Carnegie Mellon University has developed an online game to teach people how to spot phishing sites. The game, developed by the CMU Usable Privacy and Security (CUPS) Laboratory, takes about 10 minutes to play (could be longer if you have difficulty). You help Phil (a fish, naturally) navigate through a series of tests to identify fake sites.Anti-Phishing Phil is an interactive game that teaches users how to identify phishing URLs, where to look for cues in web browsers, and how to use search engines to find legitimate sites.Most of what they teach you should be common sense, like looking at the URL, making sure you don't see IP addresses rather than a site name, Googling the site, or going to the site directly rather than using an embedded link.
Our user studies have found that user education can help prevent people from falling for phishing attacks. However, it is hard to get users to read security tutorials, and many of the available online training materials make users aware of the phishing threat but do not provide them with enough information to protect themselves. Our studies demonstrate that Anti-Phishing Phil is an effective approach to user education.
Still, if you play the game, you can get one or more changes at an Amazon.com gift certificate. I got a perfect score. How about you readers?
Update: According to the site, Phil is being commercialized and will be moving soon. Drat.






























