This article presents an ethical simulation of a phishing attack as a research method for analysing users' susceptibility to such threats. The study involved conducting an experiment in which emails mimicking authentic messages from popular services such as Google, Spotify, and InPost were sent. A total of 50 participants were involved in the experiment, divided into five age groups, allowing for an assessment of the impact of age on phishing attack susceptibility. The aim of the study was to determine the effectiveness of various social engineering techniques and to analyse users' reactions to the fraudulent messages. The experiment utilized dedicated, proprietary software that enabled monitoring of recipient activity, including reading messages, opening URLs, and filling out forms. The results showed that most users opened the phishing emails; however, only a small percentage took further actions that could potentially lead to data disclosure. The analysis of the results confirmed the crucial role of educational factors and user awareness in mitigating the effectiveness of phishing attacks. A particularly significant aspect was users’ prior experience with similar attacks and their active participation in informational campaigns, which significantly reduced their susceptibility to manipulation. In conclusion, recommendations were formulated emphasizing the need for systematic training campaigns and the implementation of advanced email filtering systems, which are crucial in counteracting the threats discussed in this study.
Kęczkowska et al. (2025) studied this question.