Source-linked AI summary
A Gmail-Based Phishing Detection Prototype for Nigerian Fintech Emails Using Sender Checks and BiLSTM Classification
Gideon Francis Oghie, Uche Emmanuel Unoke
TL;DR
Phishing emails targeting Nigerian fintech users can combine deceptive sender addresses, lookalike links, and familiar language, while content and domain checks address different signals. The paper implements a Gmail extension combining those checks with a BiLSTM classifier; the classifier achieves near-perfect test metrics, but sequence overlap and the absence of labeled end-to-end evaluation limit what can be concluded.
Problem
Nigerian fintech phishing can combine deceptive sender domains, lookalike links, and familiar language, while content classification and domain matching each miss a distinct signal.
Source: §1 · pp. 1–2Method
A Gmail extension combines local sender-profile and URL checks with a BiLSTM classifier that assigns phishing probabilities and displays verdicts.
Source: §1 · p. 2Results
99.99% accuracy, 100.00% precision, 99.98% recall, and 99.99% F1 score were calculated from the BiLSTM test confusion matrix.
Source: §4 · p. 6Takeaways & Limitations
Abstract
from arXiv · showhide
Phishing emails that impersonate Nigerian fintech providers can combine deceptive sender addresses, lookalike links, and locally familiar language. This study presents a Gmail browser extension that integrates sender-domain and URL checks with a bidirectional long short-term memory (BiLSTM) classifier. The extension compares visible sender addresses and links with profiles for eight fintech platforms, obtains a phishing probability from a locally hosted Flask service, and displays a legitimate, warning, or phishing verdict when an email is opened. The BiLSTM classifier was evaluated on 8,943 test messages from a cleaned dataset of 59,622 phishing and legitimate emails. The test confusion matrix recorded 4,308 true negatives, no false positives, one false negative, and 4,634 true positives. These counts correspond to 99.99% accuracy, 100.00% precision, 99.98% recall, and 99.99% F1 score. Tokenized sequence analysis identified 5.79% overlap between the training and test sets, which may inflate performance estimates for independent messages. A Gmail demonstration showed the integrated extension producing user-visible verdicts, although the complete system was not evaluated on a labeled test set. The findings establish the feasibility of the implemented prototype while leaving its end-to-end detection performance and generalization to unseen attacks open for further evaluation.
1. Introduction
Nigerian fintech phishing can combine deceptive sender domains, lookalike links, and familiar language, while text and domain checks each leave signals unaddressed. This study implements a Gmail prototype that combines those checks with a BiLSTM classifier, but its classifier evaluation and browser demonstration support different conclusions.
1. Introduction
- Phishing messages can pair a recognizable fintech brand with a lookalike domain, deceptive link, and locally familiar language.Text classification cannot verify known-provider identity, and domain matching cannot assess message language; combining the signals raises the question of how to handle disagreement.Source: §1 · pp. 1–2
- Prior phishing and LSTM methods offer useful techniques, but their reported performance does not establish behavior on emails impersonating Nigerian fintech providers.Results depend on the messages and evaluation procedures used.Source: §1 · p. 2
- The prototype combines sender and URL checks with BiLSTM text classification to issue Gmail verdicts, while the classifier test and system demonstration answer different evaluation questions.The extension checks locally stored profiles for eight platforms; end-to-end performance remains to be established.Source: §1 · p. 2
- The classifier was tested and the extension demonstrated in Gmail, but token overlap between training and test data qualifies interpretation of the classifier result.The introduction leaves independent end-to-end evaluation to future work.Source: §1 · p. 2
2. Related Work
Prior work has used deceptive-email features, sequence models, and combinations of textual and other signals for phishing detection. This study places related approaches in an implemented Gmail workflow for Nigerian fintech impersonation, while distinguishing its evaluation from a direct performance comparison.
