Assessing AI-Generated vs. Human-Authored Spear Phishing SMS Attacks: An Empirical Study

Title:Assessing AI-Generated vs. Human-Authored Spear Phishing SMS Attacks: An Empirical Study

Abstract:Personalized phishing is difficult to defend against because messages can be tailored to a target's work, interests, and social context. Large language models may make such tailoring faster and easier, but it remains unclear whether messages produced from simple prompts are more convincing than those written by people. This 25-target pilot study compared personalized smishing messages generated by GPT-4 with messages written by novice student authors working under time constraints. Using the proposed Threshold Ranking Approach for Personalized Deception (TRAPD), participants ranked 12 messages written for them, indicated the point at which they would intend to click, explained their reasoning, and judged whether each message was authored by GPT-4 or a human. GPT-4-generated messages elicited an intention to click more often than student-authored messages (28% versus 21%), although the difference was uncertain. More broadly, our findings suggest that a simple prompt can produce personalized messages that participants found comparably convincing within the uncertainty of this pilot study. Job-related messages were significantly more likely to elicit an intention to click than hobby- or social-media-related messages. When asked whether a message was written by a human or generated by AI, participants identified the source no more accurately than chance, although the two study-specific message sets remained computationally distinguishable based on their text. Together, these findings suggest that accessible AI-assisted personalization may increase the practical scale of social-engineering threats, while also demonstrating both the value and current limitations of TRAPD for controlled and ethical comparison.

33 pages, 8 figures, and 5 tables. Revised to match the peer-reviewed version published in the Journal of Cybersecurity and Privacy

Computers and Society (cs.CY); Artificial Intelligence (cs.AI)

arXiv:2406.13049 [cs.CY]

(or arXiv:2406.13049v3 [cs.CY] for this version)

https://doi.org/10.48550/arXiv.2406.13049 Focus to learn more arXiv-issued DOI via DataCite

J. Cybersecur. Priv. 2026, 6(4), 129

https://doi.org/10.3390/jcp6040129 Focus to learn more DOI(s) linking to related resources

arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.