Trust modelling for online transactions: a phishing scenario

ABSTRACT

Trust is an important component of online transactions. The increasing amount and sophistication of spam, phishing, and other semantic attacks increase users' uncertainty about the consequences of their actions and their distrust towards other online parties. In this paper, we highlight some key characteristics of a model that we are developing to represent and compare the online trust decision processes of "expert" and "non-expert" computer users. We also report on preliminary data we are gathering to validate, refine, and apply our model. This research is part of a broader project that aims at developing tools and training modules to help online users make good trust decisions.

REFERENCES

• 1: L. Ang, C. Dubelaar, and B. C. Lee. To trust or not to trust? a model of internet trust from the customer's point of view. In Proceedings, 14th Bled Electronic Commerce Conference, pages 25--26, June 2001.
• 2: Anti-Phishing Working Group. Phishing activity trends report. Technical report, Anti-Phishing Working Group. Retrieved Aug 11, 2006, http://www.antiphishing.org/reports/apwg_report_May2006.pdf.
• 3: Ildemaro Araujo , Iván Araujo, Developing trust in internet commerce, Proceedings of the 2003 conference of the Centre for Advanced Studies on Collaborative research, p.1-15, October 06-09, 2003, Toronto, Ontario, Canada
• 4: S. Bellman, E. J. Johnson, S. J. Kobrin, and G. L. Lohse. International Differences in Information privacy concerns: A global survey of consumers. The Information Society, 20: pp. 313--324, 2004.
• 5: Anol Bhattacherjee, Individual Trust in Online Firms: Scale Development and Initial Test, Journal of Management Information Systems, v.19 n.1, p.211-241, Number 1/Summer 2002
• 6: L. M. B. Cabral. The Economics of Trust and Reputation: A Primer. Technical report, New York University and CEPR, May 2002. Retrieved Feb 20, 2006, http://pages.stern.nyu.edu/lcabral/reputation/Reputation_June05.pdf.
• 7: J. Cave. The economics of cyber trust between cyber partners. Retrieved Feb 20, 2005, http://www.foresight.gov.uk/Previous_Projects/Cyber_Trust_and_Crime_Prevention/Reports_and_Publications/Economics_of_Trust_Between_Cyber_Partners/Economics%20of%20trust%20between%20cyber%20partners.pdf.
• 8: A. Cavoukian and T. Hamilton. The Privacy Payoff, How Successful Business Build Consumer Trust. 2002.
• 9: Ramnath K. Chellappa , Raymond G. Sin, Personalization versus Privacy: An Empirical Examination of the Online Consumer's Dilemma, Information Technology and Management, v.6 n.2-3, p.181-202, April 2005 [doi>10.1007/s10799-005-5879-y]
• 10: Cynthia L. Corritore , Beverly Kracher , Susan Wiedenbeck, On-line trust: concepts, evolving themes, a model, International Journal of Human-Computer Studies, v.58 n.6, p.737-758, June 2003 [doi>10.1016/S1071-5819(03)00041-7]
• 11: Rachna Dhamija , J. D. Tygar, The battle against phishing: Dynamic Security Skins, Proceedings of the 2005 symposium on Usable privacy and security, p.77-88, July 06-08, 2005, Pittsburgh, Pennsylvania [doi>10.1145/1073001.1073009]
• 12: Rachna Dhamija , J. D. Tygar , Marti Hearst, Why phishing works, Proceedings of the SIGCHI conference on Human Factors in computing systems, April 22-27, 2006, Montréal, Québec, Canada [doi>10.1145/1124772.1124861]
• 13: Julie S. Downs , Mandy B. Holbrook , Lorrie Faith Cranor, Decision strategies and susceptibility to phishing, Proceedings of the second symposium on Usable privacy and security, July 12-14, 2006, Pittsburgh, Pennsylvania [doi>10.1145/1143120.1143131]
• 14: C. E. Drake, J. J. Oliver, and E. J. Koontz. Anatomy of a phishing email. Technical report, Mail Frontier. Retrieved Feb 27, 2006, http://www.mailfrontier.com/docs/MF_Phish_Anatomy.pdf.