2. Related Work
- Fette et al. used deceptive-email features, while later work applied LSTM networks and NLP with graph convolution to phishing-message classification.These studies support text classification as one detector component, with sender identity and link destinations addressed through other signals.Source: §2 · pp. 2–3
- HELFHED combines textual and content-based email features, and Adeyemo et al. combine email text and URL features.Their architectures and evaluation datasets differ, so their reported performance is not a direct baseline for this study.Source: §2 · p. 3
- DMARC checks alignment between the visible author domain and an SPF- or DKIM-authenticated identifier, unlike this study’s local sender-profile comparison.The local comparison contributes to detection but does not authenticate the sender.Source: §2 · p. 3
- The Gmail workflow integrates BiLSTM classification with fintech-specific sender profiles, URL checks, and user-visible verdicts, but does not establish an advantage over reviewed systems.The study evaluates the classifier and demonstrates the extension rather than measuring each component’s separate contribution.Source: §2 · p. 3
3. Methodology and System Design Data preparation
The dataset combines public samples, legitimate Nigerian fintech emails, and constructed phishing examples, then applies cleaning and stratified splitting to form training, validation, and test sets.
Data preparation
- The corpus combined public samples, legitimate Nigerian fintech emails, and locally constructed phishing examples representing impersonation, lookalike domains, and Nigerian English and Pidgin.Approximately 1,000 phishing examples were created before cleaning, but their final number cannot be determined because source labels were not retained throughout preprocessing.Source: §3 · p. 3
- The cleaned dataset contains 59,622 emails: 30,929 phishing and 28,693 legitimate, split into 41,736 training, 8,943 validation, and 8,943 test messages.The initial 66,032 records were redacted, stripped of HTML, deduplicated by content hash, and restricted to English and Nigerian Pidgin.Source: §3 · p. 3
Text classification model
The text classifier maps tokenized email sequences through an embedding layer and two BiLSTM layers to a phishing probability. The paper identifies the architecture as a BiLSTM model for email-text classification.
Text classification model
- The BiLSTM architecture classifies email text, using a 10,000-term vocabulary, sequences capped at 500 tokens, 100-dimensional GloVe embeddings, and layers with 128 and 64 units.A sigmoid output produces a phishing probability between zero and one.Source: Text classification model · p. 4, Figure 1 · p. 4
- Training used binary cross-entropy and Adam at a 0.001 learning rate, with batches of 64 for up to 20 epochs.Dropout was 0.3, recurrent dropout 0.2, and early stopping followed three epochs without validation-loss improvement.Source: Text classification model · p. 4
Browser extension and decision rules
The Gmail extension runs sender and link checks in the browser while using a local inference service for BiLSTM text classification. Decision rules combine these signals into a displayed verdict.
Browser extension and decision rules
- The Chrome extension detects an opened Gmail message, extracts its sender, subject, body, and links, and sends email text to a local Flask service for a BiLSTM probability.Figure 2 describes the extension and local inference service architecture.Source: Browser extension and decision rules · p. 4, Figure 2 · p. 5
- A local database holds sender profiles for eight named Nigerian fintech platforms; exact domain matches are VERIFIED, while domains within edit distance two are SUSPICIOUS.Links are also checked for lookalike domains and Unicode homoglyphs.Source: Browser extension and decision rules · p. 5
- The decision workflow combines sender status, link risk, and model probability to produce LEGITIMATE, WARNING, or PHISHING verdicts.Figure 3 identifies the combined checks and BiLSTM score as inputs to the verdict.Source: Figure 3 · p. 5, Browser extension and decision rules · p. 6
- A matched sender with safe links receives LEGITIMATE regardless of model score, while suspicious-link and unverified-sender cases use specified score thresholds or receive WARNING.A suspicious sender with a score above 0.7, or an unverified sender above 0.8, receives PHISHING; an unverified sender with a score from 0.6 to 0.8 also receives PHISHING when a suspicious link is present.Source: Browser extension and decision rules · p. 6
Evaluation
The held-out test split assessed the BiLSTM classifier, while selected Gmail messages were used to exercise the integrated extension. The demonstration did not measure full-system accuracy.
