@InProceedings{dietz2026mum,
  author    = {Dietz, Felix and Barlage, Katharina and Alt, Florian},
  booktitle = {Proceedings of the 25th International Conference on Mobile and Ubiquitous Multimedia},
  title     = {Would You Share the Code? Behavior and Call-Aligned Cardiac Responses in an Unexpected Vishing Attack},
  year      = {2026},
  address   = {New York, NY, USA},
  note      = {dietz2026mum},
  publisher = {Association for Computing Machinery},
  series    = {MUM '26},
  abstract  = {Voice phishing (vishing) unfolds across mobile interfaces, where a transaction notification, an incoming call, and the caller's explanation can make each other appear credible. We report a deceptive study of 17 adults examining responses to vishing. Participants received an unexpected transaction-code SMS allegedly from PayPal, followed one minute later by a confederate impersonating PayPal support. Seven were not reached, four ended the call before a code request, four refused, and two disclosed the full code. We collected post-debriefing questionnaires and Polar H10 RR intervals aligned to the call. Among the six participants who reached a disclose-or-refuse decision, median heart rate increased by 2.8\,bpm (IQR 1.4--5.0); five showed increases. Changes in ln(RMSSD) were mixed and sensitive to artifact thresholds. We contribute a stage-based account of vishing, clarify the limits of wearable sensing during live security interactions, and derive implications for trusted verification paths, transaction-bound confirmations, and physiology-aware study design.},
  doi       = {10.1145/3861188.3861228},
  isbn      = {9798400727917},
  keywords  = {vishing, voice phishing, social engineering, mobile security, usable security, deception study, heart rate variability, wearable sensing, one-time codes},
  location  = {Glasgow, United Kingdom},
  numpages  = {13},
  timestamp = {2026.11.08},
  url       = {http://www.florian-alt.org/unibw/wp-content/publications/dietz2026mum.pdf},
}