Teaching Johnny not to fall for phish

TLDR

Phishing attacks are increasingly frequent and harmful, yet research on training users to recognize them is limited, with challenges including low motivation, the secondary status of security, and difficulty distinguishing threats from non‑threats. The study aims to educate users about phishing and evaluate the effectiveness of the PhishGuru email system and Anti‑Phishing Phil game in improving trust decisions. The authors developed the email‑based PhishGuru system and the online game Anti‑Phishing Phil, applying learning‑science instructional principles to teach users how to use URL cues to avoid phishing. User studies show that while automated detection should be the first line of defense, user education via PhishGuru and Anti‑Phishing Phil effectively improves recognition of fraudulent emails and websites.

Abstract

Phishing attacks, in which criminals lure Internet users to Web sites that spoof legitimate Web sites, are occurring with increasing frequency and are causing considerable harm to victims. While a great deal of effort has been devoted to solving the phishing problem by prevention and detection of phishing emails and phishing Web sites, little research has been done in the area of training users to recognize those attacks. Our research focuses on educating users about phishing and helping them make better trust decisions. We identified a number of challenges for end-user security education in general and anti-phishing education in particular: users are not motivated to learn about security; for most users, security is a secondary task; it is difficult to teach people to identify security threats without also increasing their tendency to misjudge nonthreats as threats. Keeping these challenges in mind, we developed an email-based anti-phishing education system called “PhishGuru” and an online game called “Anti-Phishing Phil” that teaches users how to use cues in URLs to avoid falling for phishing attacks. We applied learning science instructional principles in the design of PhishGuru and Anti-Phishing Phil. In this article we present the results of PhishGuru and Anti-Phishing Phil user studies that demonstrate the effectiveness of these tools. Our results suggest that, while automated detection systems should be used as the first line of defense against phishing attacks, user education offers a complementary approach to help people better recognize fraudulent emails and websites.