Evaluation
- The held-out test split was assessed using a confusion matrix, accuracy, precision, recall, and F1 score for the BiLSTM classifier.The passage distinguishes these test-set metrics from the extension demonstration.Source: Evaluation · p. 6
- Selected Gmail messages were used to inspect extraction, rule checks, local inference, and verdict display, without a labelled sample count or measured full-system accuracy.The reported test-set metrics apply to the classifier, not the combined extension.Source: Evaluation · p. 6
- The Gmail exercise therefore demonstrates component operation, not measured detection performance for the complete decision system.No labelled evaluation of the combined extension is reported in this passage.Source: Evaluation · p. 6
4. Results and Discussion
The BiLSTM achieved near-perfect metrics on its held-out test split, but overlap between data splits qualifies the result. A Gmail demonstration showed integrated operation without measuring full-system detection performance.
4. Results and Discussion
- 99.99% accuracy, 100.00% precision, 99.98% recall, and 99.99% F1 score were calculated from the confusion-matrix counts for the 8,943-message BiLSTM test split.The cleaned dataset contained 59,622 emails: 30,929 phishing and 28,693 legitimate messages.Source: §4 · p. 6
- 5.79% of tokenized sequences overlapped between the training and test splits, so the near-perfect result reflects these dataset conditions rather than fully independent incoming mail.The overlap check also found 5.62% overlap between training and validation and 1.46% between validation and test.Source: §4 · p. 6
- The Gmail demonstration showed extraction, local inference, and all three displayed verdict types, but retained no labelled case count or full-system confusion matrix.Manual checks identified lookalike sender and link domains using spelling changes and visually similar characters.Source: §4 · p. 7, Figure 4 · p. 7
- A visible-domain match with links classified as safe yields LEGITIMATE regardless of model score, potentially suppressing a warning for a forged visible sender address.The classifier metrics do not measure this fusion-rule risk or the final user-visible verdict.Source: §4 · p. 7
5. Limitations
Dataset overlap, lost source labels, and the absence of labelled full-system evaluation constrain the performance claims. Sender checks do not authenticate email, and local inference depends on a running service.
5. Limitations
- Overlapping tokenized sequences across data splits may cause test results to overestimate performance on unfamiliar emails.The passage recommends removing overlapping sequences before splitting the data.Source: §5 · pp. 7–8
- Lost source labels prevent determining how many locally constructed phishing examples remained or reporting their performance separately; available records also do not support separate evaluation of Nigerian Pidgin messages.The proposed further evaluation would retain source and language labels.Source: §5 · pp. 7–8
- The integrated extension was not tested against a counted, labelled message set, leaving the sender rules’ effects on false positives and missed phishing unknown.The reported classification metrics describe the BiLSTM alone.Source: §5 · p. 8
- Sender checks use Gmail’s visible address and a local domain list rather than SPF, DKIM, or DMARC authentication; a matching address with safe links overrides the model score.The local inference service must also be running for the extension to obtain a classification.Source: §5 · p. 8
- The proposed next evaluation would test the complete extension on independently collected, labelled emails and measure fusion-rule effects on detection.It would also enable separate reporting for Nigerian Pidgin messages.Source: §5 · p. 8
6. Conclusion
The BiLSTM classifier produced one false negative and no false positives on 8,943 test emails, while the extension demonstrated message extraction, local predictions, and Gmail verdicts. These results do not establish the complete extension’s detection performance.
6. Conclusion
- On 8,943 test emails, the classifier produced one false negative and no false positives.The extension’s Gmail demonstration is separate from this classifier evaluation.Source: §6 · p. 8
- The extension demonstrated message extraction, local model predictions, and verdict display in Gmail.Source: §6 · p. 8
- Classifier results do not establish the complete extension’s detection performance.Sequence overlap, no labeled evaluation of final verdicts, and reliance on visible sender addresses limit conclusions.Source: §6 · p. 8