Scams That Seem Real: Cognitive, Emotional, and Contextual Clues for Recognizing Phishing and Social Engineering

Introduction: Why Fraudulent Messages Seem Believable

Phishing does not rely solely on linguistic errors or poor visual imitations. A fraudulent message can appear credible when it aligns with an expected activity, triggers an immediate concern, or uses personal information to bridge the gap between the attacker and the recipient. Credibility thus arises from the relationship between the message’s content, the context in which it is received, and the cognitive state of the decision-maker. A review of 70 studies identifies 47 constructs distributed across cognitive processing, personal traits, context, experience, influence techniques, and message characteristics (Luo et al., 2025).

Recent evidence shifts the explanation from a stable vulnerability toward a situated decision. The same person may correctly identify a phishing email under calm conditions but fall for another while performing an urgent task, searching for a job, or navigating a corporate reorganization. The analysis must link observable cues to emotions, active goals, and organizational conditions; only then can it explain why recognizing phishing requires more than simply memorizing a list of red flags.

Persuasive cues that create the appearance of legitimacy

Urgency, authority, reciprocity, and scarcity as social engineering techniques

Scams employ principles of persuasion to shape interpretation before the recipient verifies the link or the sender’s identity. Authority can be presented through a figure of authority; scarcity through a limited time window; reciprocity through a request that appears to be in return for a previous favor; and social proof through references to peers or shared procedures. In a sample of 2,300 university emails collected between 2010 and 2023, authority and scarcity were frequent tactics, while spelling errors decreased over time (Morrow, 2024).

Experiments show that the frequency of a technique alone does not determine its ability to deceive. In a task involving 200 participants, messages containing scarcity or social proof were detected more easily than other messages, and time pressure reduced overall detection, although it did not statistically significantly alter the specific effect of those techniques (Auton & Sturman, 2025). This apparent paradox suggests that one persuasive cue may attract attention because it stands out, while another may blend into an everyday situation and go unnoticed.

Social engineering thus combines two strategies: it offers a plausible interpretation and reduces the motivation to verify it. An email announcing the arrival of a new executive may seem credible because it aligns with internal expectations, even among security-conscious employees (Hable et al., 2025). Authority does not operate in isolation; it gains strength when the organizational context makes it relevant.

Linguistic, Visual, and Contextual Features of Phishing Emails

Linguistic features allow us to detect forms of ambiguity that a quick reading might accept as natural. Classification models that incorporate vagueness and subjectivity outperformed baseline classifiers in F-score, because fraudulent messages tended to use ambiguous phrasing, opinions, emotions, or exaggerated claims (Shovo & Valecha, 2025). This result does not mean that all vagueness is proof of fraud: a legitimate email can also be imprecise, and a well-written scam can avoid obvious errors.

Visual appearance must be interpreted in conjunction with content and context. Visual cues produced modest improvements in a study with 55 participants, but they also increased the misclassification of legitimate messages; subsequent explanatory feedback raised overall accuracy to 70% in a new task (Champa et al., 2025). A visual cue alone, therefore, does not guarantee a correct decision.

Context determines which signals appear normal. Emails targeting universities have evolved from security-focused messages to imitations of institutional life, such as job offers (Morrow, 2024). Consequently, the evaluation should ask what action the message requests, why it is arriving now, and whether the channel corresponds to standard procedure, rather than relying on spelling, the logo, or tone.

Personalization and the Emerging Role of Language Models

Language models make it possible to generate messages tailored to a small amount of data about the recipient, thereby reducing the cost of preparing spear-phishing campaigns (Heiding et al., 2024). In an experiment with 112 participants, emails generated by GPT-4 achieved click-through rates of 30–44%, compared to 19–28% for generic messages; messages designed using persuasion rules achieved 69–79%, and the combination of GPT-4 with those rules reached 43–81% (Heiding et al., 2024). The figures show that automation can increase scale and apparent relevance, although the wide range also reveals differences among recipients.

