InstaTrust or InstaTrap: How relationships and developmental tasks affect young adults’ phishing susceptibility on Instagram

• Exploring young adults aged 16 to 29 and their susceptibility to social media phishing. • Exploring messages from (non-)followers with a social, job and partner opportunity. • Followers and social opportunities led to highest susceptibility. • Non-followers and partner opportunities led to lowest susceptibility. • Practical implications include tailored anti-phishing awareness trainings. Social media phishing attacks are on the rise, with phishers exploiting the social nature of social media and often targeting young adults, the primary user group of most social media platforms. This study examines young adults’ susceptibility to social media phishing by integrating a novel developmental perspective. In doing so, it explores the unexamined user-specific susceptibility to phishers who offer developmental opportunities to fulfill age-related developmental tasks. In our experimental online vignette study, 500 young adults between the ages of 16 and 29 years were presented with Instagram chat messages sent by non-followers or followers offering a social, job or partner opportunity to fulfill three selected developmental tasks: (1) belonging to a peer group, (2) entering professional life and (3) being in a committed relationship. For instance, participants received phishing scenarios from supposed followers that introduced them to an upcoming event, an ideal job or partner. Our results indicate that both the relationship with the phisher and, in particular, a social opportunity are predictors of susceptibility. Messages from followers (compared to non-followers) inviting them to an upcoming event and thus offering a social opportunity to fulfill the developmental task of belonging to a peer group (compared to other developmental opportunities) led to the highest susceptibility. Based on our findings, we derive implications for future research and for phishing awareness campaigns for young adults.