Shahrivari et al. [24] examined 12 classifiers on a phishing website dataset comprising 6157 authentic websites and 4898 fraudulent websites. The classifiers investigated include Logistic Regression, Decision Tree, Support Vector Machine, AdaBoost, Random Forest, Neural Networks, K-Nearest Neighbors, Gradient Boosting, and XGBoost. The study finds that integrating multiple classification methods yields higher accuracy results. Tan et al. [25] introduced an approach, PhishWHO, for identifying phishing websites in three phases. Initially, keywords are retrieved from the websites utilizing the N-gram approach. In the second stage, these keywords are used in a web browser to identify the target domain name. Eventually, they used the same technique to verify the website’s legitimacy. Chiew et al. [26] The proposed method can detect whether a web page is a phishing site. Utilize a logo image to evaluate the consistency of identification between a website’s actual and represented identity. The suggested approach includes techniques for logo extraction and identity verification. The logo extraction procedure employs a machine learning technique. The identity verification technique uses Google Image Search to identify the image. Efficacy of experimental results. A graphical element, such as a logo, is more beneficial than a textual element. Harikrishnan et al. [27] used TF-IDF combined with SVD and Non-negative Matrix Factorization (NMF) representations, followed by machine learning, to categorize emails as authentic or phishing. The study concluded that decision trees and random forests achieved the highest training accuracy. We have summarized the reviewed studies in Table 4.

Studies [24–27] show that machine learning approaches can achieve high accuracy, while this high performance comes at the cost of more sophisticated techniques. Usually, these models learn threat patterns over time. The model identifies patterns in order to detect attacks. Making a model depend on a single feature to detect an attack can easily be countered. To identify fake logos in brand names, the research study [24] uses an XGBoost model with 98.3% accuracy. The cycle continues: researchers develop their tools while attackers find ways to circumvent them. Moreover, the cycle continues indefinitely without achieving lasting protection.

Deep learning and machine learning can learn structures and patterns from raw data and assist in detection. According to that pattern, a study by Kumar et al. [28] showed that both methods are capable of identifying intricate patterns. The main focus of the study is on using convolutional layers to detect patterns and identify links between the related content of data, enabling the model to achieve greater autonomy and efficiency on the training dataset. Sharmin et al. [29] compare CNNs to other machine learning methods. They used CNNs with a novel feature set that integrates the raw picture and Canny edges to improve earlier studies. The Support Vector Machine (SVM), Multilayer Perceptron (MLP), and CNN models outperformed conventional machine learning models with an accuracy of 99.02%. In Zavrak and Yilmaz [30], the authors’ main contribution is the integration of a convolutional layer into a deep learning model to identify the most relevant components of email content for phishing. Stratification enables the model to identify patterns in the data. Their technique obtained an overall accuracy score of 0.9926. They also investigated image fraud using convolutional neural networks to compare suspicious images with the original reference image and detect potential fraud. Sharmin et al. [29] proposed a CNN model that works with SVM and MLP. Their methodology led to a high accuracy of 99.02%. Their study compares the outcomes of CNNs with those of alternative machine learning methodologies; their findings yield raw images with novel features. Ansari et al. [31] studied how well employees can spot phishing emails. They used AI-based training to test and improve employees’ ability to detect phishing and strengthen security. This training utilizes AI to demonstrate how to identify phishing attempts effectively. Using AIs is an effective tool to mitigate cyberattacks. The authors Eze and Shamir [32] studied AI’s ability to generate phishing emails that effectively deceive individuals. They used DeepAI to generate 865 emails containing only text. The tools, such as MALLET, Universal Data Analysis of Text (UDAT) tool, were used to recognize phrases that detect phishing patterns and to identify phishing tactics. They used the CoreNLP library with a deep neural network and Long Short-Term Memory (LSTM) to enhance the detection of phishing. Furthermore, Md et al. [33] employed a Dynamic Phishing Safeguard System (DPSS) to detect phishing emails using two main components, Anti-Phishing Neural Algorithm (APNA) and the Anti-Phishing Boosting Algorithm (APBA), to identify suspicious IP addresses, protecting user privacy through safe and timely phishing detection. The APNA results achieved 97.82% and 97.10% accuracy, respectively. In the case of Zaimi et al. [34], a two-dimensional CNN architecture is also used to detect fraudulent webpages. Their methodology consisted of three main approaches: first, analyze the text in URLs; second, extract useful features from the text; third, use third party services to detect phishing websites. They focused on using CNN models for user protection. Their results show that 1D CNN performs better for phishing detection (96.76% accuracy), while 2D CNN is more suitable for image tasks. We have summarized the reviewed studies in Table 5.

