The Role of Extraversion in Phishing Victimisation: A Systematic Literature Review

Over the last decade, phishing attacks have become preeminent and increasingly successful. Anti-phishing strategies focus on raising awareness and training users to identify risks. However, those strategies do not fully consider the psychological profile of each individual. We sustain that maximising potential victims' resilience requires additional protection strategies to focus on individual personality traits. In this article, we concentrate on extraversion as a personality trait for which there is no consensus about its effect on susceptibility to phishing attacks. We implement a robust bibliographic analysis methodology and identify potentially relevant articles, which we screen and filter against inclusion and exclusion criteria. We report and analyse the findings of the 39 articles that fulfil all criteria and are deemed relevant to this research. Our analysis shows that, despite the positive correlation between extraversion and phishing susceptibility found in many studies, there is no consensus supported by a well-established psychological theory. Moreover, we identify a number of reasons justifying this lack of consensus, namely the use of non-representative samples, the non consideration of contextual factors, and the use of self-reported personality tests, which lead to limited reproducibility and data inconsistencies.

Automated summary

In recent years, phishing attacks have become prominent and increasingly successful. Existing anti-phishing strategies focus on raising awareness and training users to identify risks, but often overlook individual psychological traits. This article examines extraversion as a personality trait and finds that, despite many studies showing a positive correlation between extraversion and susceptibility to phishing attacks, there is no consensus supported by established psychological theories. The lack of consensus is attributed to the use of non-representative samples, non consideration of contextual factors, and reliance on self-reported personality tests, which result in limited reproducibility and data inconsistencies.