To build systems shielding users from fraudulent (or phishing) websites, designers need to know which attack strategies work and why. This paper provides the first empirical evidence about which malicious strategies are successful at deceiving general users. The authors first analyzed a large set of captured phishing attacks and developed a set of hypotheses about...