PB-01Strong evidence
Reports suspicious messages
Uses the reporting button or channel whenever a message feels wrong, whether or not they clicked.
Research / Tactics
Manipulation tactic
Authority
Posing as a boss, executive, or institution.
Behaviors that counter it (5)
PB-03Moderate evidence
Verifies unusual requests through a second channel
Confirms payment changes, credential requests, and odd asks by calling or messaging the person through a known, separate channel.
PB-04Moderate evidence
Acts on the sense that something is off
Stops when a message feels wrong, even before they can say exactly why.
PB-06Contested evidence
Questions requests that lean on authority
Checks before acting when a message invokes a boss, executive, government body, or IT department.
PB-12Emerging evidence
Stays alert to personalized, well-written messages
No longer relies on typos and bad grammar as the main warning sign.
Studies (9)
Mixed
Phishing Susceptibility and the (In-)Effectiveness of Common Anti-Phishing Interventions in a Large University Hospital
Susceptibility and intervention effectiveness varied sharply by staff group, and risk from a few phishing emails lingered about three days. Technical measures (filtering, in-email warnings) worked best, generic [EXTERNAL] tags did little, and some staff reacted to the simulation with fear, shame, guilt, and hostility.
Supports
Evaluating Large Language Models' Capability to Launch Fully Automated Spear Phishing Campaigns: Validated on Human Subjects
Fully AI-automated spear-phishing emails drew a 54% click-through rate, matching human experts (54%) and far above arbitrary control phishing (12%), a big jump from comparable AI results a year earlier. The AI's reconnaissance profiles were accurate and useful for 88% of targets, and AI can raise attacker profitability up to 50-fold at scale.
Supports
Devising and Detecting Phishing Emails Using Large Language Models
Click-through was 19-28% for generic control phishing, 30-44% for GPT-4 generated emails, 69-79% for emails designed by hand using the V-Triad cognitive-bias rules, and 43-81% for GPT-4 combined with the V-Triad. Large language models were also fairly good at detecting phishing intent, sometimes beating humans, and cut attacker costs.
Foundational
Persuasion: How phishing emails can influence users and bypass security measures
Merging Cialdini, Gragg and Stajano & Wilson into one set of social-engineering persuasion principles, the authors found authority, strong affect, integrity and reciprocation were the most common in phishing subject lines. Strong-affect and authority emails leaned on 'you/your' wording, reciprocation on 'we/us/our'.
Supports
Predicting susceptibility to social influence in phishing emails
In a role-play study of 985 people, emails using consistency and reciprocity were most effective while scarcity and social proof were least effective. People who scored as susceptible to a given principle were usually more fooled by emails using it, and age, computer time, social-proof susceptibility and impulsivity predicted detection ability.
Mixed
Cognitive Triaging of Phishing Attacks
Measuring Cialdini-style persuasion triggers in real reported phishing let the authors predict which attacks would draw the most clicks, enabling response teams to prioritize takedowns. Consistency and scarcity triggers were associated with more clicks, reciprocity appeared counterproductive, and authority, social proof and liking showed no clear trend.
Mixed
Susceptibility to Spear-Phishing Emails: Effects of Internet User Demographics and Email Content
43% of participants clicked at least one simulated phishing email, with older women most susceptible. Young users' susceptibility dropped over the 21 days while older users' stayed flat, and the effectiveness of each persuasion technique and life-domain topic varied by age group. Older users also rated their own susceptibility lower than it was.
Supports
Exploring susceptibility to phishing in the workplace
Across a simulation sent to about 62,000 employees, emails carrying authority cues raised the likelihood of clicking a suspicious link. Focus groups pointed to workplace factors, such as routine email habits and work pressures, that shape whether employees fall for spear phishing.
Foundational
Wisecrackers: A theory-grounded investigation of phishing and pretext social engineering threats to information security
Drawing on marketing-persuasion theory, a field study tested whether the factors that make marketing campaigns work also explain who falls for phishing and pretext phone attacks, and found that they do: dispositional factors tied to persuasion predicted victimization.