Abstract

Phishing email is one of the most common entry points for a cyberattack, and it works by manipulating the reader rather than exploiting software. Transformer models classify such text well, but fine-tuning a full-size BERT model usually needs hardware that small research groups do not have. This paper describes a reproducible, low-resource pipeline for phishing email detection built on a fine-tuned DistilBERT classifier, placing that model between a cheap classical baseline and a full BERT-base teacher with proper statistical validation. On a near-duplicate-cleaned test set of 2,495 emails, averaged over five seeds, DistilBERT reached 98.6% ± 0.2% accuracy and a phishing-class F1 of 0.980 ± 0.002, training in about three minutes on one NVIDIA T4 GPU. A McNemar test shows that DistilBERT is basically the same as a BERT-base model while training about half as long, and it is also substantially superior to a TF-IDF plus logistic regression baseline. We also tested cross-dataset generalization: a model trained on our data only gets 0.84 F1 on a different public dataset, with precision dropping from 0.98 to 0.74, while a model trained on a larger dataset performs equally well on another set of data.