Effectiveness of authority-based social engineering attacks in a cultural context: case of Turkey and Qatar

This study examines the effectiveness of authority figures in social engineering attacks in a cultural context. An experimental design was employed involving 900 participants working in electricity distribution companies in Turkey and Qatar. The analysis compared the success rates of generic phishing and spear phishing attacks, differentiated by individual and institutional authority figures. The results demonstrated that spear phishing attacks achieved significantly higher success rates compared to generic phishing attacks. The impact of authority type varied across cultural contexts. In Turkey, attacks based on individual authority figures were more successful, whereas in Qatar, attacks leveraging institutional authority figures proved more effective. Furthermore, a significant interaction effect between country and authority type was observed, indicating that the effectiveness of authority-based attacks is highly contextdependent. The study also revealed a strong sequential relationship between phishing link engagement and subsequent data submission, highlighting escalating behavioral vulnerability once initial compromise occurs. The findings suggest that cultural factors must be carefully considered when designing defense strategies against social engineering attacks. In particular, high power distance cultures may require enhanced training focused on questioning authority requests, whereas low power distance cultures may benefit from interventions aimed at strengthening autonomous decision-making. Organizations are advised to tailor their security awareness programs according to the authority dynamics and cultural characteristics of their target populations.