A Case Study on the Use of Gamification to Increase Phishing Awareness Among Swedish Citizens

Sammanfattning

Phishing is one of the most prevalent forms of cybercrime and continues to pose a growing threat as digital devices and services become more widespread and cyberattacks become increasingly sophisticated. Although organizations often address phishing risks through structured training among their employees, similar educational efforts aimed at the public are less common. This creates a gap in cyberthreat awareness and digital resilience. The purpose of this thesis is to investigate how phishing awareness can be strengthened among Swedish citizens by evaluating the feasibility and perceived usability of a game-based educational solution. A comparative study was conducted with 29 participants divided into two groups, who completed a pre-test and a post-test to measure phishing detection performance in terms of accuracy and recall. User perceptions were also collected through a survey with Likert-scale items and open-ended questions. The results show that participants who used the game-based method demonstrated a higher development of recall across all age categories, with the strongest effect observed among participants aged 18-29. The gamebased approach was also associated with higher engagement, motivation, and perceived learning. However, the text-based method was still perceived as more time-efficient. In conclusion, the findings suggest that the developed prototype can serve as an alternative to existing phishing awareness initiatives. However, further development of the game design are required to improve usability and achieve greater acceptance.