Replication package: Measurement Choices Shape Phishing Cue Findings: An Operationalization Sensitivity Study

Replication package (version 1.3) for the article “Measurement Choices Shape Phishing Cue Findings: An Operationalization Sensitivity Study” by Geoffrey A. Vanderpal and Mhelvin Mercado, under review at Telematics and Informatics Reports. The study asks whether conclusions about persuasion cues in phishing email depend on how the cues are measured. On a single deduplicated corpus of 18,747 distinct public email messages (two widely used public sources overlap 84 to 92 percent by SHA-256 content hash), it compares three operationalizations of the same cue constructs (threat or urgency, authority, trust or familiarity) built from one released set of family definitions: an a priori keyword lexicon, sentence-embedding similarity to prototype descriptions (all-MiniLM-L6-v2), and Empath, a LIWC-style category dictionary. The NRC Valence, Arousal, and Dominance Lexicon is analyzed alongside as a related affective instrument. All instruments are applied to the same messages and the same text window, with supplementary spans, composition checks across source-exclusive subsets, and an exploratory zero-shot language-model annotation of 150 messages. Contents: analysis code (v1.2 pipeline and v1.3 matched-sample reanalysis), record-level filters that reconstruct each source from the public files, keyword lexicons, family definitions, embedding prototypes, Empath category groupings, per-message derived scores for every text window with a SHA-256 hash of each source message, the cross-corpus overlap analysis, all result tables of the article and its supplement, the figure source and figure files, and the exploratory annotation prompt with per-message model codes. No raw email text is redistributed; the third-party corpora and the NRC VAD lexicon are obtained from the sources cited in data/DATA_SOURCES.md. Version 1.3 corrects the provenance of the two public sources (Source A is the Kaggle dataset “Phishing Email Detection” accessed through its Hugging Face mirror; Source B is the email portion of cybersectony/PhishingEmailDetectionv2.0), verifies that every deposited hash matches the corrected sources, embeds every message under three text windows, and adds the matched-sample, harmonized-window reanalysis. See CHANGELOG.md.