Human-Executable Algorithms for Phishing Avoidance

Abstract

Phishing attacks remain effective because they exploit human decisions at the moment of action, often before automated defenses intervene. Established countermeasures focus on detection systems or awareness campaigns but rarely provide non-expert users with a formally specified decision procedure. This work presents a lightweight, deterministic phishing avoidance algorithm that users can execute without specialized tools. The algorithm evaluates a finite set of observable indicators and applies a monotonic risk score to produce allow, caution, or block decisions. Formal properties of the procedure include monotonicity, bounded complexity, and decision traceability. A controlled study with 96 participants and 72 messages per participant showed that algorithm use increased mean classification accuracy from 68.4% to 84.7% and reduced the false-negative rate from 31.9% to 11.3%. Median decision time rose from 6.2 s to 8.7 s. These results show that phishing avoidance can be expressed as a human-executable algorithm rather than as advisory guidance, and that structured decision rules can measurably improve user level security outcomes.

1. Introduction

Phishing attacks represent a persistent challenge at the intersection of cybersecurity, human behavior, and algorithmic decision-making. This method of attack persists as a dominant social-engineering threat. It exploits human judgment under time pressure, authority cues, and routine communication patterns across email, messaging, and web channels. Large-scale research findings indicate that widely deployed awareness programs do not reliably yield durable risk reduction under operational conditions, even when organizations combine annual awareness modules with simulated phishing and immediate feedback interventions [1]. Broader syntheses of phishing training research reach a similar conclusion: although short-term gains often appear after instruction, a substantial fraction of users remains susceptible, and evidence for sustained behavioral change across time horizons that matter in practice remains limited [2]. This persistence highlights a gap between exposure to security instruction and consistent decision quality at the moment of action. In parallel, the anti-phishing literature emphasizes technology-centric countermeasures that presume either automated detection pipelines or expert supervision. Surveys of phishing countermeasures show extensive reliance on blacklists, content analysis, and machine learning models. They also report practical limitations, such as delayed coverage and incomplete early detection, which leave end users exposed in the critical window after an attack first appears [3]. Systematic reviews of mitigation strategies similarly report that many approaches remain tool-driven and that designs that ignore user capabilities cannot close the operational gap on their own [4]. In this context, non-technical users often receive prescriptive advice rather than a formally specified procedure that yields consistent, auditable decisions. Conventional guidance is advisory rather than algorithmic; it provides recommendations instead of a deterministic decision process that users can execute, verify, and apply as a repeatable rule set.

1.1. Motivation

Research in education and cognitive science consistently indicates that users perform more reliably when complex tasks are mediated by structured decision rules rather than by open-ended judgment. Studies on decision aids and rule-based instruction show that explicit procedures reduce cognitive load, improve consistency, and limit common biases associated with time pressure and uncertainty [5]. In security-relevant contexts, this effect becomes particularly important, as phishing attacks are explicitly designed to exploit intuitive reasoning and habitual responses rather than analytical evaluation. Educational interventions that translate abstract advice into concrete, repeatable rules therefore offer a more stable foundation for user behavior than awareness messages alone.

Within the cybersecurity literature, this perspective aligns with the broader shift toward “human-in-the-loop” security models, which recognize that users remain an active component of defense even in highly automated environments. Prior work in usable security emphasizes that systems which rely exclusively on automation or expert oversight often fail at the boundary where human decisions determine the final outcome [6]. Instead, security mechanisms that explicitly support user reasoning, rather than replace it, demonstrate improved effectiveness and adoption. Algorithmic thinking provides a natural bridge in this setting, as it enables the formalization of security decisions in a way that remains interpretable and actionable for non-expert users while it retains analytical rigor. Motivated by these findings, there is a clear need for lightweight, explainable, and tool-independent algorithms that users can execute directly at the moment a security decision arises. Unlike some of the machine-learning detection systems, which operate opaquely and require continuous maintenance, simple deterministic algorithms can be inspected, taught, and validated within educational settings. Prior work on explainable and rule-based security mechanisms suggests that transparency and simplicity increase trust and long-term adherence, particularly when users must justify or recall decisions after the fact [7]. An explicit decision algorithm for phishing avoidance addresses pedagogical evidence, usable security principles, and algorithmic design goals. It establishes a foundation for human-centered defenses that remain effective without reliance on specialized software or expert intervention.

