Susceptibility to URL-based Internet attacks: Facebook vs. email

The usage of social networking sites has been steadily increasing in the last decade. Communication via social networks has replaced email as the traditional means of electronic communication in many contexts. Accordingly, many types of Internet fraud also spread to social networks. In this work, we make the first to our knowledge direct comparison of users´ susceptibility to attacks that involve clicking on dangerous links in Facebook messages versus in emails. We conducted a between-subjects quasi-experiment with 398 users where the users received links from strangers in a Facebook message or via email. We observed the respective clicking behavior and investigated users´ attitudes to URL-based attacks by means of a post-experimental survey. Our results show that the communication medium (Facebook vs. email) leads to significant differences in attack susceptibility. Quite surprisingly, the success rate of email-based attacks is significantly higher.