Lessons Learnt from Using Educational Phishing Materials with UK Primary School Children

Research suggests that over a quarter of children aged 11–15 years old have already been a victim of a phishing attack. However, this threat has received limited attention in cybersecurity education aimed at children. Within this topic area this paper reports on the use of CyberSprinters UK government resources to educate school children. To understand the effectiveness of these resources we conducted an action research project with a class of 10–12 years old children. We discuss the experience of delivering the phishing lesson and examine the activities conducted with the children. Our results provide insight into children’s ability to identify typical features of phishing emails, messages, and phone calls. The lessons learnt suggest areas around incorporating children’s voice, cultivating teacher confidence, and engaging parents which could further enhance education.