Personalization does not have a uniform effect when controlling for the general type of scam. In a repeated experiment with 102 participants and 2,294 emails, the scam category explained 6% of the variation in susceptibility to links and 3% in code execution; once that category was controlled for, no robust relationships emerged between adaptation, influence techniques, and susceptibility (Sommestad & Karlzén, 2024). Language models can generate persuasive messages, but their effectiveness still depends on the specific scenario and the decision being requested.

How Knowledge, Emotions, and Cognitive Load Come into Play

Decision-making styles, use of cues, and knowledge about phishing

Detection requires more than simply stating that security matters. In a study with 145 participants, the use of cues was the only predictor that exclusively explained the ability to distinguish fraudulent emails from genuine ones; knowledge about phishing was associated with higher detection rates, but also with a tendency to classify all messages as fraudulent (Sturman et al., 2024). A preference for intuitive decisions predicted lower detection rates, primarily because it led to an increase in the classification of genuine messages as fraudulent.

Another study, involving 291 participants, found that information security awareness was linked to better behavioral intentions both directly and through a lower preference for intuitive decisions (Sturman, Bell, et al., 2024). These relationships were stronger when specific knowledge about phishing was low, and awareness better predicted discrimination when such knowledge was moderate or high, but not when it was low (Sturman, Bell, et al., 2024). General awareness appears to require concrete associations to become an effective screening tool.

The distinction between declarative knowledge and the use of cues guides training design. Knowing that urgency can be suspicious is not the same as recognizing how it combines with a specific domain, request, and identity. Training should practice associations between cues and decisions, without rewarding a strategy of indiscriminate rejection that also blocks legitimate messages. This conclusion ties into the influence of emotions, which can alter which cues receive attention.

Fear, trust, message relevance, and optimism biases

Emotions alter the interpretation of a message before a rational assessment is completed. In an experiment with 474 participants, messages that induced positive valence and low certainty led to greater susceptibility to phishing (Tian et al., 2024). This finding expands upon models focused on analytical reasoning: a pleasant or ambiguous emotion can reduce vigilance without necessarily eliciting explicit fear.

The personal relevance of the message can also increase risk. In a survey based on a job-search scenario involving approximately 232 people, personal relevance increased susceptibility, while suspicion partially counteracted that association (Li & Chua, 2025). Awareness of phishing had a dual effect: it discouraged responses, but it also made informed participants less vigilant toward messages they found personally appealing (Li & Chua, 2025). Knowledge, therefore, does not act as automatic protection when personal relevance confirms what the recipient wants to be true.

Optimism bias adds a general tendency to underestimate one’s own risk. In 226 responses from a South African financial organization, employees with greater unrealistic optimism showed a tendency toward unsafe behaviors, while attitude and confidence were associated with the intention to behave safely (Owen et al., 2024). This correlational design does not prove that optimism causes each response, but it identifies a condition that training should explicitly address.

Time Pressure, Multitasking, and Goal Activation

Time pressure affects the amount of information that can be reviewed. In an experiment with 200 participants, those given 15 seconds were better at detecting fraudulent emails and unsafe links than those given 7 seconds (Auton & Sturman, 2025). The specific effect of the persuasive principles did not depend statistically on the time limit, suggesting that the time constraint affects the overall review process more than any specific technique.

Multitasking makes the experiment more similar to everyday activities. Two experiments on detection under working memory load showed that increasing that load reduced accuracy, while activating a detection goal improved it and mitigated the negative effect of the load (Lu et al., 2025). Target activation was more effective for messages framed as gains than for those framed as losses (Lu et al., 2025). A brief instruction reminding participants of the target may help, but it does not replace the reduction of concurrent demands.

The emotional and cognitive contexts reinforce one another. An appealing message can consume resources that should be devoted to verifying the sender, while an urgent task can prevent a person from applying the knowledge they possess. Therefore, observable behavior should be analyzed as the result of cues, emotions, goals, and mental load—not as a fixed property of the user.

