Skip to main content

Technical Reports: CMU-CyLab-06-017

Title:Protecting People from Phishing: The Design and Evaluation of an Embedded Training Email System
Authors:Ponnurangam Kumaraguru, Yong Woo Rhee, Alessandro Acquisti, Lorrie Cranor, Jason Hong, Elizabeth Nunge
Publication Date:November 9, 2006


Phishing attacks, in which criminals lure Internet users to web sites that impersonate legitimate sites, are occurring with increasing frequency and are causing considerable harm to victims. In this paper we describe the design and evaluation of embedded training methods that teach people about phishing during their normal use of email. We conducted lab experiments contrasting the effectiveness of standard security notices about phishing with two embedded training designs we developed. We found that embedded training works better than the current practice of sending security notices. We also derived sound design principles for embedded training systems.

Full Report: CMU-CyLab-06-017