Web Phishing Risks for Users with Disabilities: A Scoping Review of Accessibility Barriers, Assistive Technology Mediation, and Anti-Phishing Protection

Web phishing remains a pervasive security threat, yet many anti-phishing protections assume that users can visually inspect webpages, notice warnings, interpret trust cues, and complete verification steps without assistive support. These assumptions can leave users with disabilities with unequal access to protection, while evidence on this problem remains fragmented across accessibility, usable security, warnings, authentication, and CAPTCHA-based verification. In this review, anti-phishing protection is understood as a distributed set of mechanisms operating across multiple stages of phishing-related risk, including deceptive-content detection, authenticity evaluation, verification workflows, and post-compromise safeguards. This paper presents a PRISMA-ScR scoping review of research on web phishing risks for users with disabilities across ACM Digital Library, IEEE Xplore, Web of Science, and Scopus. We reviewed 52 peer-reviewed studies published between 2015 and 2025. Through a phishing-centered lens, the review shows that phishing risks documented in the literature, particularly among blind and low-vision (BLV) users and users who access web content through screen readers, are shaped by unequal access to warnings, authenticity cues, verification workflows, and other protective mechanisms under assistive-technology-mediated web interaction. To support this argument, the review synthesizes four areas: interaction risks and accessibility barriers, assistive-technology mediation of phishing cues and warnings, limitations in current anti-phishing protections, and future directions for inclusive design. The findings further suggest that unequal access to protection can emerge before, during, and after direct exposure to phishing content, while the evidence base remains heavily concentrated on BLV users and much more limited for other disability groups.