Psychological and Demographic Predictors of Phishing Susceptibility:  A Survey-Based Study of University Users

Aminu Muhammad Auwal; Sulaiman Shehu

doi:10.70112/ajist-2026.16.2.4448

Authors

Aminu Muhammad Auwal Department of Natural Sciences, University of Jos, Plateau State, Nigeria
Sulaiman Shehu Department of Software Engineering, Bayero University, Kano State, Nigeria

DOI:

https://doi.org/10.70112/ajist-2026.16.2.4448

Keywords:

Phishing Susceptibility, Social Engineering, Human Factors, Cyber Security Awareness, Personality Traits, Impulsivity, Demographic Analysis, Cybercrime Victimization, Online Behavior, Higher Education Security

Abstract

Phishing remains one of the most effective forms of cybercrime because it exploits human decision-making rather than technical vulnerabilities. Although organizations invest heavily in technical defenses, phishing attacks continue to succeed due to differences in user behavior, psychological traits, and cybersecurity awareness. However, the combined influence of these factors on phishing susceptibility remains insufficiently understood. This paper investigates the joint contribution of impulsivity, self-reported cyber security knowledge, daily social media use, age group, and gender to phishing click rates among university students and staff, using a purpose-built 30-item phishing identification task administered alongside validated psychological and behavioral measures. A cross-sectional, survey-based empirical study was conducted with 412 volunteer participants recruited from a single university. Participants completed a 30-item phishing email identification instrument comprising 16 phishing and 14 legitimate stimuli drawn from documented campaigns, paired with an 8-item impulsivity scale, a 6-item security knowledge scale, and self-report measures of daily social media use, age, and gender. Multiple linear regression and one-way analysis of variance were used as primary analytical methods. Overall detection accuracy averaged 71.4 percent. Impulsivity (standardized beta = 0.29) and security knowledge (standardized beta = 0.21, negative) were the strongest predictors of phishing click rate, jointly accounting for approximately 24 percent of the observed variance. Participants aged 18 to 24 and those reporting over four hours of daily social media use showed the highest click rates. The full regression model explained 31 percent of total variance (R² = 0.31, p < 0.001). Gender was not a significant predictor once the other variables were controlled. Effective phishing awareness programs should be prioritized toward interventions that interrupt impulsive decision-making and address behavioral patterns associated with heavy social media use, rather than relying on broad demographic targeting by age or gender. Technical controls such as DNS and IP-based phishing detection systems (Islam et al., 2023) complement but cannot replace human-centered training. Ethical governance frameworks for information security practice (Blaise et al., 2024) and sustained cybersecurity education in higher education settings (Ravichandran & Rao, 2022; Yaseen, 2022) are jointly necessary to reduce susceptibility at an institutional level.

References

Auwal, A. M. (2025a). Autonomy versus algorithm: A replication study of student perspectives on AI ethical boundaries. International Journal of Educational Technology in Higher Education, 22, Article 72. https://doi.org/10.1186/s41239-025-00570-w.

Auwal, A. M. (2025b). Directory brute-forcing and artifact exposure: Qualitative insight into underestimated threats to web application security. Asian Journal of Engineering and Applied Technology, 14(1), 24–32. https://doi.org/10.70112/ajeat-2025.14.1.4296.

Auwal, A. M. (2025c). Invisible intrusions, internal threats and ethical vulnerabilities in Nigeria's Internet of Things. Discover Internet of Things, 5, Article 128. https://doi.org/10.1007/s43926-025-00251-0.

Auwal, A. M. (2025d). IoT integration in telemedicine: Investigating remote patient monitoring and data transmission reliability [Preprint]. Research Square. https://doi.org/10.21203/rs.3.rs-3419693/v1.

Auwal, A. M. (2025e). Smart medical IoT security vulnerabilities: Real-time MITM attack analysis and lightweight encryption deployment [Preprint]. arXiv. https://doi.org/10.48550/arXiv.2510.09629.

Auwal, A. M. (2026a). Adversarial AI vulnerability in secondary education: Threats and cybersecurity competencies. In Secondary education: Contemporary issues, practices, and future directions. IntechOpen. https://doi.org/10.5772/intechopen.1016684.

Auwal, A. M. (2026b). Adversarial threat modeling in generative AI: A systematic mapping of attack vectors to defense mechanisms. AI Ethics, 6, Article 284. https://doi.org/10.1007/s43681-026-01154-8.

Auwal, A. M. (2026c). A cross cultural extension study on privacy fatigue and AI adoption behavioral model. Discover Education. https://doi.org/10.1007/s44217-026-01903-1.

Auwal, A. M. (2026d). Institutional typology of cybercrime enforcement in Nigeria using EFCC conviction records. Discover Data, 4, Article 19. https://doi.org/10.1007/s44248-026-00115-0.

Auwal, A. M. (2026e). Operationalizing cyber attack prediction: A gap-prioritized framework with dataset and model selection guidelines [Preprint]. arXiv. https://doi.org/10.48550/arXiv.2606.03386.

