The Human Factor in Online Fraud

While most Internet security research addresses mathematical and algorithmic aspects, there is a recent trend towards attempting to understand the human factor of security. However, since most current efforts aimed at understanding social aspects of security take the approach of quantifying the efficacy of technical tools and user interfaces, they implicitly adopt a techno-centric view. We suggest that—at times—it may me more suitable to approach the issue from a human-centric view, and to consider how the human factor of security could guide the development of technical security measures to combat online fraud.

In this talk, we discuss what impact deceit and misuse has on online security, drawing on examples from phishing, click-fraud, and general privacy intrusions. We believe that a methodology founded on an improved understanding of human behavior—in particular, in the context of deceit—may help anticipate trends and steer the development of structures and heuristics to curb online fraud. Guided by behavioral aspects of security, we consider technical measures to preemptively counter some of the threats we describe. An extended abstract is available at www.human-factor.org.

Dr. Markus Jakobsson is an Associate Professor at Indiana University at Bloomington, Associate Director of the Center of Applied Cybersecurity Research, and a founder of RavenWhite Inc. He is the inventor or co-inventor of over fifty patents, has served as the vice president of the International Financial Cryptography Association, and is a research fellow of the Anti-Phishing Working Group. He is an editor of the International Journal of Applied Cryptography and a group editor of the ACM Mobile Computing and Communications Review. He is also an editor of Phishing and Countermeasures (Wiley, 2006), and editor/co-author of upcoming books on crimeware (Symantec Press, 2007), click-fraud (Morgan and Claypool, 2007), and cryptographic protocols (Addison-Wesley, 2007).