These results may seem impressive and have achieved a great deal in exposing traditional phishing, except that they present a dilemma due to their potential for real-world application. If we looked closely at studies that use the same CNN model, we found that [29] reported 99.2% accuracy on the Enron dataset, which is an email dataset. In comparison, the study [30] achieved 99.02% accuracy in image-based phishing detection on the ISH dataset. Even though CNN can detect phishing easily, it yet lacks the robustness for crafted, designed phishing emails, and that is a gap in most studies [28–34] that lack testing their models against adversarial attacks.

The authors here, Bountakas and Xenakis [35], proposed HELPED, a phishing email detection method. It analyzes linguistic characteristics of emails to enhance detection accuracy. It combines two ways: ensemble learning and hybrid attributes to improve detection. To process the hybrid features separately. They proposed two approaches for HELPED: first, an ensemble learning approach, and second, a soft voting ensemble. In each approach, they used different Machine Learning algorithms. Combining the two methods, the soft voting ensemble gives better detection results than a single-feature focus. using only content-based or text-based features. The result also shows that using the Soft Voting Ensemble method on the imbalanced email dataset achieves an F1-score of 0.9942, surpassing those of traditional machine learning and deep learning models. Additionally, Alhogail and Alsabih [36] combined deep learning, graph convolutional networks (GCNs), and natural language processing to enhance detection accuracy; they achieved 98.2% accuracy. We have summarized the reviewed studies in Table 6.

In these two studies, the main constraint is that they focus solely on combining features, even though both use ensemble learning, which requires training multiple models. In the first study [35], the combination leads to a high computational cost of hybrid methods, while the second study [36] does not justify this cost. We notice that neither study shows that the high computational cost was worth it; neither explains further practical or functional challenges.

In phishing, attackers aim to exploit human weaknesses by tricking them into trusting something unauthentic. That is what Heiding et al. [37] studied in their paper. They tested the two models’ ability to trick human participants. They used the two models to generate nearly 112 emails, which they presented to volunteers. The criterion was the number of clicks on the links in the emails. The GPT-generated emails had success rates of 30%–44%, while V-Triad emails achieved success rates of 69%–79%. Beyond that, they tested the model: both methods combined achieved success rates ranging from 43%–81%. Additionally, models GPT, Claude, PaLM, and LLaMA were used to detect phishing email intentions, as well as their ability to detect phishing from non-harmful emails. The results showed that LLMs outperformed human participants, especially in detecting subtle phishing attempts. Kulkarni et al. [38] developed PhishOracle to test how well detection systems resist attacks, which add fake and harmful web pages to legitimate ones. They used the Stack model and Phishpedia to estimate the Gemini Pro Vision performance. They put it to the test by calling for 52 participants to test whether users could recognize fake brand logos on PhishOracle-generated websites. Their results demonstrated humans can easily be deceived, while the LLM Gemini Pro showed stronger resistance to these attacks. Hua et al. [39] Phishing attackers usually aim to exploit vulnerabilities by impersonating trusted entities; this study covers both text and visual elements using ChatGPT-4 and Gemini to detect them. ChatGPT-4 shows lower recall, and also has a hard time detecting more sophisticated phishing emails with hidden malicious links. Overall, it achieved high accuracy without generating false positives. Koide et al. [40] aim to investigate how LLM contextual understanding can improve the detection of different phishing techniques. They proposed a system called ChatSpamDetector that converts email content into organized prompts. They used GPT-4 as their LLM model. Their system achieved 99.70% accuracy. Additionally, Lee et al. [41] proposed a two-stage approach to phishing detection: first, analyze the original web pages and their features, such as logos, visual themes, and brand-related elements. The second stage here is the URL classification to determine whether this web page is legitimate or malicious. Using the GPT and Claude 3 models, the results show similar precision and recall; meanwhile, Gemini performed worse, with a drop of more than 15%. The examination involved modified logos and HTML content; GPT and Claude 3 maintained strong detection performance. Furthermore, Jamal and Wimmer [42] achieved satisfactory results on both balanced and imbalanced datasets; they proposed the IPSDM, a fine-tuned transformer-based model for phishing detection, based on BERT. The IPSDM model achieved 97.50% validation accuracy and 97.10% test accuracy. Their approach improves pre-trained DistilBERT and RoBERTa models. In Mittal et al. [43], a framework based on machine learning called DARTH, their method model handles single-phishing features, and evaluation is done separately using natural language processing and neural network techniques. Their examination shows high performance in detection with an F-score of 99.98%, trained on 150,000 emails. A summary of the reviewed LLM-based approaches is presented in Table 7.

