Smishing or SMS phishing is a recent update to email-based phishing. This modern scam hinges upon the trust that users have in their bank or online service to steal users' personal details. While recent work examines these texts and the URLs sent, no work has empirically determined what happens after scammers obtain this credit card information. Card-not-present (CNP) fraud-where stolen card details are used to make purchases online without physical access to the card-has become a growing concern. While some investigate this indirectly using forum posts, the unavailability of credit card transaction data makes it tricky to study empirically. As smishing continues to rise, so does CNP fraud, resulting in more losses borne by consumers. To this end, we perform a proof-of-concept experiment towards understanding how criminals abuse stolen credit card details brought in from smishing. We collaborate with a mobile network operator and a financial institution to access live smishing URLs and test credit cards. We provide test credit cards to twelve different smishing URLs and observe 36 authorization attempts across 17 different online merchants. We analyze the ISO transaction messages to uncover scammers' transaction patterns and their cash-out mechanisms. Our insights into scammer behavior could help stakeholders develop effective mitigations to tackle CNP fraud towards eliminating the profitability of smishing.
Cyber risk has emerged as one of the most pressing board-level challenges of the digital era, yet there is still no accepted method to evaluate how effectively boards govern this critical domain. While frameworks such as ISO 31000 and the NIST Cybersecurity framework provide high-level principles for risk oversight, they fall short of offering evaluative criteria or maturity models to assess board performance. The absence of structured measurement leaves organisations vulnerable to symbolic oversight and regulatory misalignment. This paper argues for the need for a new way to evaluate board cybersecurity governance and introduces Cyber Risk Integration for Boards (CRIB), an evaluation framework to assess and benchmark how effectively boards oversee, challenge, and lead on cyber risk governance. Developed through a study including interviews with board members, CEOs, CISOs, and cyber risk leaders across the financial sector, the CRIB framework proposes Key Performance Indicators (KPIs) for assessing maturity in cyber risk governance. These KPIs capture the maturity of the board's capability across 14 cyber governance dimensions, providing a structured basis for directors to assess and enhance the effectiveness of their governance decisions in managing cyber risk.
Telephone scams often attempt to defraud or steal the identity of individuals by eliciting a response to a pressing request for payments or submission of information such as social security numbers. These calls usually come from numbers that individuals have not encountered before, and the request is passed through as a pre-recorded message with a generic voice. But AI-enabled voice cloning and the ability to spoof Caller IDs have given scammers the opportunity to run schemes targeted individuals with a cloned familiar voice coming from trusted numbers. This paper reports the findings from an empirical study that replicates this scenario with 14 participants (7 pairs of family relatives of friends) to capture the experiences of receiving such a scam call and responses to it. The results of our thematic analysis show that the familiar voice, coming from a trusted number of a family relative or a friend, is highly persuasive towards deceiving the call receiver (i.e., callee) to indeed follow through with the scammer's request. The callee, together with the caller or the participants who volunteered their voices for cloning, saw this scam working particularly in the context of family emergencies, as real-world reports have surfaced about children held for ransom, grandchildren under arrest, or relatives in car accidents. The callers and callees saw no immediate way to fend off these "family emergency scams" than for families and friends to work on "family/friend codewords" that are hard to be inferred by the scammers (and thus cloned). We discuss our findings towards the development of user-centered interventions that would facilitate the detection of a wide range of AI-enabled voice cloning scams, in addition to the suggested personal ways of scam detection.
Human-centered security research traditionally leverages self-reports and high-level behavioral data. However, the increasing ubiquity of sensors integrated into personal, wearable devices (e.g., smartphones, smartwatches) and in users' environments (e.g., cameras) enables researchers to unobtrusively collect rich physiological and behavioral signals. These real-time data streams can reveal user states-such as attention or workload-that can be employed to design adaptive security mechanisms. In this paper, we present a platform that supports designing, building, and evaluating next-generation user interfaces that leverage physiological and behavioral data for enhanced security. First, we introduce the physio-behavioral security paradigm, highlighting how sensor-based insights into user states can inform individualized security interventions and accurately identify moments of vulnerability. We then outline the requirements, system architecture, and implementation details of the platform, illustrating how multiple data streams (e.g., gaze, heart rate, keystrokes, mouse movements) are integrated and securely processed. Finally, we report on an exploratory deployment in a mid-sized organization, showcasing how the tool captures real-time security behaviors and enables context-aware interventions. The deployment yields insights into factors influencing acceptance across different stakeholders (management, IT department, employees). Our results suggest that adaptive approaches, informed by physiological and behavioral signals, can improve security outcomes and user acceptance.
A long standing goal of usable privacy and security (UPS) research is to align end-user behaviors with expert suggestions, such as through developing tools to increase user control and awareness of security and privacy (S&P) threats. These approaches, while necessary, are not sufficient to combat the ubiquitous slow violence of S&P harms that impede on people's motivation to change and erode their trust in the institutions in which experts are often entrenched. We propose that we can only effect true change and rebuild trust with users if we first deconstruct our norms of telling users what's best and expecting them to comply. We draw from concepts in critical computing, design, and games research, to propose a research agenda-"Transformational Provocation"-that involves provoking transformation in not just users' S&P knowledge, skills, or behaviors, but also their senses of truth, self, relationships, and society. Moreover, we demonstrate the value and application of our frame-work through illustrative case studies. With this framework, we call upon the UPS community to pursue new design opportunities for engendering organic and enduring intrinsic motivation for people to act on their S&P, both on their own and together.
