Abstract:

Online scams represent a growing global problem, inflicting significant financial and psychological harm on victims across all ages. Despite the prevalence of these sociotechnical attacks, cybersecurity curricula often underemphasize the social dimensions of these attacks, leaving students unfamiliar with the human elements of real-world cybersecurity threats. Developing a cybersecurity workforce that understand both the technical and psychological mechanisms of scams is therefore a pressing educational need within the cybersecurity domain. To address this gap, we developed and iteratively refined an AI-based role-playing simulation in which undergraduate students take on the role of a scammer while ChatGPT acts as the target. This adversarial exercise provides hands-on experience with the social influence tactics that underlie online scams. In this paper, we describe the evolution and design of the simulation prompts, present our strategies for scenario development, and share lessons learned to help other cybersecurity educators create similar exercises. The resulting prompts are easy to use and readily adaptable. We argue that this approach offers a safe, controlled environment in which students can develop an adversarial mindset which is a crucial perspective when designing system defenses. We also discuss student perceptions of inhabiting the attacker's perspective, offering insights into both the pedagogical value and ethical considerations of this type of experiential learning.

Keywords:

Simulation, cybersecurity, education, AI.