## 2 Background and Related Work
### Educational Mobile Games  
Anti-phishing protection has great difficulty capturing the attention of end-users. Notes, videos, and email bulletins are all common resources that users use to address and educate users about phishing assaults. Their application, on the other hand, has had a negligible influence on user engagement, information retention, and habit change [20]. Educational games, on the other hand, have been shown to be useful techniques to teach a variety of cybersecurity topics, including safe and secure online habits, threats and assaults, malware, and other cybersecurity issues [25]. Mobile games have been viewed as effective training and a tool for persuading players to change their habits [21]. However, games only provide learners with interactive opportunities if certain aspects are included, such as user requirements and needs [38]. As a result, more research should be focused on the evolution of educational games in the supply of cybersecurity education, particularly anti-phishing awareness. Other tools, training programs, and procedures have also been found to be less effective in influencing user behavior and logical thinking than games [39]. Several educational games have already been developed; for example, [PERSON] [19] created a game to assess children's digital literacy with respect to their online password habits. The game was designed to assess literacy in children aged 11 to 13. The results showed that the knowledge and behavior of the children changed immediately after playing the game and a week later. However, the design relied on procedural rhetoric and did not employ other mechanisms and principles, such as refection and conceptual principles. Additionally, when evaluating the completion of the task by the players, the game does not include time, which can lead to a learning process that is not exciting for the players. The work of [PERSON] et al. [22] presents a 2D game to teach students about phishing. The game improved the knowledge of the participants from 20% to 80% from the pre-test and post-test. However, the game involves only one phishing parameter, while several parameters are used to initiate these attacks. Additionally, players do not receive immediate feedback based on their actions and the reasons for failure during gameplay. This may cause players not to be attentive and forget and repeat their unusual behaviors, causing them to fall for phishing attacks continuously. [PERSON] et al. [20] introduced anti-phishing training using a role-playing phishing simulation game to teach people how to defend themselves from phishing. The game has been effective in helping to improve the knowledge of participants compared to other training tools. However, it addresses only a single phishing parameter. Furthermore, it relies only on the use of email rules, while these rules are subject to change based on new tricks introduced every day by attackers to deceive users. In addition, the content of the game requires the player to read more, making it boring and tiresome. Instead, some graphics and animated objects may be used to increase user engagement and make the game fun. The work also limited the scope of participants to professionals, while those who do not have computer skills remained understudied. [PERSON] et al. [23] present a board game that teaches about online phishing scams. The results show that the game improved the knowledge and awareness of the participants and was engaging and fun. However, the game component for reward and punishment involves police, whereby it is biased and causes feelings of inferiority in some groups of participants such as children since most people hesitate to go to jail or visit a police station; hence, players will not be flexible and free to play the game. Moreover, some featuresrequire players to visit an online link to receive some instructions, which may lead them to incur some cost.