Teaching Johnny not to fall for phish

Key finding

Embedded email-based training (PhishGuru) and a game (Anti-Phishing Phil) built on learning-science principles improved users' ability to recognize phishing. The authors frame user education as a complement to automated detection, noting that users are unmotivated and that training can raise false alarms on legitimate messages.

Why it matters

Foundational evidence that teachable-moment feedback and game-based learning can work, which later field studies have complicated.

Cite

Kumaraguru, P., Sheng, S., Acquisti, A., Cranor, L. F., & Hong, J. (2010). Teaching Johnny not to fall for phish. ACM Transactions on Internet Technology. https://doi.org/10.1145/1754393.1754396