A Gmail-Based Phishing Detection Prototype for Nigerian Fintech Emails Using Sender Checks and BiLSTM Classification
A Gmail extension prototype detects Nigerian fintech phishing with sender checks and a BiLSTM classifier.
Researchers describe a Gmail browser extension that checks sender domains and URLs for eight Nigerian fintech platforms and scores messages with a locally hosted BiLSTM classifier. On 8,943 test emails from a cleaned set of 59,622 messages, they report 4,308 true negatives, no false positives, one false negative, and 4,634 true positives, or 99.99% accuracy and F1. They note 5.79% token overlap between train and test sets, and say the full extension was demonstrated but not evaluated end to end on a labeled set.
- Extension compares senders and links against profiles for eight fintech platforms.
- BiLSTM scored 99.99% accuracy on 8,943 messages, with one false negative.
- A 5.79% training-test token overlap may inflate reported performance.
- The Gmail demo was not evaluated on a labeled end-to-end test set.
Full article193 words · extracted from arxiv.org · click to collapse
Phishing emails that impersonate Nigerian fintech providers can combine deceptive sender addresses, lookalike links, and locally familiar language. This study presents a Gmail browser extension that integrates sender-domain and URL checks with a bidirectional long short-term memory (BiLSTM) classifier. The extension compares visible sender addresses and links with profiles for eight fintech platforms, obtains a phishing probability from a locally hosted Flask service, and displays a legitimate, warning, or phishing verdict when an email is opened. The BiLSTM classifier was evaluated on 8,943 test messages from a cleaned dataset of 59,622 phishing and legitimate emails. The test confusion matrix recorded 4,308 true negatives, no false positives, one false negative, and 4,634 true positives. These counts correspond to 99.99% accuracy, 100.00% precision, 99.98% recall, and 99.99% F1 score. Tokenized sequence analysis identified 5.79% overlap between the training and test sets, which may inflate performance estimates for independent messages. A Gmail demonstration showed the integrated extension producing user-visible verdicts, although the complete system was not evaluated on a labeled test set. The findings establish the feasibility of the implemented prototype while leaving its end-to-end detection performance and generalization to unseen attacks open for further evaluation.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.28305