PB-01Strong evidence
Reports suspicious messages
Uses the reporting button or channel whenever a message feels wrong, whether or not they clicked.
Research / Tactics
Manipulation tactic
Urgency
Pressure to act before thinking.
Behaviors that counter it (3)
PB-02Moderate evidence
Pauses when a message pushes them to act fast
Treats deadlines, threats, and 'act now' language as a signal to slow down, not speed up.
PB-12Emerging evidence
Stays alert to personalized, well-written messages
No longer relies on typos and bad grammar as the main warning sign.
Studies (4)
Mixed
Phishing Susceptibility and the (In-)Effectiveness of Common Anti-Phishing Interventions in a Large University Hospital
Susceptibility and intervention effectiveness varied sharply by staff group, and risk from a few phishing emails lingered about three days. Technical measures (filtering, in-email warnings) worked best, generic [EXTERNAL] tags did little, and some staff reacted to the simulation with fear, shame, guilt, and hostility.
Supports
Devising and Detecting Phishing Emails Using Large Language Models
Click-through was 19-28% for generic control phishing, 30-44% for GPT-4 generated emails, 69-79% for emails designed by hand using the V-Triad cognitive-bias rules, and 43-81% for GPT-4 combined with the V-Triad. Large language models were also fairly good at detecting phishing intent, sometimes beating humans, and cut attacker costs.
Foundational
Persuasion: How phishing emails can influence users and bypass security measures
Merging Cialdini, Gragg and Stajano & Wilson into one set of social-engineering persuasion principles, the authors found authority, strong affect, integrity and reciprocation were the most common in phishing subject lines. Strong-affect and authority emails leaned on 'you/your' wording, reciprocation on 'we/us/our'.
Supports
Exploring susceptibility to phishing in the workplace
Across a simulation sent to about 62,000 employees, emails carrying authority cues raised the likelihood of clicking a suspicious link. Focus groups pointed to workplace factors, such as routine email habits and work pressures, that shape whether employees fall for spear phishing.