Investigation of Phishing Attack Awareness Among Employees of Selected Government Ministries in Abuja, FCT

Government ministries are high-value targets for phishing attacks seeking access to sensitive policy and citizen data, and the awareness level of civil servants in Nigeria's Federal Capital Territory about this threat vector requires empirical documentation. This study investigated the level of phishing attack awareness among civil servants in three Federal Government ministries in Abuja, Federal Capital Territory. A descriptive survey design was employed, with questionnaires administered to 240 civil servants across middle and senior cadre levels. A phishing awareness assessment covered recognition of suspicious sender addresses, malicious links, urgent requests, deceptive attachments, and reporting procedures. A phishing simulation was also conducted on 60 consenting participants. Survey results showed a mean phishing awareness score of 58.7 out of 100. Recognition of spear phishing (targeted impersonation) was the lowest-scoring item (mean 41.3). The phishing simulation revealed that 34.0 percent of participants clicked a simulated malicious link. Awareness levels did not differ significantly by cadre level, suggesting that seniority does not confer security awareness. Only 22.5 percent had received phishing-specific security training in the preceding year. The study concludes that phishing awareness among Abuja civil servants is moderate but inadequate for protecting sensitive government data. Recommendations include mandatory annual phishing awareness training for all civil servants, government email security filtering upgrades, and a mandatory incident reporting protocol for suspected phishing attempts in all federal ministries.

Keywords: phishing awareness, civil servants, government ministries, Abuja, email security