Abstract:Context: In the digital age, there is a notable increase in fraudulent activities perpetrated by social engineers who exploit individuals' limited knowledge of digital devices. These actors strategically manipulate human psychology, targeting IT devices to gain unauthorized access to sensitive data. Objectives: Our study is centered around two distinct objectives to be accomplished through the utilization of a serious game: (i) The primary objective entails delivering training and educational content to participants with a focus on phishing attacks; (ii) The secondary objective aims to heighten participants' awareness regarding the perils associated with divulging excessive information online. Methodology: To address these objectives, we have employed the following techniques and methods: (i) A comprehensive literature review was conducted to establish foundational knowledge in areas such as social engineering, game design, learning principles, human interaction, and game-based learning; (ii) We meticulously aligned the game design with the philosophical concept of social engineering attacks; (iii) We devised and crafted an advanced hybrid version of the game, incorporating the use of QR codes to generate game card data; (iv) We conducted an empirical evaluation encompassing surveys, observations, discussions, and URL assessments to assess the effectiveness of the proposed hybrid game version. Results: Quantitative data and qualitative observations suggest the "PhishDefend Quest" game successfully improved players' comprehension of phishing threats and how to detect them through an interactive learning experience. The results highlight the potential of serious games to educate people about social engineering risks. Conclusion: Through the evaluation, we can readily arrive at the following conclusions: (i) Game-based learning proves to be a viable approach for educating participants about phishing awareness and the associated risks tied to the unnecessary disclosure of sensitive information online; (ii) Furthermore, game-based learning serves as an effective means of disseminating awareness among participants and players concerning prevalent phishing attacks.

Engaging Users with Educational Games: The Case of Phishing

Serious Games for Cyber Security Education

User-Centred Security Education: A Game Design to Thwart Phishing Attacks

Can serious gaming tactics bolster spear-phishing and phishing resilience? : Securing the human hacking in Information Security

What Goes Wrong During Phishing Education? A Probe into a Game-Based Assessment with Unfavorable Results

Phish Phinder: A Game Design Approach to Enhance User Confidence in Mitigating Phishing Attacks

Development of the Reflective User: the Additive Effects of Reflective Practices and Gameful Learning on Flow and Cybersecurity Awareness

How Persuasive is a Phishing Email? A Phishing Game for Phishing Awareness

Integrating self-efficacy into a gamified approach to thwart phishing attacks

Designing a Mobile Game for Home Computer Users to Protect Against Phishing Attacks

Can a Mobile Game Teach Computer Users to Thwart Phishing Attacks?

Designing a mobile game to thwarts malicious IT threats: A phishing threat avoidance perspective

Exploring and Evaluating Different Game Mechanics for Anti-Phishing Learning Games

Involving Users in the Design of a Serious Game for Security Questions Education

Re-evaluation of PhishI Game and Its Utilisation in Eliciting Security Requirements

Protection and Deception: Discovering Game Theory and Cyber Literacy through a Novel Board Game Experience

Securix: a 3D game-based learning approach for phishing attack awareness

Building Confidence not to be Phished through a Gamified Approach: Conceptualising User's Self-Efficacy in Phishing Threat Avoidance Behaviour

Gamifying Course Modules for Entry Level Students

A Serious Game for Simulating Cyberattacks to Teach Cybersecurity

Designing a Serious Game: Teaching Developers to Embed Privacy into Software Systems