A Variable Vulnerability: Organizational Context, Automation, and Unpredictability

Why the Same Person Does Not Respond the Same Way to All Messages

Variable susceptibility challenges simple classifications of cautious and careless users. The variation depends on the type of scam, the action requested, and the match between the message and the recipient’s expectations. A repeated experiment involving 102 participants attributed more variation to the general type of scam than to adaptation or influence techniques once that factor was controlled for (Sommestad & Karlzén, 2024). This limits conclusions based on a single email or an individual score.

Personalization can increase plausibility, but it does not always explain the response. A job offer, an administrative request, and a communication regarding an address can trigger different goals. The integrative model of 70 studies combines message characteristics with cognitive, personal, experiential, and contextual factors, allowing us to understand susceptibility as a configuration of conditions (Luo et al., 2025). This perspective avoids turning an experimental result into a universal rule.

Organizational Factors and Situations That Promote Susceptibility

The organizational context influences which messages appear coherent. A qualitative study that combined a realistic campaign with interviews found that the expectation of a new manager’s arrival could increase credibility and promote heuristic processing even among security-conscious employees (Hable et al., 2025). Workload produced less linear results: it could induce heuristic processing, but also delayed evaluation and more systematic processing, with lower susceptibility in certain situations (Hable et al., 2025).

A comparative qualitative analysis at a European manufacturing company was designed to examine the interplay between organizational context, environmental conditions, and attack characteristics (Hable et al., 2024). These studies shift responsibility from the individual to routines, institutional changes, and the actual availability of verification. A contextual defense must consider when requests are sent, what confirmation channels exist, and how much time the organization allows for reviewing an action.

The Debate on Complacency Toward Automatic Filters

Complacency toward automation arises when technical classification replaces human evaluation. In an experiment involving 50 email classifications, those who believed the filter was highly reliable tended to follow its decision and demonstrated poorer classification ability when that reliability was presented as high (Sarno et al., 2024). The result supports a link between trust in the filter and reliance on its label, though it does not allow us to conclude that all automation leads to passivity.

The practical conclusion is not to remove filters, but to design a division of responsibilities. Tools can weed out threats, but they must explain why a message warrants review and what uncertainty remains. The need to combine technical controls with knowledge, clues, and active objectives leads directly to training interventions and explainable alerts.

From Awareness to Resilience: Interventions to Improve Detection

Serious games and practice-based training

Practice-based training aims to translate abstract rules into observable decisions. The serious game “PhishDefend Quest,” which incorporated QR codes and activities on phishing and information over-sharing, demonstrated improvements in understanding threats and their detection methods through surveys, observations, discussions, and URL evaluation (Yasin et al., 2024). The evidence supports the pedagogical viability of the format, although the summary does not specify how long the effects last or whether they carry over to real-world campaigns.

The exercise should include both genuine and fraudulent messages, because the goal is not to flag everything as suspicious. Studies on decision-making styles indicate that knowledge can increase both detection rates and a bias toward classifying any message as phishing (Sturman et al., 2024). Exercises should require participants to justify the clues they use, compare hypotheses, and decide which verification action is appropriate for the context.

Digital alerts, explanations, and visual feedback

Explainable alerts can improve decision-making without placing the entire burden on the user. An experiment compared an explainable AI-based alert with an existing alert and a no-alert condition; the explainable alert increased detection accuracy by 10.1% and reduced both intrinsic and extrinsic cognitive load (Mason et al., 2025). The explanation is most useful when it identifies the specific signal that triggered the alert, rather than displaying an opaque label.

Subsequent feedback can also modify performance. In a study of 55 participants, visual cues raised accuracy from 58.18% to 68.73%, but without a statistically significant gain and with more errors on legitimate messages; after receiving explanations, overall accuracy reached 70% (Champa et al., 2025). The difference between a visual marker and an explanation suggests that learning the reason behind a classification may be more beneficial than receiving an additional signal.

Limitations of Interventions Focused Exclusively on the User

Individual interventions face limitations when the organization imposes time pressure, employs ambiguous procedures, or uses channels that are difficult to verify. Working memory load reduces detection, while goal activation improves it; thus, the work environment can either facilitate or hinder the application of training (Lu et al., 2025). Similarly, highly reliable filters can induce dependence and reduce independent classification (Sarno et al., 2024).

