A framework for assessment of anti-phishing preparedness

Phishing, a serious online identity fraud, poses a huge threat to the e-commerce community. In order to combat the crime, many companies adopt anti-phishing strategies and organize numerous anti-phishing campaigns aimed at arousing the awareness of customers and offering them comprebensive protection. However, as anti-phishing measures vary from company to company, it is difficult to determine the overall anti-phishing preparedness of a firm. In this paper, a framework to assess anti-phishing preparedness of a company from the perspective of a general end-user of electronic service is proposed. By analyzing the security information available from the official Web sites, we evaluate the anti-phishing preparedness from the viewpoints of accessibility, usability, and information content. Using the proposed framework, an experiment is conducted to assess the anti-phishing preparedness of banks in Singapore.