PB-01Strong evidence
Reports suspicious messages
Uses the reporting button or channel whenever a message feels wrong, whether or not they clicked.
Research / Tactics
Manipulation tactic
Helpfulness
Triggering the impulse to help.
Behaviors that counter it (3)
PB-03Moderate evidence
Verifies unusual requests through a second channel
Confirms payment changes, credential requests, and odd asks by calling or messaging the person through a known, separate channel.
PB-07Emerging evidence
Confirms identity before helping
Stays helpful, but confirms who is asking before sharing files, codes, or access.
Studies (6)
Supports
Phishing reporting in organizations: What motivates employees to take action?
The main reason employees report suspicious emails is wanting to protect and help the organization and coworkers, followed by responsibility, awareness of consequences, and feelings of insecurity. Reporters were more likely to report convincing, well-impersonated emails, showing they judge potential impact.
Foundational
Persuasion: How phishing emails can influence users and bypass security measures
Merging Cialdini, Gragg and Stajano & Wilson into one set of social-engineering persuasion principles, the authors found authority, strong affect, integrity and reciprocation were the most common in phishing subject lines. Strong-affect and authority emails leaned on 'you/your' wording, reciprocation on 'we/us/our'.
Supports
Predicting susceptibility to social influence in phishing emails
In a role-play study of 985 people, emails using consistency and reciprocity were most effective while scarcity and social proof were least effective. People who scored as susceptible to a given principle were usually more fooled by emails using it, and age, computer time, social-proof susceptibility and impulsivity predicted detection ability.
Mixed
Cognitive Triaging of Phishing Attacks
Measuring Cialdini-style persuasion triggers in real reported phishing let the authors predict which attacks would draw the most clicks, enabling response teams to prioritize takedowns. Consistency and scarcity triggers were associated with more clicks, reciprocity appeared counterproductive, and authority, social proof and liking showed no clear trend.
Mixed
Susceptibility to Spear-Phishing Emails: Effects of Internet User Demographics and Email Content
43% of participants clicked at least one simulated phishing email, with older women most susceptible. Young users' susceptibility dropped over the 21 days while older users' stayed flat, and the effectiveness of each persuasion technique and life-domain topic varied by age group. Older users also rated their own susceptibility lower than it was.
Foundational
Wisecrackers: A theory-grounded investigation of phishing and pretext social engineering threats to information security
Drawing on marketing-persuasion theory, a field study tested whether the factors that make marketing campaigns work also explain who falls for phishing and pretext phone attacks, and found that they do: dispositional factors tied to persuasion predicted victimization.