• 15: F. Egger. From Interactions to Transactions: Designing the Trust Experience for Business-to-Consumer Electronic Commerce. PhD thesis, Eindhoven University of Technology (The Netherlands), http://www.ecommuse.com/research/publications/thesis.htm, 2003.
• 16: B. J. Fogg , Jonathan Grudin , Jakob Nielsen , Stuart Card, Persuasive Technology: Using Computers to Change What We Think and Do, Science & Technology Books, 2002
• 17: David Gefen, Reflections on the dimensions of trust and trustworthiness among online consumers, ACM SIGMIS Database, v.33 n.3, p.38-53, Summer 2002 [doi>10.1145/569905.569910]
• 18: E. L. Glaeser, D. I. Laibson, J. A. Scheinkman, and C. L. Soutter. Measuring trust. The Quarterly Journal of Economics, 115(3):811--846, 2000.
• 19: Sonja Grabner-Kräuter , Ewald A. Kaluscha, Empirical research in on-line trust: a review and critical assessment, International Journal of Human-Computer Studies, v.58 n.6, p.783-812, June 2003 [doi>10.1016/S1071-5819(03)00043-0]
• 20: G. A. Guerra, D. J. Zizzo, W. H. Dutton, and M. Peltu. Economics of Trust in the Information Economy: Issues of Identity, Privacy and Security. Technical report, Oxford Internet Institute, April 2003. Retrieved Feb 20, 2006, http://www.oii.ox.ac.uk/resources/publications/RR1.pdf.
• 21: Tom N. Jagatic , Nathaniel A. Johnson , Markus Jakobsson , Filippo Menczer, Social phishing, Communications of the ACM, v.50 n.10, p.94-100, October 2007 [doi>10.1145/1290958.1290968]
• 22: Lance James, Phishing Exposed, Syngress Publishing, 2005
• 23: Jungwon Lee , Jinwoo Kim , Jae Yun Moon, What makes Internet users visit cyber stores again? key design factors for customer loyalty, Proceedings of the SIGCHI conference on Human factors in computing systems, p.305-312, April 01-06, 2000, The Hague, The Netherlands [doi>10.1145/332040.332448]
• 24: Rachael Lininger , Russell Dean Vines, Phishing: Cutting the Identity Theft Line, John Wiley & Sons, 2005
• 25: Mail Frontier. Mailfrontier field guide to phishing. Retrieved Jan 28, 2006, http://www.mailfrontier.com/docs/field_guide.pdf.
• 26: S. P. Marsh. Formalising Trust as a Computational Concept. PhD thesis, 1994. citeseer.ist.psu.edu/marsh94formalising.html.
• 27: R. C. Mayer, J. H. Davis, and D. F. Schoorman. An integrative model of organizational trust. The Academy of Management Review., 1995(3):709--734, July, 1995.
• 28: D. Harrison McKnight , Vivek Choudhury , Charles Kacmar, Trust in e-commerce vendors: a two-stage model, Proceedings of the twenty first international conference on Information systems, p.532-536, December 2000, Brisbane, Queensland, Australia
• 29: R. C. Miller and M. Wu. Fighting Phishing at the User Interface. O'Reilly, Aug, 2005. In Lorrie Cranor and Simson Garfinkel (Eds.) Security and Usability: Designing Secure Systems that People Can Use.
• 30: L. Mui , M. Mohtashemi , A. Halberstadt, A Computational Model of Trust and Reputation for E-businesses, Proceedings of the 35th Annual Hawaii International Conference on System Sciences (HICSS'02)-Volume 7, p.188, January 07-10, 2002
• 31: D. C. Mutz. Social trust and e-commerce, experimental evidence for the effects of social trust on individuals' economic behavior. Public Opinion Quarterly, 69(3):393--416, 2005. Retrieved Feb 20, 2006, http://poq.oxfordjournals.org/cgi/reprint/69/3/393.
