Exploring susceptibility to phishing in the workplace

Key finding

Across a simulation sent to about 62,000 employees, emails carrying authority cues raised the likelihood of clicking a suspicious link. Focus groups pointed to workplace factors, such as routine email habits and work pressures, that shape whether employees fall for spear phishing.

Why it matters

Real-world evidence that authority cues move clicks, and that the work context, not just individual knowledge, drives susceptibility.

Informs

• Verifies unusual requests through a second channel supports
• Questions requests that lean on authority supports

Cite

Williams, E. J., Hinds, J., & Joinson, A. N. (2018). Exploring susceptibility to phishing in the workplace. International Journal of Human-Computer Studies. https://doi.org/10.1016/j.ijhcs.2018.06.004