1. Time to Open our Eyes! Markus Jakobsson markus.jakobsson@parc.com

2. We measure so we can react! 1.Measure need for education (and normalize based on your losses) 2.Measure perceived need for education (hard educate when no perceived need) 3.Measure awareness of problems (awareness campaigns cheaper than education) 4.Consider cost/benefit of campaigns (this maximizes impact - but requires insight!)

3. Know whom to ask! Are you concerned about lottery fraud? –Typical victim: “little-old-lady” Are you concerned about a criminal getting access to your friend’s myspace account and then sending you a message “I am in London, and got robbed. Can you wire me $100 today?” –Typical victim: 20-something

4. Know how to ask! Online crime is rampant. Based on your own experience with online fraud, do you think that users like you might lose money to online criminals? –9.2% say “Yes, as recent as in the past year” Have you been a victim of online fraud? –2.1% say “Yes, I was tricked last year.”

5. Know whether to ask! “Would you have fallen for this?” … does not work! Sting experiment (example: “Social Phishing” by Jakobsson and others) will tell the truth!

6. Educational strategies Old-school: Observe incidents. Show users screen shots of attacks. Needed approach: 1.Develop hypotheses. 2.Measure problem (the right way) 3.Select messaging approach wisely. Questions? markus.jakobsson@parc.com