Humans and Phishing: Why Clever People Click

When someone in your team clicks a phishing link, the reflex is to ask what is wrong with them. The better question is what is right with them. The traits phishing exploits — curiosity, trust, quick decisions under pressure — are the same traits that make people good at their jobs and pleasant to work with. Understanding that changes how you defend against it.

The numbers tell a hopeful story

Start with the uncomfortable part. In KnowBe4's 2024 benchmarking study of simulated phishing tests across millions of users, roughly a third of employees — 34.3% — clicked a phishing link or fell for a phishing test before any security awareness training [1]. And the stakes are real: the US Cybersecurity and Infrastructure Security Agency reports that more than 90% of successful cyber-attacks start with a phishing email [2]. Closer to home, phishing sits among the five scam types that together accounted for more than 70% of reported scam losses in Australia in 2024, according to the National Anti-Scam Centre [3].

Now the hopeful part. In the same KnowBe4 study, that 34.3% figure dropped to 18.9% within ninety days of combined training and simulated phishing, and to 4.6% after a year of ongoing practice [1]. That is not a marginal improvement. It is the difference between one in three people clicking and one in twenty.

So the interesting question is not whether training works — it clearly does — but why humans are so susceptible in the first place. The answer is not carelessness or lack of intelligence. It is deeper than that, and more forgivable.

Curiosity is a feature, not a bug

Humans evolved curiosity as a survival tool. The ancestors who investigated the strange sound or the unfamiliar object found the food, spotted the danger, learned the useful thing. That drive is baked in deep.

George Loewenstein's "information gap" theory of curiosity describes what happens when we perceive a gap between what we know and what we want to know: we feel an almost irresistible pull to close it [4]. Phishing subject lines are engineered directly at that gap. "You won't believe what happened." "Urgent: action required on your account." "Your package delivery update." Each one opens a gap and offers a single blue link to close it.

Trust is the default setting

Humans are wired to trust by default, and for good reason. In the small groups we evolved in, most people you dealt with were people you would deal with again, which made deception costly and trust a sensible starting position. Modern email inherits that default without inheriting the safeguards.

When an email arrives that looks like it is from your bank, your first instinct is not suspicion — it is to assume your bank is contacting you. Phishers do not have to defeat your scepticism. They only have to avoid triggering it.

Fast thinking, busy people

Daniel Kahneman's distinction between fast, automatic thinking and slow, deliberate thinking explains why busy people are especially vulnerable [5]. Under time pressure, while multitasking, or halfway through clearing forty emails before a meeting, we lean on quick intuitive responses rather than careful analysis. That is precisely the state phishing is designed for — which is why so many phishing emails manufacture urgency. "Your account will be locked in 24 hours" is not information. It is an instruction to stay in fast mode.

The persuasion playbook

Robert Cialdini spent a career cataloguing the levers of influence, and phishing crews use his catalogue like a manual [6].

• §Authority. An email that appears to come from the boss, the IT department, or a government agency taps our conditioning to comply with authority figures.
• §Social proof. "Other customers have already updated their details" leans on our tendency to follow the crowd.
• §Reciprocity. "Click here for your tax refund" offers something first, triggering the instinct to respond in kind.
• §Scarcity and urgency. "Offer expires in 2 hours" narrows the window for slow thinking to switch on.

"It won't happen to me"

Research on optimism bias — Tali Sharot's work is a good entry point — shows that people consistently underestimate the chance of bad things happening to them personally [7]. In phishing terms, it sounds like: "I'm too smart to fall for a scam." "Hackers go after big companies, not people like me." "I'd spot a fake email a mile off."

This is why people who consider themselves tech-savvy still get caught. Confidence in your own judgement is exactly the blind spot a well-crafted phish walks through.

Why "don't click suspicious links" fails

Once you see the psychology, you see why the traditional advice falls flat. Telling people "don't click suspicious links" is a bit like telling them not to think of a pink elephant. The instruction does nothing to change the automatic processes that produce the click in the first place.

Training that actually works does something different:

• §It acknowledges our natural tendencies instead of shaming them.
• §It teaches specific, concrete recognition patterns — what a dodgy sender address looks like, what urgency-manufacturing sounds like.
• §It builds new automatic responses through repetition, so "check before clicking" becomes as reflexive as clicking.
• §It uses safe simulations, so the first time you meet a convincing phish is in practice, not production.

Work with human nature, not against it

The drop from 34.3% to 4.6% [1] does not happen because training deletes curiosity or trust from people's heads. It happens because good training redirects those instincts. Curiosity becomes the habit of investigating the sender address and hovering over the link. Trust becomes trust-but-verify — a quick call on a known number before acting on a bank-detail change. Social proof gets flipped to your side when reporting a phish is publicly celebrated rather than quietly ignored.

“Humans aren't fundamentally flawed for falling for phishing. We're running psychological systems that evolved for a different environment.”

That is the core of it. The solution is not to fight human nature — you will lose — but to build security that fits how people actually think and behave. Plain-English explanations, no-blame reporting, and regular friendly simulations do more than any stern policy document ever will.

This is the thinking behind our phishing simulation and training work: safe practice, clear patterns, and absolutely no shaming. If you would like to run a friendly simulation with your team, get in touch.