Embedding Training Within Warnings Improves Skills of Identifying Phishing Webpages

Area of Science:

• Human-computer interaction
• Cybersecurity
• Usable security

Background:

• Millions of users encounter security warnings weekly.
• Many users do not understand existing phishing warnings.
• Warnings present opportunities for user education on phishing.

Purpose of the Study:

• To evaluate training embedded within security warnings for identifying phishing webpages.
• To compare the effectiveness of training-embedded warnings against standard warnings.

Main Methods:

• An online experiment with three phases was conducted.
• Participants interacted with current and training-embedded warning interfaces.
• Long-term effectiveness was assessed a week after initial training.

Main Results:

• All interfaces performed similarly when warnings were present (Phase 1).
• Training-embedded interfaces offered superior protection in subsequent phases without warnings.
• Participants improved their ability to distinguish legitimate from fraudulent pages.

Conclusions:

• Embedded training complements existing security measures.
• It compensates for a lack of user skill in detecting phishing when warnings are absent.
• This strategy enables large-scale security training.