Where Do Users Look When Deciding If a Text Message is Safe or Malicious?

Abstract

Phishing via SMS, or SMiShing, is a rapidly growing cyber threat that causes significant financial losses. While research on email phishing has explored user behavior, the understanding of human factors in SMiShing detection remains limited. This study bridges the gap by investigating how users visually evaluate real-world SMS message legitimacy using eye-tracking technology. We aim to identify which message components capture user attention (e.g., sender information, typos/grammatical errors, links) and assess if users focus sufficiently on established red flags associated with phishing attempts. This research contributes to more effective user-centric countermeasures against SMiShing attacks by informing the design of security interventions that consider user behavior and mobile device information limitations.