Training alone also does not resolve the variability of scams. The general class of the message explained a larger portion of susceptibility than adaptation and influence techniques in a repeated experiment (Sommestad & Karlzén, 2024). Defenses must combine training, understandable warnings, reviewable filters, and organizational procedures that allow for the verification of requests without penalizing prudent delays.

Critical Synthesis and Gaps in the Available Evidence

Consistencies Across Experiments, Surveys, Message Analyses, and Explainable Models

The literature converges on four observations. First, cues must be learned and applied in context, because the use of cues predicted discrimination better than other factors in an experimental task (Sturman et al., 2024). Second, emotions, engagement, and goals alter attentional monitoring (Li & Chua, 2025; Tian et al., 2024). Third, the organizational environment and multitasking influence decision-making (Hable et al., 2025; Lu et al., 2025). Fourth, explanations, rather than isolated labels, can improve responses (Champa et al., 2025; Mason et al., 2025).

These methods complement one another but are not equivalent. Experimental tasks allow for the manipulation of time, workload, or task formulation; surveys capture attitudes and biases; campaigns and interviews reveal workplace situations; and linguistic analysis classifies messages. The integrative proposal of 47 constructs organizes these dimensions, although it still requires empirical testing to determine which combinations predict actual behaviors (Luo et al., 2025).

Results That Are Difficult to Generalize and Mechanisms That Remain Controversial

Generalizability is limited by small sample sizes in several experiments, simulated scenarios, classification tasks, and the absence of long-term follow-up. The study of language models included 112 participants (Heiding et al., 2024), while the study of visual cues included 55 (Champa et al., 2025). The observed rates should not be directly applied to all organizations, sectors, or cultures.

There are also results that remain difficult to reconcile. Adaptation and influence appear relevant in some designs, but lose robust associations when controlling for scam type (Sommestad & Karlzén, 2024). Awareness provides protection under certain conditions, but it can reduce vigilance in the face of personally appealing messages (Li & Chua, 2025). These differences may reflect methodological variation, although the available evidence does not allow for the identification of a single mechanism.

The Need to Link Observable Cues to Contextual Decisions

The remaining challenge is to link each signal to the recipient’s state and to the requested action. It is not enough to ask whether a user recognized an email; one must record which cue they used, which goal was active, how much time they had, what verification options were available, and whether the message required clicking, executing code, or disclosing information. The repeated study distinguishes precisely between links and code execution, showing that susceptibility endpoints are not interchangeable (Sommestad & Karlzén, 2024).

Future research should combine realistic campaigns, repeated measurements, participant explanations, and models that account for uncertainty. Only such an integration will allow us to distinguish between genuine knowledge, indiscriminate rejection, and reliance on filters.

Conclusion: Recognizing Manipulation Without Relying on a Single Signal

Recognizing a scam requires evaluating sets of signals: identity, request, language, context, emotion, and verifiability. No single clue guarantees a correct classification, because spelling errors can be corrected, legitimate messages can be urgent, and visual cues can lead to false positives (Champa et al., 2025; Morrow, 2024). Decision-making improves when the recipient uses meaningful cues, reduces automatic intuition, and has access to explanations (Mason et al., 2025; Sturman et al., 2024).

Resilience also depends on working conditions. Less concurrent workload, explicit objectives, reviewable filters, and confirmation procedures enable the application of knowledge when a message attempts to rush a response. Phishing is better recognized when the individual, technology, and organization share the responsibility to verify before acting.

