In a small laboratory study, the combination of spear-phishing and greed recorded the highest reported yes-rate among 25 simulated social-engineering scenarios: 75%. The study compared five psychological factors with five attack types in a within-subject design, meaning the same 12 adults saw every combination. Here, a yes-rate means participants said they intended to respond to a stimulus; it does not mean they clicked, disclosed information or were compromised.
The leading combinations
Across the five attack types, spear-phishing had the highest reported overall rate, at 53.3%, followed by phishing at 48.3%. Across the psychological factors, greed ranked highest at 40%, followed by trust at 33.3%, while authority was 13.3%. These were reported rates based on participants' stated intention to respond.
Among the individual combinations, spear-phishing with greed had the highest reported rate at 75%. Phishing with greed and spear-phishing with trust each stood at 66.6%, while phishing with trust was 58.3%. Pop-ups with authority, smishing with authority and vishing with curiosity had no yes-answers.
The wider pattern
Within the greed scenarios, the reported rates were 75% for spear-phishing, 66.6% for phishing, 33.3% for pop-ups, 16.6% for smishing and 8.3% for vishing. Across the five formats, the greed yes-rate was 40%.
The reported trust rates were 66.6% with spear-phishing and 58.3% with phishing. Pop-ups and smishing each recorded 16.6%, vishing recorded 8.3%, and the overall trust rate was 33.3%.
For curiosity, spear-phishing and phishing each recorded 50%, while pop-ups, smishing and vishing were each below 10%. The overall curiosity yes-rate was 23.3%.
For fear, phishing and spear-phishing each recorded 41.6%, smishing recorded 25%, pop-ups 16.6% and vishing 8.3%. The overall fear rate was 26.6%, below the overall reported rates for greed and trust.
Vishing had a reported total success rate of 6.6%. At the factor level, authority, fear, greed and trust each had a reported rate of 8.3%, while curiosity had no success.
What participants saw
Researchers recruited 12 adults in Munich, Germany. Their ages ranged from 20 to 50, with a median of 22.5, and no compensation was given. The study crossed five psychological factors, curiosity, greed, trust, authority and fear, with five attack types, phishing, spear-phishing, vishing, smishing and pop-up attacks. This created 25 simulated stimuli presented in randomized order.
Each factor had its own scenario, and the content was held constant across the five attack formats. The stimuli were simulated, noninteractive screenshots or short audio recordings. After each stimulus, participants recorded whether they intended to respond, wrote an open-text reason and rated appeal and urgency on scales from 1 to 4. Think-aloud verbalizations were audio-recorded and transcribed for qualitative analysis.
What the result does not show
The authors say the small sample and laboratory setting limit generalizability. The simulated screenshots or audio had no real consequences, and one standardized scenario represented each psychological factor. The study also did not examine attacks that combined multiple psychological factors across different techniques.
The 75% figure should be read narrowly. The study measured whether participants said they intended to respond to each stimulus, not whether they clicked, disclosed information or suffered a compromise. It should not be treated as a population-wide risk score or a ranking of real-world attack effectiveness.
Publication record
The supplied record labels the item a preprint and identifies it as arXiv:2608.25670v1, dated 26 Aug 2026. Funding information is not reported in the supplied paper or metadata, and the authors declare no competing interests relevant to the article.
Paper data and sources
Original title: An Analysis of the Impact of Psychological Factors and Techniques Across Different Types of Social Engineering
Authors: Helin Omer, Daniela Pöhn
Journal/Repository: Availability, Reliability and Security. ARES 2026 International Workshops
Status: Preprint, not yet peer-reviewed
First online: 2026-08-26
DOI: 10.1007/978-3-032-35576-8_27
Original paper · Full text