1.2. Contributions

This work makes four distinct contributions that jointly address the gap between security advice and executable user behavior. First, it introduces a deterministic phishing-avoidance decision algorithm that can be executed directly by non-expert users without reliance on specialized tools or background knowledge. Unlike prior awareness-oriented approaches, the algorithm specifies an explicit sequence of observable checks and decision thresholds, which enables repeatable outcomes rather than subjective judgment. This design responds to empirical findings that users struggle to translate general warnings into consistent action under realistic conditions [8]. Second, the paper formalizes a compact set of phishing indicators and associated decision thresholds within a simple computational model. The approach represents observable cues such as message context, urgency signals, and request type as binary or low complexity variables. This structure aligns with established security decision aids based on rules and avoids the opacity typical of classifiers that rely on data-driven methods [9]. This formalization permits analytical inspection of decision behavior, supports reasoning about false positives and false negatives, and enables controlled adaptation without an alteration of the core decision logic. Third, the study presents an experimental evaluation that compares algorithm-guided decisions against baseline user judgment in a scenario-based phishing classification task. Prior experimental work has shown that unaided users exhibit high variance in phishing susceptibility and that performance degrades under stress or distraction [10]. In contrast, the evaluation shows that algorithmic guidance improves decision accuracy and stability across participants and enables direct comparison with advice-based defenses. It also reduces missed phishing attacks and unnecessary blocks of legitimate messages. This finding supports broader claims in usable security research that formally specified procedures can outperform intuition-based strategies in adversarial settings [11]. Fourth, the paper provides a formal theoretical characterization of the proposed decision rule, which includes formal analysis of monotonicity (i.e., activation of additional indicators cannot decrease the aggregate risk score nor yield a less restrictive decision), bounded computational complexity, and explainability. These properties establish that the algorithm is analytically well-defined, predictable in behavior, and suitable for transparent human execution within usable security frameworks. These contributions position phishing avoidance not merely as a matter of user awareness, but as a problem amenable to lightweight algorithmic treatment within established usable security research, with emphasis on formal specification and controlled empirical evaluation.

2. Methods

The methodological framework of this study is designed to support a precise and reproducible evaluation of a user-executable phishing-avoidance algorithm. Rather than a focus on system-level detection or large-scale automated filtering, the methods highlight explicit assumptions, observable inputs, and controlled decision outcomes that can be replicated across users and experimental settings. Particular attention is given to the isolation of the decision process executed by the user, independent of auxiliary technical defenses, in order to assess the intrinsic effectiveness of the algorithm. Thus, this section defines the analytical boundaries of the study and establishes the conditions under which the proposed algorithm operates and is evaluated. It provides a structured foundation for subsequent analysis and comparison.

2.1. Algorithm Design Methodology

The decision procedure was designed via a constrained, user-centered workflow. First, we enumerated common phishing tactics from the prior empirical literature and incident analyses, then translated them into candidate cues that remain directly observable within ordinary message interaction (no external tools, no reputation services, no automated analysis). Second, we filtered candidates by (i) observability at the moment of action, (ii) semantic clarity (i.e., each cue must admit a short user-level interpretation), and (iii) low cognitive overhead. Third, we removed cues that tended to appear together in the same phishing messages and retained only one representative per group, so that each indicator that remains, corresponds to a different observable condition evaluated by the user. We also verified this property directly from the definition of the decision rule: the aggregate score is computed as a weighted sum of binary indicators with non-negative weights, and the final decision follows from comparisons with fixed thresholds (i.e., the aggregate score $S\left(m\right)={\sum }_i{w}_i{I}_i$, with $w_i\ge 0$, is compared against fixed thresholds to produce the final decision). Under this definition, the addition of an indicator cannot reduce the score or yield a less restrictive outcome.

2.2. Threat Model and Assumptions

The methodological scope of this study adopts a user-centered threat model that reflects the most prevalent and operationally relevant forms of phishing observed in contemporary digital communication environments. The attacker is modeled as an external adversary who delivers phishing content through common channels such as email, instant messaging applications, and social networking platforms. This assumption aligns with longitudinal measurement studies which point out that these vectors remain the dominant delivery mechanisms for phishing campaigns, largely due to their scalability, low cost, and ability to exploit established trust relationships [12,13]. The defender is assumed to be an ordinary user with no access to specialized security tools, automated detection software, or expert support at the moment of decision. This assumption reflects empirical evidence that, in many real-world contexts, users encounter phishing attempts outside managed enterprise environments or before automated filter mechanisms have adapted to novel threats [14]. Consequently, the defensive capabilities considered in this work are intentionally restricted to information that is directly observable by the user, such as message content, sender cues, and contextual expectations, without reliance on browser extensions, reputation services, or machine-learning-based classifiers.

Within this model, the attacks under consideration include credential theft, payment fraud, and malware delivery. These categories account for the majority of reported phishing-induced losses and are consistently identified as primary objectives in both academic analyses and industry incident reports [15]. Credential theft remains a central goal due to its role as an enabler for downstream compromise, while fraudulent payment requests and malware-laden attachments represent direct vectors for financial loss and system compromise. The proposed algorithm is designed to address these classes through decision cues that precede irreversible user actions, such as submission of credentials, transfer of funds, or execution of executable content. Certain threat classes are explicitly excluded from the model. Zero-day browser exploits, drive-by attacks that require no user interaction, and highly targeted nation-state spear-phishing campaigns fall outside the intended scope. Prior work indicates that such attacks rely on technical exploitation or extensive reconnaissance that cannot be reasonably countered through user-executable decision procedures alone [16]. The defined threat model isolates phishing scenarios in which user judgment serves as the decisive line of defense. It provides a realistic and analytically tractable basis for evaluation of a lightweight, human-executable algorithm. The threat model is explicitly bounded to externally delivered phishing attempts that require user interaction (e.g., credential submission, payment authorization, or attachment execution). Attacks that rely exclusively on technical exploitation without user decision (e.g., zero-click exploits) are excluded. All algorithm parameters (indicator set, weights $w_i=1$ for $i=1,\dots ,7$, and thresholds $T_c=2$ and $T_b=4$) were fixed prior to experimental evaluation and remained unchanged throughout the study. The message corpus size, composition, and evaluation metrics are fully specified, which enables direct replication of the experimental protocol.