In related studies we reviewed, we noticed that cloud-based commercial models such as GPT-4, Gemini, and Claude were the fundamental concern. However, locally implemented models are more appropriate for applications that care about privacy, such as LLaMA and Mistral. Allowing models to train in a decentralized way, with fine-tuning and running on-premises. The model can adjust and operate locally, which eliminates the need to send sensitive email or URL data to external servers. The method supports a decentralized approach and could be combined with federated learning to allow collaborative training without sharing raw data. Future research should focus on integrating the local LLM deployment with federated learning for phishing detection, especially in high-value data sectors such as healthcare and finance.

Korkmaz et al. [44] found that Federated Learning (FL) is a form of Distributed machine learning, first introduced by Google, to support collaborative, decentralized, and multi-device model training. The most important difference from centralization is that a server trains the model for security, rather than each individual device training it. Each device can train its own model at home using its own data, and the model does not have to expose data it doesn’t need to other devices. The benefits of FL include improved performance, increased scalability, cost savings, and faster development time. Applications of federated learning span many fields, including healthcare [45–47], industrial cyber-physical systems [48], IoT anomaly detection [49], cybersecurity [50], and privacy-preserving systems [51]. As noted by Guo et al. [52], FL generally operates in an environment with multiple users or participants; therefore, a coordinator is sometimes needed to compile the insights gathered from users. This is also one reason why FL is attractive, as it can mitigate privacy issues because users’ private data is never shared when training is centralized [53]. Zeng et al. [54] reported that when using FL, the centralized global model can be created on a server and distributed to clients for local training.

As summarized in Table 8, the federated learning studies [55,56] represent a promising direction for privacy-preserving phishing detection, directly addressing the regulatory and ethical concerns raised by centralized data collection. However, only three studies focus on phishing detection, leaving the field underdeveloped. Study [57] demonstrates that FL achieves comparable accuracy to centralized while keeping email data distributed across clients. Study [55] stated that achieving protection through best practices is better than traditional centralized detection methods. Research in this field, aimed at protecting user privacy, investigated federated learning (FL). Study [56] used an SMS dataset to detect phishing attacks, with the training process kept locally on users’ devices using a federated learning (FL) approach. The study describes this as a solution for protecting user privacy. Their examination achived 95.02% accuracy. Maintaining the data trained on a single local server creates serious privacy risks because it requires sharing sensitive communications for model training. Earlier studies demonstrated that federated learning is a privacy-preserving alternative that enables collaborative detection without sharing raw data, thereby preserving detection accuracy, which we observed varying from minimal reductions [56,57] to more noticeable decreases [55].

