In modern cybersecurity, attackers are not looking for vulnerabilities exclusively in software; instead, they are targeting our cognitive load. For a phishing attack (and specifically spear phishing) to be effective, the cybercriminal injects an emotional trigger precisely designed to exploit automatic human reactions that cloud analytical thinking.
Various behavioural analyses in real-world environments demonstrate that the most successful deception campaigns do not just mimic technical formats; they apply psychological principles of influence combined with contexts from our daily lives, causing a large number of users to fall into the trap right in their inbox.
The promise of unexpected financial gains, discounts, or exclusive benefits. Attackers use this trigger because greed short-circuits scrutiny: the prospect of a reward makes people less likely to question a request's legitimacy. Constant exposure to bank fraud alerts and consumer scam warnings has made many users more sceptical of overtly financial lures than they once were, which is why attackers increasingly wrap greed inside a more credible context, for example a refund, a bonus, an overdue invoice.
Fear drastically manipulates risk perception. By presenting severe consequences or critical scenarios, the attacker seeks to block the victim's logical thinking, forcing them to act under a state of alert that clouds common sense just to avoid reputational, financial, or technical damage.
By establishing a strict time limit, the victim is forced to act on impulse to avoid losing a valuable option or suffering an imminent penalty. Urgency compresses the decision window; scarcity raises the stakes of missing out. Combined, the two leave little room for a considered response. A 2017 field study and a separate 2024 replication both found that younger adults are significantly more susceptible to scarcity-based attacks than older adults.
This trigger relies on respect for hierarchical structures and official channels. Human beings tend to comply with requests from figures we perceive as holding political, legal, or corporate power. What is consistent across the literature is that an email appearing to come from a senior figure or official body reliably lowers a recipient's guard.
This appeals to our community and collaborative nature through the desire to return a favour, accept a gift, or react to empathy. The same pattern flips for reciprocation: research from 2017, replicated again in 2024, found older adults significantly more susceptible to reciprocation-based attacks than younger adults. If an email offers a courtesy, a gift, or appeals to mutual help, this group's defences drop noticeably.
The innate human need to solve mysteries or uncover hidden information. Attackers exploit this impulse by sending ambiguous yet highly enticing messages (such as "look at this document about you" or "this information has been leaked"), pushing the user to click immediately to satisfy their need to know what happened.
Emails simulating traffic tickets, parking violations, or court subpoenas tap into something few other pretexts can: the fear of formal, documented consequences. Rule-breaking carries a dread that overrides the usual pause-and-check instinct, which is why legal and compliance-themed phishing remains one of the more difficult pretexts for recipients to shake off, however sceptical they normally are.
For a deeper look at the psychological theory behind several of these triggers, see our guide to Cialdini's six principles of influence.
The most alarming finding in the psychology of phishing is what we call the discrepancy between reporting and behaviour. When evaluating "susceptibility awareness" (how vulnerable a user believes they are), the vast majority of people report a self-perception of high security and a low probability of making a mistake.
However, their actual behaviour in everyday environments proves otherwise, revealing a critical disconnect between what we think we would do and how we actually react when an emotion is directly stimulated in our inbox.
Modern awareness programmes must shift toward a customised approach: training employees to recognise not just the technical layout of an email, but the exact emotion (reciprocity, authority, scarcity) that the attacker is trying to trigger in their minds. The next section sets out a practical framework for building that kind of programme.
In a landscape where our own evolutionary biology plays against us, the question is inevitable: if we cannot "patch" the human mind as if it were software, are we defenceless? Hadnagy's answer is a resounding no. The solution lies not in paranoia, but in preparation. To counter social engineering, organisations must implement what he calls a M.A.P.P. (Mitigation and Prevention Plan), designed to create "muscle memory" in users.
Human cybersecurity requires systematic training based on four fundamental pillars:
Common sense is not enough; technical knowledge must be translated into human language. Employees cannot defend against what they do not know. The first step is to educate the workforce to recognise the symptoms of a psychological infection: What is vishing? What does an impersonation attack look like? The goal is for the user's mind to trigger a red alert before processing the emotion when receiving an urgent call from an "angry CEO" (Authority) or an unexpected gift (Reciprocity).
Vague policies like "do not click on malicious links" are useless, as no one clicks on a link knowing it is malicious. An effective policy must eliminate the need for the employee to make decisions under emotional pressure. Neutralising empathy is not about forbidding kindness, but about preventing empathy from overriding protocols. For example, a clear policy should dictate: "If an external technician needs access, they must be verified via two channels, no matter how urgent their request." This frees the employee from the guilt of saying "no" to a charismatic attacker.
Theory is forgotten; experience is remembered. Organisations must undergo controlled social engineering audits. If employees have never been "hacked" in a safe environment, they will fall for a real one. Statistics back the efficacy of constant simulation. In cases documented by Hadnagy, implementing regular testing and positive reinforcement achieved drastic results:
Finally, security must stop being the department of "NO" and become a culture of "HOW." Positive reinforcement works better than punishment. Shaming those who fall into a trap only creates employees who hide their mistakes. Successful programmes have used gamification, such as rewarding the employee who detects the "phishing of the month", to transform vigilance into a collective habit. When the CEO publicly admits to having fallen for a test, the stigma is removed, and the message is reinforced: we are all vulnerable, therefore, we are all responsible.
Social engineering turns our best instincts (trust, helpfulness, respect) into vulnerabilities. However, a well-implemented M.A.P.P. turns those very instincts into a shield. With the right education, clear policies, and a supportive culture, the mind becomes our most sophisticated firewall. Security is not a destination; it is a habit that must be practised.
Hadnagy, C. (2018). Social Engineering: The Science of Human Hacking (2nd ed.). John Wiley & Sons.
Oliveira, D., Rocha, H., Yang, H., Ellis, D., Dommaraju, S., Muradoglu, M., Weir, D., Soliman, A., Lin, T., & Ebner, N. (2017). Dissecting Spear Phishing Emails for Older vs Young Adults: On the Interplay of Weapons of Influence and Life Domains in Predicting Susceptibility to Phishing. In Proceedings of the 2017 CHI Conference on Human Factors in Computing Systems (pp. 6412–6424). ACM.
Sommestad, T., & Karlzén, H. (2024). The Unpredictability of Phishing Susceptibility: Results from a Repeated Measures Experiment. Journal of Cybersecurity, 10(1), tyae021. https://doi.org/10.1093/cybsec/tyae021
