Checking Email While Busy? That’s When Phishing Scams Get You

Study show that when attention is stretched, particulary from multitasking, even security-savvy people slip.

HAMILTON, Ontario — Workers juggling multiple tasks are far more likely to fall for phishing emails, according to new research that questions how organizations train employees to spot digital threats.

A study published in the European Journal of Information Systems. found that people asked to remember information while evaluating emails showed measurably worse judgment about which messages were legitimate. When participants held eight digits in memory compared to just two, their ability to identify phishing attempts dropped noticeably.

Results point to a troubling reality: Most people encounter suspicious emails not during quiet, focused moments but while mentally occupied with other work demands.

“Phishing detection is not merely a reactive response to external cues; users must mentally represent the detection goal, sustain it amid competing demands, and retrieve it at the moment of decision,” the researchers wrote.

The Multitasking Problem

Scholars from McMaster University, Binghamton University, and the University at Albany recruited more than 900 participants across two online experiments. Participants completed memory tasks of varying difficulty, then evaluated a mix of legitimate and phishing emails designed to mimic real-world threats.

Those handling the more demanding memory task showed reduced accuracy in flagging suspicious messages. Researchers measured not just whether people made correct choices but also their confidence in those decisions, creating a composite score of detection quality.

The experiments recreated everyday multitasking, like pausing work to check an email. Email checking works the same way for most office workers: not as a standalone activity but as a secondary task that breaks into other work.

Why Current Training Falls Short

This research raises questions about current security training approaches. Most programs assume people evaluate emails during distraction-free conditions, yet cognitive load from ongoing work proved to be a barrier to threat detection.

Researchers drew on Memory-for-Goals theory, a psychology model explaining how people retrieve and act on goals when switching between tasks. Under this theory, the mental goal of scrutinizing emails for threats must be actively brought back to mind and can easily be displaced when working memory is already taxed by other demands.

Prior research has focused heavily on individual traits like age or personality, or on message characteristics like urgent language or authority cues. The current study shifts attention to the cognitive state users are in when they encounter threats.

When Simple Reminders Make a Difference

Researchers also tested a potential solution: brief reminders that appeared between tasks, explicitly telling participants to focus on detecting phishing attempts. These goal activation prompts improved detection accuracy, especially when people were under higher cognitive load.

Reminders proved most effective for emails framed around potential gains, such as prize notifications or refund offers. Warning-style emails triggered more caution on their own, reducing the added benefit of external reminders.

Male participants showed stronger benefits from the reminder intervention compared to female participants. Researchers note this may reflect gender differences in baseline security vigilance, with women maintaining more consistent caution regardless of whether they received prompts, though they caution against drawing firm conclusions from this pattern.

What This Means for Workplace Security

Findings point toward context-aware security systems that could recognize when someone’s attention is stretched and deliver targeted alerts at those vulnerable moments. Such systems might monitor signals like typing patterns, task-switching frequency, or time since the last break to infer mental load, though the study did not test real-time monitoring tools.

Rather than treating all phishing threats uniformly, security tools could prioritize reminders for gain-framed messages while allowing loss-framed warnings to rely on their inherent ability to trigger suspicion.

Results also show training should incorporate realistic conditions. Simulated phishing exercises might be more effective if conducted during busy periods rather than in dedicated training sessions, better preparing employees for the actual circumstances under which they’ll need to make security judgments.

With an estimated 3.4 billion malicious emails sent daily, even modest improvements in detection rates could prevent substantial harm. The study demonstrates that relatively simple interventions, delivered at the right moment, may offer practical protection without requiring extensive behavioral change or expensive technology overhauls.