Nofer et al. [58] first introduced blockchain for digital currency, such as Bitcoin, using a distributed ledger system. They also highlighted its potential for use in other applications. Swan [59] blockchain can operate across public and private environments, making it suitable for use across fields and sectors. Additionally, Esmaili and Christensen [60] clarify that public ledgers are open to all participants without restrictions. In contrast, Azaria et al. [61] explain that a private blockchain is restricted to only certain users who meet specific conditions and are authenticated and allowed to participate. Islam et al. [62] define Blockchain as a distributed ledger containing multiple blocks that hold information, where each block is linked to the previous one to maintain a historical record. Additionally, Zheng et al. [63] noted that each block has a pointer to the preceding block, using a link that is merely a hash of that block. Fig. 5 below clarifies the application of Blockchain in security.

Scicchitano et al. [64] propose an anomaly detection system that uses an encoder-decoder deep learning model trained on aggregated data from tracking blockchain incidents. The results demonstrate the model’s effectiveness in detecting publicly disclosed attacks.

Ashfaq et al. [65] blockchain technology using XGBoost and Random Forest (RF) to detect fraudulent transactions. inonther study.

Yan et al. [66] ropose ADA-Spear-an automatic phishing detection model utilizing adversarial domain adaptive learning which symbolizes the method’s ability to penetrate various heterogeneous blockchains for phishing detection. Du et al. [67] Designed DeepPhishDetect, which used deep learning with blockchain to detect fraudulent nodes in blockchain networks. Their novel approach, DMFD, for node feature learning, and GAT for label dependency modeling

Nouman et al. [68] used a Histogram-based Gradient Boosting (HGB) classifier to detect the malicious node; they proposed this approach using a blockchain-based method. Their approach resulted in speed detection. Saveetha and Maragatham [69] integrated both deep learning and blockchain to detect network intrusion. Their experiment led to high accuracy and enabled the detection of security threats. Furthermore, in a review study, Afaq and Manocha [70] highlighted that combining blockchain and deep learning improves decision-making. In other studies, both technologies were integrated.

In Hamdan et al. [71], the author proposed a solution for fraud detection that can enable risk-free, secure transactions. They propose a Deep Learning-based Blockchain Framework for Fraud Detection using Multilevel Supervision in Hierarchical Generative Hashing. Chen et al. [72] introduces a blockchain-based anti-phishing authentication protocol that enhances the security and efficiency of virtual game recharge orders. The proposed protocol integrates elliptic curve cryptography. Furthermore, Sheng et al. [73] proposed blockchain phishing detection method leveraging a dynamic feature fusion model that combines graph-based representation learning and semantic feature extraction. Varma et al. [74] proposes a novel framework, AI-MCAGCN-B-DIFCS, which integrates a Multi-Component Attention Graph Convolutional Neural Network (MCAGCN) with blockchain technology for secure and precise fraud detection. Darwish et al. [75] explores the integration of lightweight blockchain technology and deep learning for robust fraud detection in financial transactions. Lightweight blockchain ensures transaction immutability. Ref. [76] present an approach for detecting medical insurance fraud utilizing a consortium blockchain and deep learning, capable of identifying suspect medical records through an explainable model. BERT-LE is intended to assess the validity of ICD illness codes.

Zhang et al. [76] present an approach for detecting medical insurance fraud utilizing a consortium blockchain and deep learning, capable of identifying suspect medical records through an explainable model. BERT-LE is intended to assess the validity of ICD illness codes.

