Teaching Johnny not to fall for phish

By Ponnurangam Kumaraguru, Steve Sheng, Alessandro Acquisti, Lorrie Faith Cranor, Jason I. Hong. 2010

445 citations recorded by the source corpus.

Phishing attacks, in which criminals lure Internet users to Web sites that spoof legitimate Web sites, are occurring with increasing frequency and are causing considerable harm to victims. While a great deal of effort has been devoted to solving the phishing problem by prevention and detection of phishing emails and phishing Web sites, little research has been done in the area of training users to recognize those attacks. Our research focuses on educating users about phishing and helping them make better trust decisions. We identified a number of challenges for end-user security education in general and anti-phishing education in particular: users are not motivated to learn about security; for most users, security is a secondary task; it is difficult to teach people to identify security threats without also increasing their tendency to misjudge nonthreats as threats. Keeping these challenges in mind, we developed an email-based anti-phishing education system called “PhishGuru” and an online game called “Anti-Phishing Phil” that teaches users how to use cues in URLs to avoid falling for phishing attacks. We applied learning science instructional principles in the design of PhishGuru and Anti-Phishing Phil. In this article we present the results of PhishGuru and Anti-Phishing Phil user studies that demonstrate the effectiveness of these tools. Our results suggest that, while automated detection systems should be used as the first line of defense against phishing attacks, user education offers a complementary approach to help people better recognize fraudulent emails and websites.

Subfields: Information Systems, Sociology and Political Science, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Information Systems

In Sociology and Political Science

In Signal Processing

Citations in the corpus

PhishEye: Live Monitoring of Sandboxed Phishing Kits (2016, background): “Our study presents accurate measurements of the duration and effectiveness of this popular threat, and discusses many new and interesting aspects we observed by monitoring hundreds of phishing campaigns.”
Phishing Attacks: A Recent Comprehensive Study and a New Anatomy (2021, methodology): “However, only 38% of global organizations claim they are prepared to handle a sophisticated cyber-attack (Kumaraguru et al., 2010).”
User preference of cyber security awareness delivery methods (2014, background): “Although a great deal of eﬀort has been expanded on trying to solve the phishing problem through automated detection and prevention system, little research has been done in the area of training users to recognise and avoid phishing attacks (Kumaraguru et al. 2010).”
Who falls for phish?: a demographic analysis of phishing susceptibility and effectiveness of interventions (2010, background): “These results are similar to a previous real-world phishing study [16] in which 52.”
Insights into User Behavior in Dealing with Internet Attacks (2012, result): “, PhishGuru and Anti-Phishing Phil [41, 50]) could effectively be used to help achieve a similar effect to the one we observed in our tests.”