  Despite technical and non-technical countermeasures, humans continue to be
tricked by phishing emails. How users make email response decisions is a
missing piece in the puzzle to identifying why people still fall for phishing
emails. We conducted an empirical study using a think-aloud method to
investigate how people make 'response decisions' while reading emails. The
grounded theory analysis of the in-depth qualitative data has enabled us to
identify different elements of email users' decision-making that influence
their email response decisions. Furthermore, we developed a theoretical model
that explains how people could be driven to respond to emails based on the
identified elements of users' email decision-making processes and the
relationships uncovered from the data. The findings provide deeper insights
into phishing email susceptibility due to people's email response
decision-making behavior. We also discuss the implications of our findings for
designers and researchers working in anti-phishing training, education, and
awareness interventions