Ghnemat and Mosa [77] Decentralized blockchain networks are designed to make it hard to intervene in or alter records; therefore, individuals on the network can send transactions, rendering traditional fraud prevention methods ineffective. Ertam [78] This study shows that using XGBoost, LightGBM, and CatBoost can achieve 95.83%–96.46% accuracy to detect phishing attempts in Ethereum wallets. Shevchuk et al. [79] Due to increased attacks, fraud, and threat complexity, blockchain security is gaining popularity. Machine learning is replacing fundamental protection approaches as the area becomes more sophisticated. Karthika et al. [80] The proposed Phish Block on a private Ethereum blockchain has kept homographic phishing URLs. Liu et al. [81] The first effort to characterize and detect Ethereum phishing gangs was this paper. They examine phishing gang transaction habits from people’s viewpoints. Bayan et al. [82] The evolution of Permissionless blockchains has become the foundation for Web3 applications, as well as decentralized finance (DeFi), resulting in privacy vulnerabilities. Vanna et al. [83] The study highlights the need for an advanced phishing detection hybrid approach to enhance the accuracy Gao et al. [84] Proposed AHGT-DFD is designed to detect phishing in blockchain-based on four categories: Feature, Encoding, Graph, and Continuous Learning there result shows 95.58% F1. Farrukh et al. [85] argued that centralized ML is more efficient than FL but might put privacy at risk. FL-blockchain hybrids reduce false positives.

Blockchain provides transparency and a decentralized ledger, as Refs. [80–84] demonstrate. However, there is no mention of how these studies address the privacy concerns. The Ethereum transaction analysis studies [86–89] focus on cryptocurrency phishing rather than email or web phishing. They rely on public blockchain data, where transaction privacy is already limited. However, these studies do not discuss privacy-preserving analysis methods or consider that fraud detection models might unintentionally reveal sensitive transaction patterns. Study [90] used a permissioned system called a “private Ethereum blockchain”, which is a proposed system that can control access in the network, yet there is no evidence to support their claim. Critically, none of the blockchain studies evaluate privacy implications of their proposed systems, compare privacy properties against centralized or federated alternatives, or implement privacy-enhancing techniques such as zero-knowledge proofs, confidential transactions, or encrypted on-chain data. Main strengths of blockchain technology are its immutability and transparency, which conflict with the privacy concept, and prior studies do not clearly show how to balance transparency and privacy without harming either. In several studies [86–89], the Ethereum transaction data used for phishing detection was collected from publicly available platforms such as Etherscan [91].

A combination of secure technology blockchain and federated learning can offer several solutions that are substantial to immutability and collaboratively train among different local devices. At the same time, blockchain functions as a secure, immutable ledger that documents and authenticates each model update. Together, they provide a remarkable blend of privacy and trust [92,93]. Fig. 6 demonstrates that the generalized blockchain-based federated learning paradigm incorporates blockchain as a decentralized ledger to facilitate model aggregation among distributed clients.

Many recent surveys have studied how these two technologies can function together. Research by Qammar et al. [94] investigated how blockchain can enhance the robustness of federated learning. Fig. 7 illustrates the architecture of FL members’ interaction with the blockchain network via smart contracts and consensus procedures. They noted improvements in model fidelity and in protection against poisoning. Issa et al. [95] examined blockchain-based federated learning for IoT security, and Ali et al. [96] examined blockchain and FL-based intrusion detection for industrial IoT networks. Orabi et al. [97] organized current research through data partitioning to demonstrate how blockchain could enhance the security and knowledge sharing of FL systems. In blockchain-based FL setups, Sameera et al. [98] reviewed differential privacy, homomorphic encryption, and safe multiparty computation.

One of the studies, Ren et al. [99], proposed a system that uses FL with a smart contract to automate model verification. As shown in Fig. 8, the FLCoin framework uses a composed two-layer model with blocks and update blocks. Here, it records every system event, the size of the training data, contribution metrics, and validation proofs.

Abou El Houda et al. [100] proposed using explainable AI, a blockchain, and a federated system to detect IoT intrusions. Yang and Li [101] proposed a solution to the free-rider problem, in which a system participant does not contribute to their own data. Here, the solution consists of Federated Learning (FL), Blockchain, and Incentive mechanisms to reward the participants. Li et al. [102] introduced BLADE-FL, which is in Fig. 9. Its decentralized FL blockchain framework encompasses performance evaluation metrics and resource allocation strategies. Mainly replacing the central server with a blockchain network for aggregation and verification.

