arXiv subjects

Sarah Tabassum

Publications and source records attributed to Sarah Tabassum.

4 recordsLinked to original sources

arXiv2026

Who Falls for SMiSh? Learning Through Survey Data Where to Best Target Awareness Training for Mobile Messaging Attacks

As mobile phone adoption has surged, so have scams involving these devices. One such scam, known as SMiShing (or smishing) after Short Message Service (SMS), involves fraudsters sending phishing links via mobile texts. Despite the prevalence of SMiShing, there is a lack of data on who is most vulnerable to these attacks. Prior research on phishing (its email counterpart) suggests that susceptibility may vary by demographic and contextual factors. In two large-scale surveys, we use a previously published simulation method to collect data from representative samples of U.S. adult mobile phone users. Our findings indicate that younger individuals and college students are particularly vulnerable. Participants struggled to correctly identify legitimate messages, with the second study providing comparisons of financial message variants. Researchers, regulators, and telecoms can help users by creating mobile-specific interventions for under-24 and university customers and adding verifications and warnings.

cs.CR↗

arXiv2026

Are Security Cues Static? Rethinking Warning and Trust Indicators for Life Transitions

Security cues, such as warnings and trust signals, are designed as stable interface elements, even though people's lives, contexts, and vulnerabilities change over time. Life transitions including migration, aging, or shifts in institutional environments reshape how risk and trust are understood and acted upon. Yet current systems rarely adapt their security cues to these changing conditions, placing the burden of interpretation on users. In this Works-in-Progress paper, we argue that the static nature of security cues represents a design mismatch with transitional human lives. We draw on prior empirical insights from work on educational migration as a motivating case, and extend the discussion to other life transitions. Building on these insights, we introduce the Transition-Aware Security Cues (TASeC) framework and present speculative design concepts illustrating how security cues might evolve across transition stages. We invite HCI to rethink security cues as longitudinal, life-centered design elements collectively.

cs.CR↗

arXiv2024

Digital Privacy for Migrants: Exploring Current Research Trends and Future Prospects

This paper explores digital privacy challenges for migrants, analyzing trends from 2013 to 2023. Migrants face heightened risks such as government surveillance and identity theft. Understanding these threats is vital for raising awareness and guiding research towards effective solutions and policies to protect migrant digital privacy.

cs.HC↗

arXiv2023

Preliminary Results from a U.S. Demographic Analysis of SMiSh Susceptibility

As adoption of mobile phones has skyrocketed, so have scams involving them. The text method is called SMiShing, (aka SMShing, or smishing) in which a fraudster sends a phishing link via Short Message Service (SMS) text to a phone. However, no data exists on who is most vulnerable to SMiShing. Prior work in phishing (its e-mail cousin) indicates that this is likely to vary by demographic and contextual factors. In our study, we collect this data from N=1007 U.S. adult mobile phone users. Younger people and college students emerge in this sample as the most vulnerable. Participants struggled to correctly identify legitimate messages and were easily misled when they knew they had an account with the faked message entity. Counterintuitively, participants with higher levels of security training and awareness were less correct in rating possible SMiSH. We recommend next steps for researchers, regulators and telecom providers.

cs.HC↗