2.3. Phishing Indicators

The proposed decision algorithm relies on a small and finite set of phishing indicators that are directly observable by end users in ordinary interactions with messages, links, or attachments (Table 1). The selection of indicators is guided by two constraints: first, each indicator must be assessable without specialized tools, automated analysis, or expert knowledge; second, each indicator must correspond to a concept that can be clearly explained, taught, and recalled at the moment of decision (Table 1). This approach follows earlier usable-security research which demonstrates that users may perform more reliably when cues are concrete, perceptually accessible, and limited in number rather than abstract or probabilistic [17]. In order to ensure the reproducibility of the indicator set, we applied the following selection rules: (R1) user observability, which requires that the cue is decidable from the message interface itself (ex., sender identifiers, message text, link preview or target, attachment type, and context known to the user); (R2) action relevance, which requires that the cue precedes an irreversible action (ex., credential entry, payment authorization, code disclosure, execution of risky attachments); (R3) non-redundancy, whereby indicators must capture distinct attacker tactics rather than multiple encodings of the same cue; and (R4) teachability, which requires that each indicator admits a short, platform-independent explanation suitable for recall under time pressure. Use of these rules yields the final set I₁–I₇ reported in Table 1.

Table 1. Observable phishing indicators used by the proposed decision algorithm.

I 1	Observable Condition	User-Level Interpretation	Rationale from the Literature
I1	The message requests an action that was not previously expected or initiated by the user.	Unexpected communication increases risk.	Contextual inconsistency strongly correlates with phishing success, because users compare messages with their expectations when they evaluate legitimacy [9,17,18].
I2	The message contains urgency, threats, or time pressure (e.g., “account suspended,” “act now”).	Emotional pressure reduces deliberation.	Urgency cues suppress analytical reasoning and increase impulsive compliance in phishing scenarios [19].
I3	The message requests credentials, payment information, authentication codes, or financial transfer.	High-impact request requires heightened scrutiny.	Credential and payment requests represent primary phishing objectives and account for a large fraction of reported losses [15,20].
I4	The name of the sender, reply address, or link text does not match the actual destination.	Visual mismatch signals deception.	Mismatches between displayed and actual identifiers are a reliable cue when users are trained to inspect them [21].
I5	The domain structure appears suspicious (excessive subdomains, misleading brand tokens, unusual TLDs 2).	URL structure deviates from known legitimate patterns.	Structural properties of phishing URLs differ measurably from benign domains across large-scale studies [22].
I6	The message includes risky attachment types (executables, archives, macro-enabled documents).	Attachments increase compromise risk.	Malware delivery via phishing attachments remains a common and effective attack vector [23].
I7	The request cannot be verified through a trusted secondary channel.	Lack of independent confirmation increases uncertainty.	Secondary verification significantly reduces successful social engineering attacks [24].

¹ I = Indicator; ² TLD = Top-Level Domain (e.g., mdpi.com).

Therefore, several of the indicators employed in this work derive from well-established empirical findings on phishing susceptibility. Unexpected requests constitute a central signal, as users are significantly more likely to misclassify phishing messages when the communication context deviates from prior interaction or expectation [9,18]. Similarly, urgency or threat-based language has been repeatedly identified as a manipulation strategy that suppresses deliberation and promotes impulsive action, particularly when combined with authority cues or time pressure [19]. Requests for credentials, payment information, or authentication codes represent high-impact actions that correlate strongly with successful phishing outcomes and therefore serve as a decisive indicator in many practical defenses [15,20]. Additional indicators capture structural inconsistencies that users can observe visually. Mismatches between displayed sender names and actual addresses, as well as discrepancies between link text and target destinations, have been shown to influence phishing detection accuracy when users are explicitly trained to attend to them [21]. Suspicious domain structures, which also include excessive subdomains, misleading brand tokens embedded outside the registrable domain, or unfamiliar top-level domains, have also been identified as frequent characteristics of phishing URLs across large-scale measurement studies [22]. Risky attachment types, such as executable files or macro-enabled documents, provide another observable cue that aligns with common malware delivery strategies in phishing campaigns [23].

Therefore, the absence of a secondary verification channel functions as a contextual indicator rather than a syntactic one. Prior studies indicate that users who habitually confirm sensitive requests through an independent channel, such as a known phone number or a prior communication thread, demonstrate significantly lower susceptibility to fraud [24]. Importantly, each indicator is treated as independent within the algorithmic model, which allows users to reason about their presence individually. This structure preserves a transparent mapping between observed cues and the final decision. Thus, the method constrains the indicator set to observable, explainable, and independent signals. This design avoids the cognitive overload and opacity associated with feature-rich automated classifiers, yet preserves sufficient expressive power to represent common phishing strategies.

2.4. Decision Algorithm

The core contribution of this work is a deterministic phishing-avoidance decision algorithm that translates observable message cues into a structured and repeatable outcome (Figure 1). The algorithm is intentionally simple, both in form and execution, so that non-expert users can follow it, and it remains amenable to formal analysis. Its design draws on established principles from rule-based decision systems and risk scoring models, which have long been used in security and fraud prevention to balance interpretability and effectiveness [25,26]. Please note that the weights $w_i$ and thresholds $T_b$ and $T_c$ were set through a simple, transparent calibration procedure defined prior to the experimental evaluation, in order to preserve interpretability and monotonic decision behavior. The use of a weighted additive model reflects prior findings that linear risk aggregation provides a robust and interpretable approximation for human-centered security decisions, particularly when the number of features is small and semantically distinct [27]. Please note that although indicators are illustrated individually in Figure 1, the decision rule operates on the full indicator vector rather than on a sequential evaluation.