Liu et al. [103] used both blockchain and federated learning in detection. Their approach highlighted that accuracy can be improved while safeguarding the data.

The combination of decentralized technologies has driven the attention of researchers. Zhao et al. [104] developed a privacy-preserving approach specifically designed for IoT devices that have limited computing power. Lu et al. [105] designed a platform for secure data sharing in the industrial internet of things that employs the Use of a blockchain and federated learning. Fig. 10 shows the combination of blockchain technology with federated learning to enable secure data exchange among industrial IoT devices. Hallaji et al. [106] examined the security and privacy vulnerabilities of decentralized federated learning, particularly the potential of blockchain to mitigate model poisoning and data inference attacks. Han et al. [107] simultaneously provided a comprehensive examination of methodologies for ensuring both privacy and reliability in federated learning, including blockchain-based methods. Manzoor et al. [108] surveyed various defense strategies in FL, categorizing them according to what occurs before, during, and after model aggregation. Ngoupayou Limbepe et al. [109] focused on effective healthcare and examined how blockchain technology could enhance privacy in Florida-based medical systems.

Wu et al. [110] and Ning et al. [111] have provided significant surveys that classify blockchain-based federated learning solutions according to consensus mechanisms and model aggregation methods. Cao et al. [112] have identified privacy and trust concerns given from the integration of blockchain and federated learning in intrusion detection systems. Phishing detection research is nascent yet demonstrates significant potential. Ghosh et al. [113] demonstrated that it is feasible to train phishing-detection models collaboratively across distributed nodes using FL and blockchain, while keeping transaction data private on the Ethereum network. The FedPhishLLM framework [114] took things even further by combining FL with fine-tuned multimodal large language models for phishing detection, representing one of the first attempts to merge all three technologies.

To further phishing detection, blockchain-enabled federated learning is emerging, with many recent studies presenting frameworks to address security, privacy, and scalability challenges. In an early comprehensive taxonomy of blockchain-enabled federated learning, Qu et al. [92] classified techniques by architectural frameworks and consensus mechanisms, Jiang et al. [115] conducted a comprehensive survey of blockchain-based federated learning in IoT settings, examining interactions among blockchain participants throughout the federated learning process and categorizing frameworks into three classes based on the level of integration between blockchain and federated learning. In addition, Cai et al. [116] investigated the uses of both benefits, challenges, and possible solutions; they stress model verification strategies.

Multiple frameworks have shown that combining federated learning with blockchain is effective in real-world applications. Vijay Anand et al. [117] integrated federated learning with LSTM autoencoders to safeguard blockchain network transactions, enabling diverse datasets across nodes to contribute to a global model without exchanging raw data. Their framework achieved strong anomaly detection performance while maintaining data Privacy through decentralized training. Shalan et al. [118] use knowledge distillation, transfer learning, and blockchain-enhanced FL to enable multiple IoT devices with different computing capabilities to collaborate while ensuring security via blockchain-based role-based access control.

The preservation of privacy in blockchain-enabled federated learning systems has caused increased interest among the research communities. Abuzied et al. [119] proposed FLoBC, a distributed ledger-based expandable privacy-preserving FL framework, and explored node update synchronization algorithms and associated performance trade-offs. Chen et al. [120] proposed a blockchain-based federated learning framework that establishes trust and fairness while counteracting poisoning attacks through federated computation. In study [121], the BPRFL framework was proposed to detect malicious clients and eliminate their intrusions. Their approach uses federated learning with differential privacy. Their framework consists of tracking each client’s behavior, setting two rules they must pass, and accepting updates only from participants. Their methodology achieved high accuracy.

