Design and Motivational Factors for an Effective Educational Game for Malicious Email Detection

Abstract

Phishing email attacks remain one of the dominant and ever-evolving cybersecurity threats facing organisations, demanding defensive measures to adapt continually. Existing anti-phishing education methods have narrowly focused on certain aspects of phishing detection, such as URL verification, instead of incorporating insights from learning theory, such as the role of motivation and cognitive message processing in phishing detection. In particular, the effectiveness of collaborative game elements in anti-phishing training remains largely unstudied. This thesis addresses these gaps through two interconnected studies. First, we analyse the Motivated Strategies for Learning Questionnaire (MSLQ) across different instruction modes, including remote, in an undergraduate engineering design course. From this, we derive a validated motivational construct, which we then apply to the anti-phishing training domain. Second, we design and implement Phooled!, a scalable collaborative anti-phishing training game, and evaluate it through a comparative study. We find that collaborative training improves phishing detection efficiency, measured as a balance between accuracy and speed, by 32% compared to the control group. Additionally, we demonstrate that motivation predicts phishing detection improvement, and identify key determinants of phishing email detection difficulty.