Auwal, A. M., & Abiodun, J. O. (2025). A sectoral study of cyber threats and vulnerability management in resource-constrained Nigerian SMEs. Asian Journal of Engineering and Applied Technology, 14(1), 33–38. https://doi.org/10.70112/ajeat-2025.14.1.4297.

Auwal, A. M., & Lazarus, S. (2024). Sociological and criminological research of victimization issues: Preliminary stage and new sphere of cybercrime categorization. Journal of Digital Technologies and Law, 2(4), 915–942. https://doi.org/10.21202/jdtl.2024.44.

Auwal, A. M., & Lazarus, S. (2025). Experiences of local victims of Yahoo Boys' socio-economic cybercrimes in Nigeria. Discover Psychology, 5, Article 161. https://doi.org/10.1007/s44202-025-00479-5.

Auwal, A. M., & Shehu, S. (2026a). Measuring the impact of embedded phishing training on ransomware-lure click behavior: A field study across three organizations. Asian Journal of Science and Applied Technology, 15(1), 47–54. https://doi.org/10.70112/ajsat-2026.15.1.4350.

Auwal, A. M., & Shehu, S. (2026b). Psychological, situational, and demographic predictors of susceptibility to ransomware social-engineering lures: A survey study. NeuroData, 3. https://doi.org/10.63688/neurodata2026305.

Auwal, A. M., & Shehu, S. (2026c). To pay or not to pay: An organizational survey of ransom payment decision drivers, data exfiltration, and the role of cyber insurance among mid sized organizations. NeuroData, 3. https://doi.org/10.63688/neurodata2026306.

Blaise, O. O., Aaron, I., Alfred, U., & Amusa, A. (2024). Evaluating the ethical frameworks of information security professionals: A comparative analysis. Asian Journal of Computer Science and Technology, 13(2), 61–66. https://doi.org/10.70112/ajcst-2024.13.2.4289.

Chen, R., Gaia, J., & Rao, H. R. (2020). An examination of the effect of recent phishing encounters on phishing susceptibility. Decision Support Systems, 133, Article 113287. https://doi.org/10.1016/j.dss.2020.113287.

Christie, N. (1986). The ideal victim. In E. A. Fattah (Ed.), From crime policy to victim policy (pp. 17–30). Palgrave Macmillan.

Cohen, L. E., & Felson, M. (1979). Social change and crime rate trends: A routine activity approach. American Sociological Review, 44(4), 588–608.

Gavett, B. E., Zhao, R., John, S. E., Bussell, C. A., Roberts, J. R., & Yue, C. (2017). Phishing suspiciousness in older and younger adults: The role of executive functioning. PLOS ONE, 12(2), Article e0171620. https://doi.org/10.1371/journal.pone.0171620.

Islam, A., Rashid, M. M., & Othman, F. (2025). Identifying personality traits associated with phishing susceptibility. Security Journal, 38, Article 18. https://doi.org/10.1057/s41284-025-00466-4.

Islam, M. S., Sajjad, M., Hasan, M. M., & Mazumder, M. S. I. (2023). Phishing attack detecting system using DNS and IP filtering. Asian Journal of Computer Science and Technology, 12(1), 16–20. https://doi.org/10.51983/ajcst-2023.12.1.3552.

Jones, H. S., Towse, J. N., Race, N., & Harrison, T. (2019). Email fraud: The search for psychological predictors of susceptibility. PLOS ONE 14(1), Article e0209684. https://doi.org/10.1371/journal.pone. 0209684.

Kleitman, S., Law, M. K. H., & Kay, J. (2018). It’s the deceiver and the receiver: Individual differences in phishing susceptibility and false positives with item profiling. PLOS ONE, 13(10), Article e0205089. https://doi.org/10.1371/journal.pone.0205089.

Marttila, E., Koivula, A., & Räsänen, P. (2022). Cybercrime victimization and problematic social media use: Findings from a nationally representative panel study. American Journal of Criminal Justice, 47(1), 108–128. https://doi.org/10.1007/s12103-021-09665-2.

Ravichandran, S., & Rao, K. L. N. (2022). Design and development of an advancing web information stockpiling for engraved ontology in user contours. Asian Journal of Computer Science and Technology, 11(2), 11–15. https://doi.org/10.51983/ajcst-2022.11.2.3379.

Wang, J., Li, Y., & Rao, H. R. (2011). Testing individual differences in phishing vulnerability within an integrated information processing model. Decision Support Systems, 51(3), 576–586. https://doi.org/10.1016/j.dss.2011.03.002.

Williams, E. J., Hinds, J., & Joinson, A. N. (2018). Exploring susceptibility to phishing in the workplace. International Journal of Human-Computer Studies, 120, 1–13. https://doi.org/10.1016/j.ijhcs.2018.06. 004.

Yaseen, K. A. Y. (2022). Importance of cybersecurity in the higher education sector. Asian Journal of Computer Science and Technology, 11(2), 20–24. https://doi.org/10.51983/ajcst-2022.11.2.3448.