Figure 1. Activity diagram of the phishing-avoidance decision procedure. Indicators $I_1,\dots ,I_n$ are shown in a vertical arrangement for compact visualization only; the algorithm treats them as an unordered indicator vector evaluated without sequential dependency. The aggregate score $S\left(m\right)={\sum }_i{w}_i{I}_i$ is compared against two thresholds, $T_b$ and $T_c$, to assign the final decision (BLOCK, CAUTION, or ALLOW). The brain icon denotes the user decision point and does not imply heuristic reasoning or learning. Color coding is used for visual grouping only; the decision logic remains fully deterministic and unambiguous in grayscale. The diagram corresponds directly to Algorithm 1.

Algorithm 1: Deterministic Phishing-Avoidance Algorithm

Input: a message m

Output: decision  $\in \{\mathrm{ALLOW},\mathrm{CAUTION},\mathrm{BLOCK}\}$

1. For the message m, evaluate the predefined set of phishing indicators I1, I2, …, In, where each indicator takes a binary value which reflects the presence or absence of the associated observable condition.

2. Compute the aggregate risk score:

$S(m)={\displaystyle \sum _{i=1}^n}{w}_i\cdot I_i,$

where wi denotes the weight associated with indicator Ii

3. If $S\left(m\right)\ge T_b$, return BLOCK.

4. Else, if $S\left(m\right)\ge T_c$ return CAUTION.

5. Otherwise, return ALLOW.

Weight and Threshold Calibration

The main parameters were calibrated under two explicit constraints: (C1) preservation of interpretability through small integer weights, and (C2) preservation of monotonicity through non-negative weights. Higher weights can be assigned to indicators that imply high-impact outcomes (e.g., such as credential or payment requests), while lower weights can be assigned to weaker cues, such as stylistic urgency, which may also occur in legitimate messages (here, however, the weights were equal, namely $w_i=1$). A small, finite parameter check was then carried out over candidate threshold values consistent with the integer score range defined by the indicator count.

Since all indicator weights were fixed to $w_i=1$, the aggregate score $S\left(m\right)$ takes integer values in the interval $\left\{0,\dots ,7\right\}$. Threshold values were therefore restricted to a narrow integer range within this bounded domain. All admissible threshold pairs that satisfy $T_b>T_c$ were examined with respect to false-negative and false-positive behavior. Configurations that produced excessive missed phishing cases or widespread rejection of legitimate messages were discarded. One configuration that satisfied this trade-off was fixed prior to the main experiment and used unchanged for all reported results. Thus, the final configuration was selected before the main experimental results were reported and remained fixed throughout the evaluation. In the final configuration used for the experiment, all indicator weights were set to $w_i=1$ for $i=1,\dots ,7$. The decision thresholds were defined as $T_c=2$ and $T_b=4$. This configuration partitions the discrete score range $\left\{0,\dots ,7\right\}$ into three contiguous risk regions that correspond to progressively greater cumulative evidence. Under this configuration, messages with zero or one activated indicator are classified as ALLOW, messages with two or three indicators as CAUTION, and messages with four or more indicators as BLOCK. The use of unit weights was intentional. Because the algorithm is designed to be human-executable without tools, the aggregate score must be computable through simple mental addition (e.g., 1 + 1 + 1 for each triggered indicator). Equal weights preserve monotonicity, transparency, and cognitive simplicity and also prevent parameter overfitting. Such models are widely employed in fraud detection and access control due to their transparency and predictable behavior under feature variation [28]. The algorithm is deterministic by construction: for a fixed set of indicator values and parameters, it always produces the same decision. This property is essential for both pedagogical use and analytical evaluation, as it enables users to understand, anticipate, and verify outcomes. In addition, the decision rule satisfies monotonicity with respect to indicator inclusion. Under the defined score function, the addition of an indicator cannot reduce the aggregate score or yield a less restrictive decision. Monotonicity is a desirable property in security decision systems, as it aligns the behavior of the algorithm with intuitive risk reasoning and prevents counterintuitive outcomes that could undermine user trust [29]. A frame for phishing avoidance as an explicit algorithm replaces open-ended judgment with structured, rigorous decision logic. The decision procedure remains simple enough to be executed mentally or with minimal guidance, yet sufficiently formal to support experimental evaluation, parameter tuning, and future extensions within a human-in-the-loop security framework.

2.5. Theoretical Properties

The proposed decision algorithm admits a concise set of theoretical properties that support both analytical treatment and practical deployment. These properties follow directly from the structure of the weighted additive risk function and the discrete nature of the indicator set. The decision rule satisfies monotonicity with respect to its inputs. Each phishing indicator contributes a non-negative weighted term to the aggregate risk score, which implies that the activation of any additional indicator cannot reduce the value of the score. As a consequence, the decision outcome cannot shift from a more restrictive state to a less restrictive one when new evidence of risk appears. Monotonic decision behavior has long been recognized as a desirable property in security and risk assessment systems, as it aligns algorithmic output with intuitive notions of cumulative risk and avoids paradoxical outcomes that can erode user trust [30,31].

