DIGITAL LIFE

Even modest sleep loss may leave people more vulnerable to email scams

A poor sleep schedule doesn’t only affect your overall mood, energy levels, and long-term health. New evidence indicates that losing as little as one hour of rest may increase your chance of falling for an online scam by over 10 percent the following morning. Neurobiologists at the University of California, Irvine, laid out their findings in a study published today in the Proceedings of the National Academy of Sciences (PNAS), arguing that even minimal sleep disruptions can have almost immediate consequences.

“Our results demonstrate that even though you may not be aware of it, lack of sleep leads to impulsive choices, and you may lose more than you gain from putting sleep on the back burner,” said UC Irvine neurobiologist and study co-author Eitan Schechtman.

If you have already fallen prey to a scam email in the past, you can at least take some small comfort in the knowledge that you aren’t alone. Cybercrimes continue to increase exponentially in the United States. The FBI’s Internet Crime Complaint Center received over one million reports in 2025—a nearly 25 percent increase from only five years earlier.

Remaining aware of con artist tactics and staying up-to-date on personal cybersecurity strategies are some of the best ways to protect yourself. However, Schechtman and his colleagues recently wondered if something as seemingly inconsequential as a single evening of bad sleep may also put people at risk for schemes like an email phishing attack. To investigate, the team partnered with a large, unnamed company as it ran a cybersecurity awareness campaign for more than 11,000 employees. Multiple times a year, the company’s IT department issued emails imitating phishing attempts, then tallied how many workers clicked through the fake malicious links. Schechtman’s team then analyzed results both before the switch to Daylight Saving Time (DST), as well as the Monday after employees lost an hour of sleep.

On the Monday prior to DST, workers clicked on a phishing email link about 15.5 percent. of the time. Then, the Monday immediately following DST saw that rate rise to about 17.7 percent. That may not seem like much, but the difference comes out to about a 13 percent increase in phishing victims after losing approximately just one hour of sleep. According to Schechtman, there are multiple ways to contextualize these results.

“First, they give us a peek into the effects of very minor sleep loss… [from] Daylight Saving Time, which is similar in scope to the kind of sleep loss that many of us experience daily,” he said. “Although we focused on cybersecurity, many of our day-to-day decisions are likely compromised in similar ways.”

Schechtman hopes both employers and cybersecurity companies take regularly sleep-depriving events like DST, holidays, and even primetime sporting events into consideration when advising the public on phishing awareness. In the meantime, he stressed that even those who regularly suffer from sleep issues continue to prioritize their rest as much as possible.

Why are people more vulnerable to phishing scams when multitasking, and what does your research reveal about how our brains process these threats?

When we multitask, our mental resources become stretched, making it harder to focus. For instance, if we are deeply engaged in tasks like analyzing data, writing a report, or browsing the web, and a phishing email arrives, our ability to detect it accurately can drop significantly.

The more mentally demanding the task we’re working on (referred to as high working memory load), the harder it is to shift our attention and properly evaluate the suspicious message.

Our study shows that high working memory load during multitasking impairs the brain’s ability to notice subtle warning signs that something might be off.

In these moments, we are more likely to miss red flags in phishing emails and click on malicious links without questioning their legitimacy.

Your study found that simple cues can improve phishing detection. What might these cues look like in real-world settings?

Goal activation cues are small, timely reminders that bring the “think before you click” mindset back to the forefront right before someone interacts with a suspicious message.

In everyday environments, this could include:

-Pop-up reminders: A brief message like “Be cautious! This email might be suspicious” that appears when opening emails.

-Nudges during multitasking: Systems that detect when users are multitasking (e.g., rapidly switching between apps) or working on complex tasks. In those circumstances, when users shift to checking email or responding to a pop-up message, a gentle prompt can remind them to stay alert.

-Visual cues: Subtle interface cues like a colour change, warning icon, or sound notification, can signal that a message might be suspicious.

Our research shows these cues are most effective when delivered just in time, especially during high workload moments when users are most distracted.

Rather than adding more information, these cues work by reactivating the mental goal of phishing detection, helping users refocus and make safer decisions.

How does the framing of phishing messages affect our ability to spot them?

Phishing messages often use gain framing (e.g., “Claim your reward!”) or loss framing (e.g., “Your account will be locked!”) to manipulate recipients.

Loss-framed messages tend to trigger stronger self-protection instincts and vigilance, making people more likely to recognize them as suspicious. In contrast, gain-framed messages are less likely to raise immediate concern, which makes them harder to detect, especially when people are multitasking and under high cognitive load.

Our research shows that goal activation cues are particularly effective for gain-framed phishing emails. Because these messages don’t naturally prompt suspicion, a timely reminder, like a security nudge or visual cue, can help users refocus and engage their phishing detection mindset before clicking.

What practical advice would you give to organizations trying to reduce phishing risks?

Organizations should design security interventions that reflect the realities of multitasking in the workplace. Based on our research, we recommend four key strategies:

-Train in realistic conditions: Most security training assumes users are focused and free from distractions but in reality, employees often face interruptions and cognitive overload. Training should simulate phishing scenarios during busy moments, such as task switching or right after meetings, rather than in ideal, distraction-free settings.

-Use lightweight, context-aware reminders: Implement small, timely goal activation cues (e.g., short prompts, icons, or alerts) that nudge users to refocus their attention at critical moment.

-Tailor cues to message type: Gain-framed phishing messages (e.g., “Claim your reward!”) tend to lower users’ guard. These messages benefit most from extra reminders that prompt caution.

-Encourage “distraction shielding”: Help employees build habits of pausing briefly before clicking links or responding to urgent emails, especially when multitasking.

Our study shows that phishing risk is not just about poor training. It is about how human cognition works under real-world pressure.

Effective security interventions should avoid overwhelming users with constant alerts and instead focus on precision: helping people refocus their attention at the exact moments when they are most likely to slip into autopilot.

Even a modest loss of sleep—such as the single hour lost during the transition to Daylight Saving Time—increases an employee's likelihood of falling for email phishing scams by about 13% to 14%.

Key study findings:

• The Research: Neurobiologists at the University of California, Irvine (UCI), led by Dr. Eitan Schechtman, tracked simulated phishing attacks around the spring Daylight Saving Time clock shift.

• The Numbers: On the Monday prior to the time change, employees clicked on simulated phishing links at a rate of 15.56%. On the Monday immediately following the loss of one hour of sleep, that click rate jumped to 17.76%—a relative increase of roughly 13% to 14%.

• Underlying Mechanism: Mild sleep deprivation impairs executive function and increases impulsive decision-making, making tired brains far more likely to take phishing bait without recognizing red flags.

• Broader Impact: The findings reflect daily sleep deficits that many people experience regularly due to work hours, stress, or screen use, extending beyond calendar clock shifts to periods like holidays or major sporting events

mundophone