How many 15-year-olds would get scammed by a spam email?

This piece was initially published on FFT Education Datalab's blog for April Fool's Day here by Dr John Jerrim. Datalab are a team of education data analysts, using statistics to inform policymaking and school practices.

Online fraud is very serious business. We are faced with it every day. Indeed, as I am writing this blog, I’ve just received an email from a prince from a far-off-land who has an “exciting” business opportunity he wishes to discuss with me…

I’m sure you have all received such emails as well: it is estimated that around 3.4 billion spam emails are sent every day. But how many young people are actually at risk of being duped by such a primitive digital scam?

Given that in many countries today is April Fools’ Day, essentially a day where we celebrate gullibility, let’s take a look. (With further details available within my new academic working paper, available here.)

Measurement

As part of the PISA 2018 study, 15-year-olds across the world were given the following scenario to consider:

“You have received a message in your inbox from a well-known mobile phone operator telling you that you are one of the winners of a smartphone. The sender asks you to click on the link to fill out a form with your data so they can send you the smartphone.”

They were then asked how appropriate a set of possible responses to this email would be, including: “Clicking on the link to fill out the form as soon as possible.”

If you get such an email, PLEASE DON’T DO THIS! It is clearly a scam!

But, unfortunately, some young people believe this to be an appropriate response.

How many, exactly?

The chart below illustrates how many 15-year-olds in each country indicated that they believe clicking the link to be an appropriate response. The question asked respondents to use a six-point scale, ranging from 1 (not appropriate at all) to 6 (very appropriate); here I investigate the percent of teenagers who selected a value of 4, 5 or 6 along this six-point scale. To ensure that the results are not being driven by carelessness or attempts by young people to be “funny”, I have removed from the data those providing very quick responses, odd response patterns and such like.

On average across countries, one-in-seven young people (14%) are at risk of being duped by such a primitive phishing email. The UK fares slightly better than the average OECD country (9%). Teenagers from Japan and Scandinavia are at least risk, with 7% or fewer report clicking the link to be an appropriate response. This compares to 25% or more in Hungary, Chile and Mexico.

Table 1 illustrates how the risk differs between demographic groups. Some groups are quite clearly more likely to be fooled than others. In particular, 17% of those from disadvantaged socio-economic backgrounds are at danger of clicking on the link in a phishing email, compared to just 11% of those from the most advantaged backgrounds. The differences by academic achievement are bigger still: just 5% of those with very strong reading skills report they would “click the link”, compared to 24% of those with the weakest reading skills.

Does instruction provided by schools into online dangers help?

In short, it does not seem to.

As part of the questionnaire, teenagers were also asked whether they had ever received at school any lessons teaching them about online dangers, including a specific question about phishing emails. Unfortunately, those who said they had received such lessons were no less likely to believe clicking the link within the phishing email and providing their personal data to be an appropriate response.

Conclusions

April Fools’ Day is a light-hearted moment where we try to trick the more gullible of our friends. But deception and taking advantage of the naivety of others obviously has a darker side as well. Online dangers seem to be ever increasing, and becoming more sophisticated. Falling prey to such scams can obviously have some pretty serious consequences as well. So, while we perhaps enjoy the rest of this morning trying to take the mickey out of someone we love, we might also take a moment to think a bit more about what should be done to help young people navigate the online risks that they face.

Dr John Jerrim is a professor at the IoE and a research associate at the Datalab.