A Hybrid Transformer and Rule-Based Linguistic Framework for Phishing Detection and Manipulation Tactics Identification

Abstract

Phishing attacks exploit linguistic manipulation, including urgency, authority signalling, impersonation, and persuasive framing, across email and SMS. This manuscript describes a two-stage framework coupling transformer-based binary classification with a rule-based Linguistic Manipulation Detection Tool (LMDT) that returns tactic spans and a configurable Linguistic Manipulation Score (LMS). Before splitting, the 2,000-message cross-channel corpus is grouped by near-duplicate and template similarity so that no shared-template family crosses the train/validation/test boundary; on the resulting test set (n=300), fine-tuned BERT reaches the highest classification performance (macro F1 97.67%), significantly ahead of a Random Forest baseline and of RoBERTa (Holm-adjusted exact McNemar, p=0.021 and p=0.039), while the deployed hybrid pipeline continues to gate the LMDT stage on RoBERTa (macro F1 94.99%, 95% CI [92.32, 97.33]), the backbone specified before the BERT comparison was run; replacing it with BERT is the first item of future work. The LMDT is evaluated against a 120-message stratified subsample of the frozen test set, independently labelled by two human annotators with disagreements resolved by adjudication (Cohen kappa reported per tactic, Appendix B): on this ground truth the original rule set outperforms a proposed refinement to the authority and impersonation detectors, which eliminates their false positives on legitimate messages but also eliminates their recall, so the original rules are retained in the deployed system. Per-message predictions, 95% bootstrap confidence intervals, and exact McNemar tests with Holm correction are reported for every classifier comparison. The LMS is reported only as a descriptive aggregation of the four detected tactics: with no independently rated severity outcome available, its weights remain unvalidated design choices rather than an evidenced risk score.