Current detection frameworks largely analyze emails as technical artifacts while overlooking the behavioral
evidence generated during user evaluation. This gap is consequential in settings such as Nigeria, where rapid digital
adoption and emerging data-protection obligations under the Nigeria Data Protection Act 2023 (NDPA 2023) create both
an elevated threat environment and a legal requirement for privacy-conscious security design. This paper applies design
science research (DSR) methodology following the process model of Peffers et al. (2007). It addresses problem
identification, definition of solution objectives, and artifact design, and conducts an internal ex ante evaluation covering
theoretical coherence, design requirement traceability, architectural consistency, and regulatory risk alignment. The
artifact has four components: a theory-derived behavioral feature model grounded in Human Error Theory (HET), DualProcess Theory (DPT), and Protection Motivation Theory (PMT); a client-side pipeline producing 12 privacy-minimized
interaction indicators; a distributed federated learning (FL) architecture with participant-level differential privacy (DP)
and a formal adversarial threat model; and a governance layer aligned with NDPA 2023 obligations. Its value lies in
theory-derived behavioral feature operationalization, distributed DP with adversarial threat modeling, and an NDPAaligned governance specification, contributing to cognitive cybersecurity, privacy-preserving machine learning, and
African digital governance research.