How Experts Detect Phishing Scam Emails

Key finding

Experts detect phishing in three stages: making sense of the email and noticing small discrepancies, becoming suspicious when something (usually a link asking for action) triggers the phishing explanation, then investigating and deleting or reporting. Training should build this sensemaking process, not just checklists.

Why it matters

Describes detection as trained noticing of 'something off', matching PsySec's emphasis on instinct and recognition over rules.

Informs

• Verifies unusual requests through a second channel context
• Acts on the sense that something is off supports

Cite

Wash, R. (2020). How Experts Detect Phishing Scam Emails. Proceedings of the ACM on Human-Computer Interaction (CSCW). https://doi.org/10.1145/3415231