Researchers: Current education inadequate to fight phishing

Researchers said that current methods of educating users about phishing are inadequate, but some things do work.

Security researchers in the US last week disagreed over how to educate Web users to prevent phishing attacks, but agreed on one thing: most current methods of user education are inadequate.

Moreover, it's also difficult to find a method that works because of the diversity of people who use the Web, said Lorrie Faith Cranor, associate research professor at Carnegie Mellon University.

"We've taken user education and found that some things work [with some users], but if we e-mail them out to others they don't work," she said at the Anti-Phishing Work Group (APWG) eCrime Researchers Summit

Markus Jakobsson, an associate professor of informatics at Indiana University, said that some of the mainstream advice for Web users about phishing can be misleading, and phishers are changing tactics, making that advice obsolete.

For instance, he cited a recent article in a widely read consumer magazine that provided tips for surfing the Web safely, including to "Install security software and stay current with the latest patches." While well-meaning, he said, this tip make users vulnerable.

"If we tell users that, then phishers may send out an e-mail saying, 'Here is the latest patch," Jakobsson said. A nervous user might follow the phisher's advice and unwittingly become prey, he said.

The situation isn't totally dire, however, and researchers are finding that some things do work. Usually education that appeals to human nature and people's general intuitiveness is more successful at making them less vulnerable to phishing, researchers said.

Aaron Emigh, executive vice president of technology at blog software and services provider Six Apart, said that people have been duped by miscreants for thousands of years, and that technology has made it easier for people to fall for scams in an infinitely scalable way. He said that security researchers should focus more on creating user interfaces that can't be compromised rather than trying to train users to identify scam sites.

"People learn a lot more from the experiences they have interacting with things than from declarative lessons," he said. "Right now a user can't tell the difference [between a good or bad URL] without a lot of passive indicators. The point is, people shouldn't even have to know what a URL is."

While that may be true, researchers said it doesn't solve the current problem at hand. But Cranor and researchers at Carnegie Mellon have had some success improving users' ability to identify phishing sites with two recent studies they've conducted.

In one, users were paid to read materials about phishing for 10 minutes. However, this method is not something that could work on a broader scale, she said. "We found that if you forced people to read the materials they do work, but you don't always have the [opportunity] to do that," she said.

Another, more viable method to reach users is a game Carnegie Mellon researchers invented called "Anti-Phishing Phil." The animated online game has Web users control a fish swimming around in an ocean filled with other creatures. When he gets close to another sea creature, a URL will appear and users must decide if the URL is legitimate or a phishing URL.

If the users get an answer right, they -- as Phil -- will get praise from Phil's father, another fish sitting at the bottom of the ocean scene. If the answer is wrong, a message will come up with information about what was wrong with the URL -- for example, the URL contains a series of numbers before the actual bank domain name, or the ".com" is broken up as ""

Researchers tested users before and after they played the game, and found that their ability to spot phishing sites "improved significantly" after playing, Cranor said.

Why has a child's game been more effective than other methods to help educate Web users about phishing? According to Cranor, Anti-Phishing Phil, unlike other more banal educational materials, appeals to human nature. "It's fun and people like to win things," she said. "The training is fast and we focus on teaching actionable steps people can take to prevent phishing."

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Elizabeth Montalbano

IDG News Service
Show Comments


Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >


Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >


Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >


Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles


GGG Evaluation Team

Michael Hargreaves

Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Kathy Cassidy


First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni


For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell


The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi


The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?