Corey Bohil¹; ¹Lawrence Technological University

A debate in phishing detection research is whether e-mail observers allocate attention primarily to semantic or surface-level features. This study examined the relative salience of visible surface cues (abnormal e-mail structure, urgent-action hyperlinks) versus abstract semantic cues (premise plausibility, personalization, disproportionate benefit) and their relation to judgments of message authenticity and danger. Fifty-eight participants (model training n = 46, test = 12) evaluated 50 emails (2,900 observations), rating the salience of the five features and perceived levels of authenticity and danger. To understand causal influences on these judgments, a set of Bayesian network models were fit to the discretized (low, medium, high) rating data, separately for authenticity and danger judgments. Three theoretically-motivated models were compared: a Surface Features model (with nodes for actionable links and abnormal structure), a Semantic Features model (with nodes for benefit, personalization, & plausibility), and an Interaction model, with one surface-feature node (links) and one semantic-feature node (benefit). For both authenticity and danger judgments, the Surface Features model provided the most parsimonious account. Despite its simplicity, this two-feature-node model achieved moderate predictive power (for authenticity and danger judgments respectively: F1=.65, .60; average AUC=.79, .76; Accuracy= .65, .60). The Surface Feature model also demonstrated superior generalization compared to a more complex data-driven model that included nodes for all 5 predictive features. These results suggest the primacy of visible, concrete email features in observer judgments, supporting a "heuristic" account of risk assessment (i.e., judgments based on the presence of superficial cues). The model-based approach used here offers a rigorous basis for future research examining how cognitive states (e.g., fatigue, high workload) modulate feature salience.