Phishing

You know the feeling before you know the reason: a message that is almost ordinary — roughly the right subject, roughly the right tone — and a quarter-turn off. Sometimes you catch it. Sometimes you have already clicked.

In its 2025 annual report the FBI's Internet Crime Complaint Center logged 191,561 phishing and spoofing complaints — more than any other crime type it tracks, out of 1,008,597 complaints in all — against $215.8 million in reported losses. The related category of business email compromise, in which a message impersonating a colleague or a supplier redirects a payment, drew far fewer complaints, 24,768, but $3.05 billion in reported losses.Historical / descriptive The cheap messages are the ones you meet; the expensive ones are aimed at somebody's accounts payable.

The US Federal Trade Commission's consumer guidance describes the same object from the receiving end: an unexpected message that looks like it comes from a company you know, telling a story — suspicious activity on your account, a problem with your payment information, an invoice you do not recognise — and inviting you to click a link to confirm something. Its flat rule is that legitimate companies will not email or text you a link to update your payment information.Historical / descriptive The sketches above take that shape apart.

A phishing message is not trying to be true. It is trying to be answered quickly by the right person, and it has two levers.

The first is who appears to be asking. A field study of nine simulated spear-phishing emails sent to 62,000 employees of a single organisation over six weeks rated each message for authority and urgency cues, and found that the presence of authority cues increased the likelihood that a recipient would click the suspicious link.Supported, with limits Rank is convenient for a stranger: unverifiable at a glance, awkward to query.

The second is what the message is about. Which message arrives matters more than most people expect. Across ten simulated campaigns at a large healthcare organisation, average failure rates ranged from 1.8% to 30.8% depending on the lure, and two messages on closely related themes performed very differently — 7.6% for one about open enrollment benefits against 30.8% for one about vacation policy.Supported, with limits A seventeen-fold spread across messages sent to the same people in the same months is a fact about messages, not about the people reading them: "how did I fall for that?" usually has an answer about the letter.

If recognition were the whole answer, teaching it would work. It works far less well than the industry selling it implies.

An eight-month randomised controlled experiment covering more than 19,500 employees at a large healthcare organisation found no significant relationship between how recently someone had completed annual cybersecurity awareness training and whether they failed a phishing simulation, and embedded training delivered after a click lowered the average failure rate by only about 1.7 percentage points. Over the eight months, 56% of users — 11,077 of 19,789 — clicked a simulated phishing link at least once.Supported, with limits That last figure is the one to sit with: given enough attempts, more than half of a large, trained, professional population clicked something. The ones who dodged the first eight lures were not a different species, only people who had not yet met theirs. Which is the honest case for a walkthrough: not immunity, but a name ready to hand.

Nothing here diagnoses a message in front of you, and no sketch clears one either: a live message can wear any of these shapes, or none.

The UK's National Cyber Security Centre puts the limit plainly: "No training package, including phishing simulations, can teach users to spot every phishing attempt." Its guidance treats user vigilance as one layer among four — beside stopping messages reaching people, limiting what a successful attack can reach, and responding quickly once one lands — and it warns that blaming users for clicking on links does not work.Historical / descriptive Read that as an argument against a particular kind of shame: anyone caught was caught by a trade with better data on them than they had on it.

Nor does this entry measure how much recognition practice protects anyone; that study has not been run.

Three kinds of instrument stand behind this entry. Complaint statistics count what was reported, by people who knew where to report it, in one country. Simulation studies measure clicks on a fake lure inside an organisation that agreed to be tested — quieter about what arrives on a private phone on a Sunday. And the training results come from one large healthcare employer.

The same study explains why the training does so little: over half of all embedded training sessions ended within ten seconds and fewer than 24% of users formally completed the material. Among the minority who did complete interactive training, the likelihood of clicking a later lure fell by 19% — a reduction the authors call small in absolute magnitude and possibly a selection effect, since it describes the people who chose to engage.Supported, with limits The open question is not whether attention helps but whether anyone can be brought to spend it. Where the research is silent — on how long any effect lasts, on what a tired person does at four in the afternoon — this entry is silent too.