The computational complexity of the algorithm is bounded and linear in the number of indicators. For a message $m$, the evaluation requires a single pass over the indicator set, followed by a constant number of comparisons against fixed thresholds. Since the number of indicators is intentionally small and fixed by design, the effective runtime is constant in practice. This bounded complexity mirrors classical scoring models used in fraud detection and access control, where predictability and low overhead are essential for real-time or human-executed decision processes [32]. From a theoretical perspective, the algorithm operates in $O\left(n\right)$ time with respect to the indicator count $n$, with no dependence on external data structures or historical state.

Explainability constitutes a further core property of the algorithm. Each decision can be decomposed into a finite set of active indicators and their associated weights, which in turn yields a transparent justification for the final outcome. This traceability enables both users and evaluators to reconstruct the reasoning path that led to a given decision, a property that contrasts sharply with opaque statistical classifiers. Prior research in interpretable decision systems has shown that such transparency improves correctness assessment, error correction, and long-term adherence to prescribed procedures in high-stakes domains [33,34]. In the present context, explainability also supports pedagogical goals, as users can associate outcomes directly with observable cues rather than abstract model behavior.

2.6. Experimental Design

The experimental evaluation employed a controlled, scenario-based message classification task designed to approximate realistic phishing decision contexts while it preserved full experimental control. A total of 96 participants took part in the study, which consisted of university students and academic staff with no professional background in cybersecurity. All participants were treated as non-expert users and reported routine use of email and messaging platforms as part of daily activities. Before the task, participants completed a short background questionnaire that recorded (i) prior exposure to phishing messages (i.e., never; rare; occasional; frequent), (ii) prior formal training on phishing (yes/no), and (iii) self-rated confidence for the identification of suspicious messages (i.e., Likert scale). We report these variables descriptively to contextualize the participant pool and to support interpretation of performance differences under algorithmic guidance. Moreover, the composition of the sample reflects established practice in phishing susceptibility research and aligns with prior experimental studies that evaluate security interventions for non-expert users under controlled conditions [8,9,21]. Detailed demographic variables (e.g., age distribution and gender breakdown) were not systematically recorded and are therefore not included in the present analysis.

Participants completed the task through a web-based interface that presented simulated email and messaging stimuli sequentially. Each stimulus displayed a sender identifier, subject line, message body, and, where applicable, embedded links or attachment indicators. The message corpus comprised 72 stimuli per participant, evenly divided between phishing and legitimate messages. Phishing stimuli represented credential-harvest attempts, fraudulent payment requests, and attachment-based malware delivery. These categories correspond to the dominant attack types reported in empirical phishing analyses [3,15,17,19]. Legitimate messages included routine account notifications, internal communications, and time-sensitive but benign requests, some of which intentionally contained isolated suspicious cues to test false-positive behavior. Each message was associated with a ground-truth label established at the corpus construction stage and independently verified by two researchers. In addition, each stimulus was annotated with the appropriate indicator vector $I_1\dots I_7$, which guaranteed consistency between message design and algorithmic evaluation.

The experiment followed a within-subjects design with a counterbalanced condition order. Each participant completed two blocks of equal size. In the unaided condition, participants classified messages based solely on personal judgment. In the algorithm-assisted condition, participants evaluated the predefined phishing indicators and were shown the decision produced by the proposed algorithm before they confirmed their response. Different but comparable stimulus sets were used across conditions to prevent learning effects, in accordance with established methodology in usable security experiments [10,21]. Participants selected one of three responses for each message: ALLOW, CAUTION, or BLOCK. No feedback with regard to correctness was provided during the task. Decision time was recorded automatically as the interval between message presentation and response confirmation.

Performance was evaluated by using four primary metrics (i.e., accuracy; false-negative rate (missed phishing); false-positive rate (legitimate messages blocked); decision time). Accuracy measured the proportion of correct classifications relative to ground truth. The false-negative rate quantified the proportion of phishing messages labeled as ALLOW, which represents the most critical security failure mode. The false-positive rate measured the proportion of legitimate messages labeled as BLOCK, which captured usability cost and over-cautious behavior. Decision time served as a proxy for cognitive effort and task efficiency, with median values reported due to skewed distributions. This metric set reflects standard evaluation practice in phishing intervention research [1,2,8].

2.7. User-Level Execution Model

The proposed decision algorithm is designed for direct execution by non-expert users at the point prior to a potentially irreversible action (e.g., credential submission, payment authorization, attachment execution). The user is not required to classify the attack type (e.g., credential theft, payment fraud, malware delivery), nor to estimate probabilities or adjust parameters. All weights and thresholds are fixed a priori ($w_i=1$ for all indicators; $T_c=2$; $T_b=4$). Operational execution proceeds as follows:

Step	User-level operation
1	Observe the message within its native interface.
2	Evaluate each indicator I1–I7 independently; assign 1 if present, 0 otherwise.
3	Compute S(m) by counting activated indicators (S(m) ∈ {0,…,7}).
4	Apply decision rule:   ➢ S(m) ≥ 4 → BLOCK;   ➢ S(m) ∈ {2,3} → CAUTION;   ➢ S(m) ∈ {0,1} → ALLOW.

