Is Domain Highlighting Actually Helpful in Identifying Phishing Web Pages?

Area of Science:

• Human-Computer Interaction
• Cybersecurity
• Usability Studies

Background:

• Domain names within URLs are crucial for identifying websites but are often overlooked.
• Browser domain highlighting aims to assist users in recognizing legitimate sites, yet its efficacy remains understudied.
• Previous research confounded highlighting with explicit instructions, limiting understanding of highlighting's independent effect.

Purpose of the Study:

• To evaluate the effectiveness of domain highlighting in assisting users to distinguish between legitimate and fraudulent web pages.
• To investigate user behavior and attention when presented with highlighted domain names during phishing detection tasks.

Main Methods:

• Two phishing detection experiments were conducted, one online and one in a laboratory setting.
• Participants judged web page legitimacy, with variations in focusing on the address bar and domain highlighting.
• Experiment 2 utilized eye-tracking to record visual attention and fixation patterns.

Main Results:

• Participants could differentiate legitimate from fraudulent pages above chance levels.
• Focusing on the address bar offered some benefit, but domain highlighting alone did not significantly improve phishing detection.
• Eye-tracking data correlated with performance, showing visual attention was drawn to highlighted domains, but this did not translate to better security.

Conclusions:

• Domain highlighting alone is insufficient to protect users from phishing attacks.
• User ineffectiveness suggests a lack of knowledge regarding web security cues and their utilization.
• Future interventions should integrate domain highlighting with other security awareness methods for enhanced phishing prevention training.