PickMail: A Serious Game for Email Phishing Awareness Training

Abstract

Phishing threats are on the rise, especially through Business Email Compromise (BEC). Despite having several tools for phishing email detection, the attacks are becoming smarter and personal, targeting individuals to gain access to personal and organizational information. Game-based cybersecurity training methods are found to have positive results in educating users. Along this line, we introduce PickMail, an anti-phishing awareness game that simulates typical real-life email scenarios to train an organization's employees. In PickMail, we train participants to judge the legitimacy of an email by inspecting its various parts, such as the sender's email domain, hyperlinks, attachments, and forms. The game also records participants' decision-making steps that lead to their final judgment. Our study with 478 participants shows how the serious game-based training helped the participants make better judgments on emails, with the correctness in identifying email legitimacy reaching 92.62%. The study also provided us with insights that could help develop better training methods and user interfaces.Usable Security and Privacy (USEC) Symposium 2022

CyberHero: An Adaptive Serious Game to Promote Cybersecurity Awareness

“…The game has time constraints to complete the tasks and utilizes scoring mechanisms such as ethics levels, points progression, and leaderboards. Passworld [19] is a scenario-based serious game for promoting password awareness and diversity in an enterprise. The game uses both Bloom's Taxonomy and the Six "I" Framework of Serious Game Design.…”