No dynamic threshold selection or weight calculation is performed throughout the execution. Indicator evaluation relies on directly observable message properties rather than subjective intuition. For example, “unexpected request” refers to a request not initiated or anticipated by the user; “sender mismatch” refers to visible inconsistency between displayed name and actual address; “credential request” refers to explicit solicitation of authentication information. Each condition is visually or contextually verifiable within the message interface. The algorithm is additive and non-sequential. All indicators are evaluated independently, and no branching structure or hierarchical dependency is imposed. Unlike a decision tree, the final decision depends solely on the aggregate count of activated indicators rather than on a specific evaluation order.

Example Execution

Consider a message stating: “Your account has been suspended. Log in immediately to restore access,” containing a login link and no prior interaction.

I1 (unexpected request) = 1

I2 (urgency language) = 1

I3 (credential request) = 1

I7 (no secondary verification channel) = 1

Remaining indicators = 0

Thus, S(m) = 4.

Since S(m) ≥ 4, the algorithm returns BLOCK.

This execution requires evaluation of a finite checklist and counting up to seven, with no probabilistic reasoning or threat-type classification. The bounded number of indicators ensures constant cognitive effort and reproducible decision behavior across users.

3. Results

Results are reported according to four predefined metrics: accuracy, false-negative rate, false-positive rate, and decision time. Values derive directly from observed classifications and response times without post hoc adjustment. Reported outcomes enable direct comparison between unaided and algorithm-assisted decisions and capture both security-relevant errors and bounded usability costs.

3.1. Classification Performance

Participants evaluated the same message set twice: once based on their own judgment and once based on the proposed decision algorithm. Classification accuracy, false-negative rate, and false-positive rate for both conditions are reported in Table 2. Participants without algorithmic support achieved a mean accuracy of 68.4%, whereas algorithm-assisted decisions reached 84.7%. The improvement is observed across participants and message categories. The false-negative rate, which captures missed phishing attempts, decreased from 31.9% in the unaided condition to 11.3% under algorithmic guidance. This reduction represents a substantial decrease in security-critical errors. The false-positive rate increased moderately from 14.6% to 16.2%, which reflected a limited rise in conservative decisions for legitimate messages.

Table 2. Classification performance across experimental conditions.

Condition	Accuracy (%)	False-Negative Rate (%)	False-Positive Rate (%)
Unaided judgment	68.4	31.9	14.6
Algorithm-assisted	84.7	11.3	16.2

The accuracy broken down by message category is shown in Table 3. The largest improvement appears for credential-harvest phishing, where accuracy increased from 62.1% to 88.9%. Payment fraud messages show a similar pattern, with accuracy rising from 66.4% to 85.3%. Attachment-based phishing exhibits a smaller but still notable improvement, from 71.2% to 80.6%. Accuracy for legitimate messages increased from 73.9% to 83.8%, which indicates that algorithmic guidance did not cause widespread misclassification of benign content.

Table 3. Classification accuracy by message category.

Message Category	Unaided Accuracy (%)	Algorithm-Assisted Accuracy (%)
Credential-harvest phishing	62.1	88.9
Payment fraud phishing	66.4	85.3
Attachment-based phishing	71.2	80.6
Legitimate messages	73.9	83.8

Decision time results are summarized in Table 4. Median decision time increased from 6.2 s in the unaided condition to 8.7 s with algorithmic support. Algorithm-assisted decisions required additional time per message, with a consistent increase across participants and message types. No participant exhibited extreme delays or task abandonment in the algorithm-assisted condition.

Table 4. Median decision time per message.

Condition	Median Decision Time (s)	Interquartile Range (s)
Unaided judgment	6.2	4.1–8.9
Algorithm-assisted	8.7	6.3–11.4

3.2. Error Analysis

Analysis of incorrect classifications reveals systematic differences between the two conditions. Indicator activation frequencies in phishing messages are summarized in Table 5. Error patterns are interpreted in relation to the predefined phishing indicators, so that each incorrect decision can be traced to a specific indicator judgment. In the unaided condition (i.e., decisions were made without use of the proposed algorithm), false negatives frequently arose in messages that combined moderate urgency with familiar branding, particularly in credential-harvest scenarios. Participants often relied on surface-level cues, such as recognizable logos or plausible sender names. In contrast, they overlooked inconsistencies in the message content or the destination link. Payment fraud messages that mimicked internal organizational communication also produced a high rate of missed attacks under unaided judgment.

Table 5. Indicator activation frequency in phishing messages.

Indicator	Activation Rate (%)
Unexpected request (I1)	91.7
Urgency or threat language (I2)	76.4
Credential or payment request (I3)	83.9
Link or sender mismatch (I4)	69.1
Suspicious domain structure (I5)	64.8
Risky attachment type (I6)	58.2
No secondary verification channel (I7)	87.5

In the algorithm-assisted condition, residual false negatives occurred primarily when participants failed to mark the presence of key indicators, most notably unexpected requests and absence of secondary verification channels. Please note that these errors reflect incorrect indicator evaluation rather than failures of the decision rule itself. When indicators were correctly identified, the algorithm rarely produced an incorrect ALLOW outcome. False positives in both conditions typically involved legitimate messages that contained urgency cues or unusual timing, such as late-hour administrative notices. In the algorithm-assisted condition, most false positives corresponded to cases where multiple low-weight indicators activated simultaneously, which pushed the aggregate score beyond the caution threshold.

Indicator-level analysis shows that unexpected requests and credential or payment demands contributed most strongly to correct phishing identification, followed by urgency cues and sender-link mismatches. Risky attachment types contributed primarily in malware-oriented phishing scenarios and had minimal influence on benign messages.

