Anti-Phishing Phil: the design and evaluation of a game that teaches people not to fall for phish

By Steve Sheng, Bryant Magnien, Ponnurangam Kumaraguru, Alessandro Acquisti, Lorrie Faith Cranor, Jason I. Hong, Elizabeth Ferrall-Nunge. Symposium On Usable Privacy and Security, 2007

635 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/e78341e9fa4d67a797bac81d7c61ea979e626e2f

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Information Systems

In Signal Processing

Citations in the corpus

School of phish: a real-world evaluation of anti-phishing training (2009, background): “None of this previous research considers the question of how a user’s behavior changes over time as a result of training.”
A Framework for Reasoning About the Human in the Loop (2008, background): “In the failure mitigation step, the designer tries to find ways to prevent failures by determining how humans might be better supported in performing these tasks [17].”
Who falls for phish?: a demographic analysis of phishing susceptibility and effectiveness of interventions (2010, background): “Their evaluation showed that participants who played the game were better able to identify fraudulent websites compared to participants in other conditions [29].”
Measuring user confidence in smartphone security and privacy (2012, neutral): “, [34]).”
Phishing Detection: A Literature Survey (2013, background): “• Anti-Phishing Phil — an educational interactive game created by Carnegie Mellon University (CMU) and commercialized by Wombat25 that is playable via web browsers [51].”
You've been warned: an empirical study of the effectiveness of web browser phishing warnings (2008, result): “We believe that the coincidental nature of this attack was the reason why many more participants fell for our attacks than what has been found in similar studies [8, 7, 19, 14, 20].”
Getting users to pay attention to anti-phishing education: evaluation of retention and transfer (2007, methodology): “User studies examining phishing or phishing-related interventions are often agnostic to individual user characteristics (sex, age, education level and hours using computer) or have not found significant relationships between features such as age or gender and phishing-related behavior [6, 7, 15, 23]”
Teaching Johnny not to fall for phish (2010, methodology): “We found that participants who played the game were better at identifying fraudulent Web sites compared to participants who did not play the game [Sheng et al. 2007].”
Security awareness of computer users: A phishing threat avoidance perspective (2014, methodology): “Therefore, to thwart this, anti-phishing education needs to be considered (Downs et al., 2007; Kumaraguru et al., 2007a; Richmond, 2006; Robila & Ragucci, 2006,b; Arachchilage & Love, 2013; Iacovos & Sasse, 2012; Long, 2013; Purkait, 2012; Sanchez & Duan, 2012; Sheng et al., 2007).”
An Empirical Analysis of Phishing Blacklists (2009, background): “[20, 34]) and to design trusted user interfaces (eg.”
The state of phishing attacks (2012, background): “Sheng et al.’s research identified a gap between research and industry in terms of true positives.”
User preference of cyber security awareness delivery methods (2014, methodology): “Similar approach was used in (Sheng et al. 2007).”