References

• Auton, J. C., & Sturman, D. (2025). Persuasion under pressure: the influence of persuasion principles and time constraints on phishing email susceptibility. Information and Computer Security, 33(5), 845–859. https://doi.org/10.1108/ics-07-2024-0163
• Champa, A. I., Rabbi, M. F., Eishita, F. Z., & Zibran, M. F. (2025). Catch me if you see: Using visual cues and explanatory feedback to enhance human phishing detection. IEEE Access, 13, 193249–193272. https://doi.org/10.1109/access.2025.3631670
• Hable, F., Hooff, B. van den, & Nina-Birte, S. (2024). Contextual Influences on Phishing Susceptibility: A Qualitative Comparative Analysis. Journal of the Association for Information Systems.
• Hable, F., Nina-Birte, S., & Hooff, B. van den. (2025). Phishing Attacks in Context: Organizational Factors Shaping Phishing Susceptibility. Journal of the Association for Information Systems. https://aisel.aisnet.org/context/amcis2025/article/1519/viewcontent/1478_doc.pdf
• Heiding, F., Schneier, B., Vishwanath, A., Bernstein, J., & Park, P. S. (2024). Devising and detecting phishing emails using large language models. IEEE Access, 12, 42131–42146. https://doi.org/10.1109/access.2024.3375882
• Li, J., & Chua, A. Y. K. (2025). Message involvement increases phishing susceptibility: can suspicion and awareness make a difference? Information and Computer Security, 34(4), 663–683. https://doi.org/10.1108/ics-04-2024-0097
• Lu, X., Jiang, J., Head, M. M., & Yang, J. (2025). Phishing detection in multitasking contexts: the impact of working memory load, goal activation, and message framing cues on detection performance. European Journal of Information Systems, 35(1), 134–164. https://doi.org/10.1080/0960085x.2025.2548543
• Luo, Y., Yazdanmehr, A., & Kumar, N. (2025). An Integrative Model of Phishing Susceptibility. Journal of the Association for Information Systems. https://aisel.aisnet.org/cgi/viewcontent.cgi?article=1504&context=amcis2025
• Mason, W., Ampel, B., Hashim, M. J., & Chen, H. (2025). Email Phishing Prevention: An Explainable Nudging Approach. Journal of the Association for Information Systems. https://aisel.aisnet.org/context/wisp2025/article/1004/viewcontent/WISP2025_paper_10.pdf
• Morrow, E. (2024). Scamming higher ed: An analysis of phishing content and trends. Computers in Human Behavior, 158, 108274. https://doi.org/10.1016/j.chb.2024.108274
• Owen, M., Flowerday, S., & van der Schyff, K. (2024). Optimism bias in susceptibility to phishing attacks: an empirical study. Information and Computer Security, 32(5), 656–675. https://doi.org/10.1108/ics-02-2023-0023
• Sarno, D. M., Gendron, C., & Volante, W. G. (2024). Filtering out the user?: Are users complacent with phishing emails due to automated filters? International Journal of Human-Computer Interaction, 41(16), 9908–9917. https://doi.org/10.1080/10447318.2024.2429759
• Shovo, Md. S. N., & Valecha, R. (2025). Phishing Email Detection Using Linguistic Cues. Journal of the Association for Information Systems.
• Sommestad, T., & Karlzén, H. (2024). The unpredictability of phishing susceptibility: results from a repeated measures experiment. Journal of Cybersecurity, 10(1). https://doi.org/10.1093/cybsec/tyae021
• Sturman, D., Auton, J. C., & Morrison, B. W. (2024). Security awareness, decision style, knowledge, and phishing email detection: Moderated mediation analyses. Computers & Security, 148, 104129. https://doi.org/10.1016/j.cose.2024.104129
• Sturman, D., Bell, E. A., Auton, J. C., Breakey, G. R., & Wiggins, M. W. (2024). The roles of phishing knowledge, cue utilization, and decision styles in phishing email detection. Applied Ergonomics, 119, 104309. https://doi.org/10.1016/j.apergo.2024.104309
• Tian, C., Jensen, M. L., Bott, G. J., & Luo, X. R. (2024). The influence of affective processing on phishing susceptibility. European Journal of Information Systems, 34(3), 460–474. https://doi.org/10.1080/0960085x.2024.2351442
• Yasin, A., Fatima, R., JiangBin, Z., Afzal, W., & Raza, S. (2024). Can serious gaming tactics bolster spear-phishing and phishing resilience? : Securing the human factor in information security. Information and Software Technology, 170, 107426. https://doi.org/10.1016/j.infsof.2024.107426