In the study by Ali et al. FL-BCID: A Lightweight and Smart Model-Update System for Industrial IoT Systems in Decentralized Environments [122]. This paper proposes an FL-based intrusion detection system for industrial IoT environments; it uses a lightweight technique that updates the model via smart contracts and the Blockchain. Odeh and Taleb [123] proposed another combination of the two technologies, integrating federated learning with Blockchain and smart contracts, leveraging the Merkle tree to enhance integrity and eliminate unauthorized access to the network. In addition, a dual-layer hybrid blockchain–SecureChainFL–was proposed [124]. The public Blockchain ensures cryptographic auditability, and the private Blockchain (or, in some cases, a federated ledger) is used for model validation and aggregation. Moreover, for privacy protection, zero-knowledge proofs and homomorphic encryption are used.

However, several substantial obstacles persist. On public networks [94,97], transaction fees and consensus latency on blockchains can significantly delay model updates. Due to storage constraints, model parameters cannot be stored entirely on the Blockchain; as a result, systems depend on off-chain storage using IPFS [95,98]. In addition, the communication overhead inherent in federated learning, combined with blockchain verification costs, is a major stumbling block to large-scale real-time phishing detection [96,106]. Participating clients generally have non-identical data distributions, which constitute a substantial statistical challenge that blockchain technology cannot solve on its own [107,110]. Furthermore, most proposed frameworks are only evaluated in controlled lab settings, leaving many open questions about their capacity and performance in practical phishing detection [108,112]. Most importantly, the field lacks standardized benchmarks, which makes it difficult to compare various approaches fairly and consistently [109]. Table 9 summarizes the key studies on federated learning and blockchain integration.

In this review, we looked at studies that applied traditional machine learning methods (Naive Bayes, Random Forests, SVMs) to identify and extract attributes of phishing content [24–27]. In addition, we evaluated the application of a deep learning method [29,30,32–34] using CNNs and LSTMs, as well as a hybrid method combining machine learning and deep learning. In [35,36], we identified two hybrid approaches that combine both methods for improved detection performance. Federated learning and blockchain were the focus of studies [55–57,80,86–89,125,139,140], whereas studies [24–27,29,30,32–34, 37–43] were focused on improving detection results. The large language models (BERT and GPT) described in [37–43] demonstrate exceptional capabilities for understanding semantic content, exceeding expectations for BERT’s ability to understand context and GPT’s ability to generate a comprehensive representation of the content.

The European Union EU designed the GDPR to protect individuals from unauthorized use of their personal data. Although it was developed to provide legal protections for individuals’ rights with regard to data privacy, centralized approaches [24–27,29,30,32–34,37–43] rely on model training on a central server, which creates legal challenges when deploying those models. Decentralized methodologies [55–57,80, 86–89,125,139,140] have exhibited potential advantages over centralized methods, as they can incur 1%–3% accuracy loss due to trade-offs made to preserve user data at the device level. However, the greatest challenge for methodologies that can preserve accuracy is the lack of production-ready implementations. In addition, although blockchain-based studies [80,86–89,125,139–141] demonstrate high levels of security, they do not address computational inefficiencies.

We researched many of the major datasets that have been studied, namely those related to URLs (such as PhishTank, Alexa, and OpenPhish) and email data (such as IWSPA, Enron, and Nazario). Despite their importance, we found that phishing techniques have changed over time, yet these established datasets do not reflect that change. The fact that so many studies use this same data set, which is well-balanced between actual and phishing examples, will provide the best possible accuracy and effectiveness for our study. Existing datasets differ in format; some include URLs, email content, and IP addresses.

The key findings from our review include a major gap in combining blockchain and federated learning in production-ready systems, along with other gaps. We noticed that most of the papers we reviewed focused mainly on accuracy; they neglected other metrics such as precision, recall, F1-score, and false positives. Furthermore, large language models with federated learning were not used to detect phishing in a privacy-preserving manner. Additionally, there is a need for standardized multilingual benchmarks to evaluate phishing detection and to broaden its scope to include new and emerging types of phishing (e.g., mobile, voice, and IoT-based phishing). Further, the issue of class imbalance needs to be systematically addressed across all phishing detection studies using techniques such as SMOTE, cost-sensitive learning, and generative data augmentation to guarantee dependable, generalizable results.