  Cyber attacks such as phishing, IRS scams, etc., still are successful in
fooling Internet users. Users are the last line of defense against these
attacks since attackers seem to always find a way to bypass security systems.
Understanding users' reason about the scams and frauds can help security
providers to improve users security hygiene practices. In this work, we study
the users' reasoning and the effectiveness of several variables within the
context of the company representative fraud. Some of the variables that we
study are: 1) the effect of using LinkedIn as a medium for delivering the
phishing message instead of using email, 2) the effectiveness of natural
language generation techniques in generating phishing emails, and 3) how some
simple customizations, e.g., adding sender's contact info to the email, affect
participants perception. The results obtained from the within-subject study
show that participants are not prepared even for a well-known attack - company
representative fraud. Findings include: approximately 65% mean detection rate
and insights into how the success rate changes with the facade and
correspondent (sender/receiver) information. A significant finding is that a
smaller set of well-chosen strategies is better than a large `mess' of
strategies. We also find significant differences in how males and females
approach the same company representative fraud. Insights from our work could
help defenders in developing better strategies to evaluate their defenses and
in devising better training strategies.