3.3. User Consistency

User-level analysis demonstrates a marked reduction in performance variance under algorithmic guidance. In the unaided condition, accuracy scores exhibited substantial dispersion, with some participants that performed near chance level while others achieved relatively high detection rates. Under algorithm-assisted decision-making, accuracy distributions narrowed considerably, and low-performing participants exhibited the largest gains.

Agreement between participants also increased in the algorithm assisted condition. Decisions for the same message converged more consistently toward the correct outcome, which indicated a reduced reliance on idiosyncratic (i.e., specific to an individual and not systematically shared across participants) judgment strategies. This effect appeared most prominently for credential-harvest and payment fraud messages, where algorithmic structure constrained divergent interpretations of urgency and authority cues. Moreover, the results show that algorithmic guidance not only improved mean performance but also stabilized decision behavior across users. Across all analyses, the false-negative rate represents the primary security-relevant outcome, while the false-positive rate and decision time capture bounded usability costs.

4. Discussion

Experimental results show measurable differences between decisions based solely on participant judgment and decisions produced through execution of the proposed algorithm in phishing scenarios. These differences reflect both the benefits and constraints of formal decision procedures when applied to human-centered security tasks. In particular, the observed reduction in missed phishing decisions, coupled with increased decision consistency across users, indicates that explicit rule execution can suppress opportunistic heuristics that attackers may routinely exploit. From a security perspective, the false-negative rate constitutes the most critical outcome, since each missed phishing message represents a direct compromise risk. At the same time, the persistence of residual errors under algorithmic guidance underscores the influence of perception and compliance limits that no deterministic procedure can fully eliminate. These results indicate that phishing avoidance requires both algorithmic structure and user compliance, since formal rules constrain but do not eliminate judgment under adversarial pressure. Accordingly, the contribution of the present study should be understood as formalization and controlled empirical assessment of a structured decision aid within established usable security research, rather than as introduction of a new detection framework.

4.1. Effectiveness of Algorithmic Guidance

Observed gains in classification performance support the premise that explicit decision rules can outperform intuition in phishing contexts where attackers target fast, heuristic judgment. The algorithm-assisted condition reduced missed phishing decisions while it maintained a limited increase in conservative blocking, which indicates that rule execution shifted user behavior toward a more risk-averse stance without loss of legitimate-message handling. This pattern aligns with empirical evidence that users often disregard or misapply browser warning cues, even when warnings appear prominently, because rapid, habitual action dominates careful verification in realistic workflows [35,36]. In contrast to generic warnings, the present approach externalizes a concrete sequence of checks and converts dispersed cues into a single monotone score, which constrains opportunistic reasoning and reduces susceptibility to authority and urgency manipulation. The error profile further suggests that structured reasoning can counteract the bias exploitation that phishing campaigns deliberately encode. Recent analyses of phishing content show systematic use of cognitive biases to elicit action, with measurable impact on user decisions and on classifier performance when bias-related features enter the model [37]. Training interventions that explicitly target bias triggers can yield measurable improvements in detection, which supports the claim that user cognition is a controllable component of defense when the intervention offers more than advisory statements [38]. The algorithm requires explicit confirmation of high-risk cues, such as unexpected requests and credential or payment demands and reduces reliance on superficial legitimacy signals.

4.2. Comparison with Automated Mail Filtering

One obvious question is: How does a user-executable phishing-avoidance procedure relate to automated machine-learning mail filtering, and what role does it play when filtering fails or is unavailable? Automated machine-learning mail filtering seeks to block phishing messages prior to delivery and thus operates as an upstream classification mechanism. Such systems often rely on opaque models and require periodic retraining as attacker tactics evolve. In contrast, the present work addresses the decision moment at the user endpoint and provides a deterministic, auditable rule set that supports accountability and instruction. The two approaches serve complementary roles: automated filtering reduces overall exposure volume, while a user-executable decision procedure reduces residual risk when malicious messages bypass filters or reach users through unmanaged communication channels. Moreover, while automated systems operate exclusively on textual and structural features available at the filtering stage, human users rely on additional contextual and graphical cues available at the point of interaction, which motivates the complementary role of an explicit user-executable decision procedure.

4.3. Educational Implications

Results also support the educational value of an algorithmic representation of phishing avoidance. Many awareness programs emphasize recognition tips, yet learners often struggle to translate advice into stable behavior at the moment of action, particularly under time pressure. A decision procedure based on a finite indicator set offers a teachable artifact that fits instructional practice: it can be rehearsed, assessed, and adapted to new examples while it preserves a fixed decision logic. This approach matches evidence from phishing education work that shows a measurable behavior change when instruction provides concrete tasks and structured practice rather than passive exposure [8,10,21]. The indicator format also allows direct alignment with digital literacy objectives, because it promotes the explicit evaluation of message context, request legitimacy, and verification channels rather than reliance on intuition.

Integration into digital literacy curricula can proceed as a short module that connects social-engineering tactics to observable cues and provides repeated classification exercises. A key advantage is portability across platforms, since indicator evaluation does not require specialized software and remains applicable to email, messaging, and social channels. The method also supports formative assessment, because the instructor can trace an incorrect decision to a specific indicator judgment rather than to a vague “lack of awareness,” which enables targeted remediation and supports measurable learning outcomes.

