*3.3. Experiment Procedure*

On arriving for the experiment, the participant was seated in a regular office in front of a 24 computer monitor that displayed the experiment environment. The monitor was equipped with a Gazepoint GP3 HD eye tracker (https://www.gazept.com/product/gp3 hd/) (accessed on 6 March 2022). The participant was asked to read the informed consent form and given the opportunity to ask questions about the experiment and study before signing it. The participant was then asked to respond to a survey with demographic questions and asked to take a seat in front of the monitor. The eye tracker was calibrated using the manufacturer's built-in calibration sequence with nine points [45]. The calibration was considered successful when the control software deemed all nine points valid. In cases where the eye tracker could not be successfully calibrated, eye-tracking data were disregarded for that participant. This happened for three participants.

The participant was then reminded of Jenny's persona and asked to classify the email in Jenny's inbox. The participant was instructed to delete all phishing emails and keep all legitimate emails. The participant was asked to think aloud during the experiment, especially about how decisions to delete emails were made. The participant was also told that at least one of the emails was phishing and that a score was to be calculated based on the participants' performance. The intent was to make the participant as aware

of phishing as possible. The rationale was that mere inclusion in the experiment would increase the participant's awareness level, and by priming all participants to high awareness would make the awareness levels of the participants comparable. Consequently, the gathered data reflects the participants' best ability to delete phishing rather than the ability they can be assumed to have during their daily work. Gazepoint analysis UX Edition (https://www.gazept.com/product/gazepoint-analysis-ux-edition-software/) (accessed on 6 March 2022) was used to monitor the participant's performance in real time on an adjacent screen and for post-experiment analysis of the collected eye-tracking data. Following the experiment, the participants in the game group were asked if they had played the game before the experiment as instructed. The experiment process, from the participant's point of view, is visualized in Figure 4.

**Figure 4.** Visualization of experiment procedure. Dashed boxes only applied to some groups.
