Deep Learning Approaches for Phishing Detection: A Systematic Review with a Focus on Mobile Deployment, Explainability, and Temporal Modelling

Abstract

Financial loss, data theft, and user harm can result from phishing attacks, which are increasing in frequency and variety beyond traditional email-based attacks to include mobile forms like smishing, quishing, malicious mobile applications, and mobile phishing websites. While a number of reviews have already addressed phishing, Android Mal-Ware, and Explainable Artificial Intelligence (XAI), the literature is still disjointed in the lightweight deployment, model explainability, temporal attack behaviour, coordinated phishing detection, and evaluation datasets of intelligent mobile systems. The purpose of this systematic literature review (SLR) is to analyse all the major phishing detection methods using deep learning published from 2020 to 2026 and to focus on the key features of these methods, such as the model architectures, the mobile deployment, the explainability, the temporal modelling, coordinated detection, and the evaluation datasets. Studies were identified, screened, and assessed for eligibility using the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) 2020 guidelines before being included in the review for qualitative synthesis. Out of 101 studies that were included in the final review, the evidence was comparatively synthesised considering the following: learning architecture, detection modality, deployment characteristics, explainability mechanisms, the ability to model time, and the evaluation performance reported. The synthesis results show that phishing detection is generally good, with the accuracy of the transformer-based, hybrid, and attention-enhanced architectures being above 97% for some of the selected studies, and lightweight and edge-oriented architectures making the deployment more feasible for resource-constrained mobile environments. The reviewed evidence also demonstrates the increasing combination of XAI, temporal sequence modelling and multimodal analysis to enhance the transparency and robustness of detection. Comparisons between studies are, however, restricted by variations in the datasets, the representation of the features, the evaluation protocols, and the performance metrics. The results highlight the importance of future research focused on explaining lightweight, temporally adaptive, and robust phishing detection frameworks for intelligent mobile systems.