combination of psychological, behavioral, and contextual factors, highlighting the importance of cybersecurity education that addresses both technical awareness and human decision-making.