The Tricks Your Brain Plays
Here’s a paradox that should make you uncomfortable: a New York University study found that people consistently “self-enhance” when assessing cyber risk — believing they are less likely than others to fall for phishing. A separate study published in ScienceDirect in 2023 went further: people with greater internet usage and higher self-rated phishing detection skills were actually more susceptible to phishing attacks. The people most confident they can’t be fooled are the easiest to fool.
This isn’t a flaw in those people. It’s a flaw in how human brains work.
Consider the numbers: 71% of employees surveyed by Proofpoint admitted to engaging in actions they knew were risky — reusing passwords, clicking unknown links, sharing credentials. Of those, 96% were fully aware of the potential dangers. They did it anyway, citing convenience and time pressure. And in a university study, over 90% of students opened at least one of three phishing emails, and over half clicked a link inside.
Phishing doesn’t exploit technical weaknesses. It exploits mental shortcuts — automatic responses your brain uses to make fast decisions. Understanding these shortcuts is the first step to overriding them.
1. The Authority Shortcut
The research: An analysis of 207 real-world phishing emails found that 96.1% use the authority principle, based on Robert Cialdini’s foundational research on persuasion. Authority is the single most common psychological lever in phishing.
How attackers use it: An email appears to come from the CEO, the CFO, a government agency, or law enforcement. Your brain says: “This person has power. This is important. I should comply.” Questioning authority feels risky — you don’t want to be the person who delayed the CEO’s urgent request.
A phishing example: You receive an email from what appears to be your CEO: “I need you to handle something confidential. Can you purchase five $200 Amazon gift cards for a client appreciation event? I’m in meetings all day — please just email me the codes when you have them.”
The request feels awkward to question. But that awkwardness is exactly what the attacker is exploiting.
The defense: Authority makes the request more important to verify, not less. The higher the authority claimed in the message, the more important it is to confirm through a separate channel. A real CEO will understand a verification call. An attacker won’t survive one.
2. The Urgency Shortcut
The research: According to Hoxhunt, people are 8 to 10 times more likely to click a phishing link in the afternoon than in the morning. Employees are twice as likely to click after work hours. Business Email Compromise attacks are deliberately timed for Friday at 4:55 PM, when people are tired, distracted, and want to clear their inbox before the weekend.
How attackers use it: “Your account will be locked in 2 hours.” “This wire must go out before the bank closes at 5 PM.” “Respond immediately or your package will be returned to sender.”
Urgency shuts down your analytical thinking. When you feel rushed, you skip the steps that would protect you — checking the link, calling to verify, asking a colleague. You act first and think later.
A phishing example: At 4:40 PM on a Friday, you receive an email from what appears to be your bank: “Suspicious activity detected on your account. If you do not verify your identity within 2 hours, your account will be temporarily suspended.” There’s a big blue “Verify Now” button.
The deadline creates pressure. The fear of losing access creates urgency. Combined, they push you toward clicking without checking.
The defense: Treat urgency as a yellow flag, not a green light. Almost nothing legitimate is so urgent that you can’t take 5 minutes to verify it. If something truly can’t wait 5 minutes, that urgency is suspicious in itself.
3. The Context Shortcut
How it works: An attacker compromises someone’s email account. They don’t send a new message — they read ongoing conversations, find a thread about a real project with real payments, and wait for the right moment. Then they reply within that existing thread with updated wire transfer instructions.
The email history is real. The project references are real. The invoice amounts are real. The people cc’d are real. Only the person controlling the account has changed.
This is called conversation hijacking, and it’s one of the most effective phishing techniques because it exploits your familiarity with the context. Your brain says: “I know this thread. I’ve been talking to this person for weeks. This is just the next step in a process I’m already part of.”
A phishing example: You’ve been emailing back and forth with a vendor about a $45,000 consulting engagement. Contracts are signed. Work has begun. Then you receive a reply in the same thread: “Quick update — we’ve switched banks. Here are our new wire details for the remaining payment.” The message is well-written, references the project correctly, and comes from the same email address.
Everything checks out — except the person behind the keyboard.
The defense: Any request involving money, passwords, or sensitive data deserves verification through a separate channel, regardless of how familiar the conversation feels. If the context is real but the request involves financial action, pick up the phone.
4. The Trust Transfer Shortcut
How it works: When a link points to Google Forms, Microsoft Office, Notion, or SharePoint, your brain automatically transfers the trust you have in those platforms to the content hosted there. “It’s on Google, so it must be safe.”
But anyone can create a Google Form. Anyone can publish a Notion page. Anyone with a Microsoft account can share a document. The platform is trustworthy. The content might not be.
A phishing example: You receive an email saying your company has a new wellness benefit — a $500 stipend. The link goes to a Google Form asking for your name, employee ID, and direct deposit information to process the payment. The URL is forms.google.com — genuinely Google.
The form is real. The Google domain is real. But the person who created the form is an attacker, and now they have your banking details.
The defense: Trust the platform to be real. Don’t trust the content just because the platform hosts it. When a familiar platform asks for credentials, financial details, or personal information, ask: would this company really collect this data through this platform?
5. The Reciprocity Shortcut
How it works: When someone offers you something valuable — a gift, a favor, an opportunity — your brain feels an obligation to reciprocate. Attackers exploit this by leading with generosity: “Free $500 wellness benefit.” “Job opportunity paying $280K.” “I’m doing you a favor letting you know about this security issue with your account.”
The bigger the offer, the less critically you evaluate it. Your brain is so focused on the reward that it suppresses the skepticism that would normally protect you.
A phishing example: A recruiter messages you on LinkedIn with a dream job — remote, $280K base, equity, at a well-known company. They’ve clearly read your profile. After a brief conversation, they send a link to “the official application portal” where you need to create an account. The portal looks professional and asks for your resume, personal details, and current employer information.
The opportunity felt too good to pass up. That feeling was the attack.
The defense: If something seems too good to be true, verify it through official channels. Real job offers can be found on the company’s official careers page. Real benefits are announced through official internal communications. If you can’t find the offer through a channel you trust, it probably doesn’t exist.
Why these shortcuts are so dangerous
The Verizon Data Breach Investigations Report found that the median time to click a phishing link is 21 seconds from opening the email. Twenty-one seconds. These cognitive shortcuts fire before your analytical brain has time to engage.
This is why “just be careful” doesn’t work as advice. You can’t be careful about something that happens in the time it takes to tie your shoe. The shortcuts are automatic, unconscious, and universal — they work on security researchers, CEOs, and the person writing this lesson.
The defense isn’t being smarter. It’s building a pause into your process. When urgency hits, when authority speaks, when the context feels familiar — that’s when you need to slow down most.
The Rule: The more urgent it feels, the more important it is to slow down.