Publikations-Information

Download

Felix Dietz, Katharina Barlage, Florian Alt
Would You Share the Code? Behavior and Call-Aligned Cardiac Responses in an Unexpected Vishing Attack
In MUM '26: Proceedings of the 25th International Conference on Mobile and Ubiquitous Multimedia. November 8, 2026. Association for Computing Machinery, New York, NY, USA. DOI: https://doi.org/10.1145/3861188.3861228 (bib)

Voice phishing (vishing) unfolds across mobile interfaces, where a transaction notification, an incoming call, and the caller's explanation can make each other appear credible. We report a deceptive study of 17 adults examining responses to vishing. Participants received an unexpected transaction-code SMS allegedly from PayPal, followed one minute later by a confederate impersonating PayPal support. Seven were not reached, four ended the call before a code request, four refused, and two disclosed the full code. We collected post-debriefing questionnaires and Polar H10 RR intervals aligned to the call. Among the six participants who reached a disclose-or-refuse decision, median heart rate increased by 2.8\,bpm (IQR 1.4–5.0); five showed increases. Changes in ln(RMSSD) were mixed and sensitive to artifact thresholds. We contribute a stage-based account of vishing, clarify the limits of wearable sensing during live security interactions, and derive implications for trusted verification paths, transaction-bound confirmations, and physiology-aware study design.