PHISHING EMAIL DETECTION USING A PAKISTAN SPECIFIC DATASET: REVISITING AN SVM BASELINE AND THE CASE FOR DATA CENTRIC AI SAFETY

Abstract

Phishing continues to be one of the most reported categories of cybercrime worldwide, with email remaining its dominant delivery channel. A structural but rarely examined feature of the phishing-detection literature is that nearly all widely used benchmark datasets, Enron, Nazario, Spam Assassin, and their derivatives are collected from North American and European sources. This creates an open and largely untested question: how representative are these corpora of phishing threats encountered in other regions, and what happens to detection systems built without regional data in view. This paper revisits an original, manually labeled phishing email corpus of 1,630 messages collected specifically from users in Pakistan over approximately eighteen months, and evaluates a linear kernel Support Vector Machine (SVM) with Bag-of-Words (BoW) feature extraction on this data, achieving 96% classification accuracy (macro-F1 = 0.95). We situate this result against the current generation of deep learning and transformer based phishing detectors, most of which report only marginal accuracy improvements over classical baselines while de-pending on substantially larger, Western sourced training corpora and far greater computational resources. Drawing on this comparison, we argue that dataset representativeness, not model architecture is a consequential and under addressed constraint on equitable, safe AI deployment in security relevant domains. We present the dataset’s construction methodology, a full experimental evaluation, an honest accounting of the study’s limitations, and a discussion of what data centric AI safety concretely requires in regional and resource constrained settings.