• 32: Andrew S. Patrick, Building Trustworthy Software Agents, IEEE Internet Computing, v.6 n.6, p.46-53, November 2002 [doi>10.1109/MIC.2002.1067736]
• 33: A. S. Patrick, P. Briggs, and S. Marsh. Designing Systems That People Will Trust. O'Reilly, Aug, 2005. In Lorrie Cranor and Simson Garfinkel (Eds.) Security and Usability: Designing Secure Systems that People Can Use.
• 34: M. G. Pollitt. The economics of trust, norms and networks. Business Ethics - A European Review, 11(2):119--128, 2002.
• 35: Alfarez Abdul-Rahman , Stephen Hailes, A distributed trust model, Proceedings of the 1997 workshop on New security paradigms, p.48-60, September 23-26, 1997, Langdale, Cumbria, United Kingdom [doi>10.1145/283699.283739]
• 36: P. Resnick and R. Zeckhauser. Trust among strangers in internet transactions: Empirical analysis of ebays reputation system. Draft Version for review by NBER workshop, 2001. Retrieved Feb 20, 2006, http://www.si.umich.edu/pres-nick/papers/ebayNBER/RZNBERBodegaBay.pdf.
• 37: Jens Riegelsberger , Martina Angela Sasse, Trustbuilders and Trustbusters, Proceedings of the IFIP Conference on Towards The E-Society: E-Commerce, E-Business, E-Government, p.17-30, October 03-05, 2001
• 38: Jens Riegelsberger , M. Angela Sasse , John D. McCarthy, Shiny happy people building trust?: photos on e-commerce websites and consumer trust, Proceedings of the SIGCHI conference on Human factors in computing systems, April 05-10, 2003, Ft. Lauderdale, Florida, USA [doi>10.1145/642611.642634]
• 39: Jens Riegelsberger , M. Angela Sasse , John D. McCarthy, The mechanics of trust: a framework for research and design, International Journal of Human-Computer Studies, v.62 n.3, p.381-422, March 2005 [doi>10.1016/j.ijhcs.2005.01.001]
• 40: P. Salovey and A. Rothman. Social Psychology of Health. 2003.
• 41: B. Schneier. Are you sophisticated enough to recognize an internet scam? Retrieved Feb 24, 2006, http://www.schneier.com/essay-035.html.
• 42: C. Scott. Interpersonal trust: A comparison of attitudinal and situational factors. Human Relations, 33(11):805--812, 1980.
• 43: A. M. Spence. Job market signaling. Quarterly Journal of Economics, 87(3):355--374, 1973.
• 44: J. Stanford, E. R. Tauber, B. Fogg, and L. Marable. Experts vs. Online Consumers: A Comparative Credibility Study of Health and Finance Web Sites. 2002. Retrieved Sept 13, 2005, http://www.consumerwebwatch.org/dynamic/web-credibility-reports-experts-vs-online.cfm.
• 45: Susannah Fox et al. Trust and privacy online: Why Americans want to rewrite the rules. The Pew Internet & American Life Project, August 20, 2000. Retrieved Sept 13, 2005, http://www.pewinternet.org/pdfs/PIP_Trust_Privacy_Report.pdf.
• 46: Y. H. Tan and W. Thoen. An Outline of a Trust Model for Electronic Commerce. Applied Artificial Intelligence, 14(8), 2000.
• 47: A. Westin and Harris Louis & Associates. Health Information Privacy Survey. Harris Louis & Associates, 1993. Conducted for Equifax Inc. 1,000 adults of the national public.
• 48: A. Westin and H. Interactive. IBM-Harris Multi- National Consumer Privacy Survey for IBM. Approximately 5,000 adults of the U.S Britain and Germany. Technical report, 1999.
• 49: Min Wu , Robert C. Miller, Fighting phishing at the user interface, Massachusetts Institute of Technology, Cambridge, MA, 2006
• 50: Min Wu , Robert C. Miller , Simson L. Garfinkel, Do security toolbars actually prevent phishing attacks?, Proceedings of the SIGCHI conference on Human Factors in computing systems, April 22-27, 2006, Montréal, Québec, Canada [doi>10.1145/1124772.1124863]