The experimental results indicate that structured execution of a finite indicator checklist improves decision accuracy and reduces security-critical errors. For practical deployment, the proposed algorithm should not remain a one-time instructional artifact but be incorporated into repeated training exercises aimed at internalization. A structured implementation pathway may include: (i) a guided introduction of the seven observable indicators with annotated examples; (ii) supervised classification sessions that use realistic message scenarios; (iii) a delayed retention assessment to evaluate the stability of indicator recognition; and (iv) periodic short refresher sessions to maintain recall under time pressure. Such repetition supports the gradual transition from deliberate checklist execution toward stable, low-effort recognition behavior. Because the algorithm relies on a fixed additive rule with bounded complexity (maximum seven binary checks), it is suitable for integration into digital literacy curricula, onboarding programs, and security awareness modules. The deterministic structure allows instructors to trace incorrect decisions to specific indicator misjudgments, which enables targeted remediation rather than generic awareness messaging. Future field studies should evaluate long-term retention, behavioral stability under workload and emotional stress, and effectiveness when embedded in organizational workflows.

4.4. Limitations

Several limitations constrain generalization. First, the method does not address all sophisticated attacks. Highly targeted spear phishing that leverages deep personal context can reduce the salience of “unexpected request” cues, while advanced impersonation techniques can weaken sender and link mismatch indicators. Second, the approach assumes user compliance with the procedure. If a user bypasses indicator evaluation under urgency or workload, performance can revert toward unaided judgment, which is consistent with broader evidence that security behaviors compete for limited attention and effort [11]. Third, indicator distributions evolve. Attackers adapt message structure and channel constraints, which can shift indicator frequencies and alter the optimal weight and threshold configuration over time. This risk motivates periodic recalibration rather than static parameter fixation. A further limitation concerns the evaluation setting. Scenario-based tasks provide controlled measurement, but they cannot fully reproduce organizational consequences, multi-task interruption, or long-term habituation effects. Field evidence from browser security warnings shows that user response can vary by context and repeated exposure, which implies that laboratory gains do not automatically imply equivalent operational gains without longitudinal validation [35,36].

4.5. Future Work

An additional extension concerns user-specific calibration. The present study employs fixed indicator weights and thresholds applied uniformly across participants in order to preserve interpretability and comparability. However, future work may explore constrained personalization strategies in which weights or threshold values are adjusted based on observed individual error patterns. Any such adaptation must preserve monotonicity, bounded complexity, and decision transparency to maintain the human-executable character of the method.

Several extensions can strengthen robustness and educational impact. Adaptive weighting offers a direct next step. A simple update rule can modify indicator weights or threshold values on the basis of errors observed for each user (e.g., such as repeated false negatives or repeated false positives). The adjustment remains restricted to predefined numerical bounds, and the monotonic structure of the decision rule (i.e., activation of additional risk indicators cannot decrease the aggregate score or yield a less restrictive decision) remains unchanged, which preserves interpretability and decision transparency. Such calibration can use periodic small-scale refresh sessions rather than continuous opaque optimization, which preserves the teachable character of the method.

Integration with email clients or browsers is also feasible. Rather than full automation, a client could present the indicator checklist as an interactive overlay and compute the score locally; this approach preserves user agency and reduces omission errors. Evidence from large-scale measurements suggests that warning design (e.g., wording clarity, color coding, iconography, button hierarchy) and delivery timing (e.g., before link activation, after page load, at credential entry, during attachment execution) can materially affect user outcomes, which indicates that interface integration deserves explicit evaluation rather than assumption [35,36]. Also, longitudinal retention studies remain essential. Large-scale observational work on phishing awareness shows that behavior can change across extended periods, but the magnitude and stability of change depend on reminder timing (e.g., interval between refresh sessions or post-error prompts) and sustained reinforcement (e.g., repeated simulations, periodic micro-lessons, recurring practice tasks) [39,40,41,42,43,44,45]. A retention design that repeats the classification task after several months, with and without short refresh reminders, would directly test whether the algorithm yields durable skill rather than short-lived compliance.

5. Conclusions

In a controlled within-subject evaluation with 96 participants and 72 stimuli per participant, use of the proposed decision algorithm increased mean classification accuracy from 68.4% to 84.7% and reduced the false-negative rate from 31.9% to 11.3%. The reduction in false negatives represents the largest security relevant improvement observed in the study and appears consistently across participant groups and phishing categories. The false-positive rate increased from 14.6% to 16.2%, which reflects a limited usability cost rather than indiscriminate rejection of legitimate messages. Median decision time increased from 6.2 s to 8.7 s, with no evidence of task abandonment or extreme delay. The observed trade-off therefore reflects greater caution rather than operational breakdown. Residual errors in the algorithm condition arose primarily from incorrect identification of observable indicators rather than from failure of the decision rule itself. When indicator values were correctly assessed, unsafe allow outcomes were rare. This distinction clarifies that future improvement depends more on indicator perception and compliance than on structural modification of the rule set. These findings demonstrate that a deterministic indicator-based decision algorithm can measurably improve phishing avoidance under controlled experimental conditions. The results do not imply protection against all attack classes, particularly highly targeted or context-rich deception. However, the evidence supports the use of explicit human-executable procedures as a complement to automated mail filtering and to intuition-based judgment. Consequently, future work should evaluate long term retention, field deployment under realistic workload constraints, and periodic recalibration of indicator weights in response to dynamic attack patterns.