Skip to content Skip to Search
Skip navigation

Why do we click? The psychology behind phishing attacks

Understanding our online behaviour is a crucial step towards protecting our digital lives and businesses

Hand about to click computer mouse Pexels/Roberto Cosentino
A sense of urgency or a intriguing proposition can be all it takes to trigger that fateful click

The majority of cyberattacks in the Middle East rely on social engineering, malware, or exploitation of software vulnerabilities. Around 80 percent of successful attacks are of a targeted nature, according to a recent report from Positive Technologies.

So why do we click? Given that October is Cybersecurity Awareness month, let us look at the things that make us click and how we can ensure not to be tricked by cybercriminals.

Our personal and professional lives are entangled in the vast networks of the internet, and social engineering exploits this entanglement, often with a single, well-placed deception.

Over the years, I have become increasingly intrigued by the psychology that underpins these deceptions, particularly as they’ve evolved with the advent of disinformation and generative AI.

The landscape of phishing and social engineering attacks is not what it used to be. Once characterised by poorly written emails from a supposed “Prince”, today’s attacks are sophisticated, tailored and believable.

The rise of disinformation campaigns and generative AI has added another layer of complexity.

These technologies can generate realistic and personalised messages that can easily deceive an unsuspecting individual. This evolution reflects a deep understanding of human psychology and our sociable nature.

Four approaches

What makes us click? At the heart of social engineering lies a profound understanding of human behaviour and psychology. Attackers prey on our innate tendencies – trust, curiosity, fear and sense of urgency. 

  • Trust is our social glue, yet, in the digital realm, it can lead to mistakes. An adeptly created email impersonating a trusted colleague or a reputable organisation can catch us off guard, and we fall into the trap.
  • Curiosity is another aspect of human nature that phishers exploit. An exciting proposition or a message with a cliff-hanger exploits our inquisitive nature, and we unknowingly click.
  • Fear is a potent tool that cybercriminals misuse. A fabricated tale of a security breach or a compromised account compels us to delve further and we click open the malicious email. 
  • Creating a sense of urgency is often the coup de grâce in the phisher’s scheme. A concocted narrative of a fleeting opportunity or an imminent threat compels us to act hastily, and we ignore our instinct and the feeling of scepticism that might have otherwise saved us.

A well-crafted phishing email may impersonate a trusted colleague, stoke fear about a supposed security breach, or spark curiosity with a “too-good-to-be-true” proposition and before we know it, we’ve clicked and the malicious cycle begins.

Exploiting fear

Recent years have seen a spate of successful social engineering attacks that underscore the effectiveness of these psychological exploits.

Take, for example, the exponential rise in phishing-related scams during the Covid-19 pandemic. Cybercriminals preyed on the global fear and uncertainty, crafting emails impersonating health organisations or offering essential supplies.

The psychological underpinning was clear: exploit the pervasive fear and urgency to prompt a click, a download or a share of sensitive information.

The psychological sophistication of these attacks begs the question: How do we safeguard against an enemy that understands us so well?

Education and awareness are crucial first steps. Understanding the psychology of social engineering and the tactics employed by cybercriminals can foster a healthy sense of scepticism and caution.

It is also important to avoid haste and distractions when dealing with technology, even if it is just an email. If the email is from a colleague or an organisation, verify with them directly on a separate communication platform before responding to their initial communication channel.

Trust your instinct: there will be a red flag if you read carefully and examine the message.

Moreover, it is important for individuals and organisations to adopt robust cybersecurity measures and stay abreast with the evolving threat landscape. 

The marriage of psychology and technology in the realm of social engineering presents a formidable challenge. As the line between the real and the digital continues to blur, so does the line between trust and deception.

The onus is on us to remain vigilant, to question the too-good-to-be-true, and to foster a culture of cybersecurity awareness that can withstand the psychological onslaught of social engineering.

Do remember that you don’t just win without doing anything and hardly anything comes for free. Be especially careful with links and downloads.

In an era where disinformation and sophisticated digital deceit are the norm, understanding the “why” behind our clicks is not merely a matter of intellectual curiosity, but a crucial step towards protecting our digital lives and businesses against the ever-evolving threat of social engineering.

Matthew White is a partner at PwC Middle EastHe leads the cybersecurity and digital trust practice for the region and is a leader in virtual assets

Latest articles

Turkey foreign property sales

Foreigners turning back on Turkish real estate

Foreign buyers are increasingly shunning the Turkish property market, wary of high prices, the expensive cost of living and a less welcoming environment for overseas real estate investors. There were only 2,064 residential units sold to foreign buyers in May, 35 percent down on the same month last year, data issued by the state statistics […]

Adult, Male, Man

UAE to invest in Turkey’s economic sectors says minister

The UAE is willing to invest across numerous sectors in Turkey, said Emirati energy and infrastructure minister Suhail Al Mazrouei. The Gulf state is exploring opportunities in the energy, agriculture, transportation, tourism and other sectors, state-run Anadolu Agency (AA) news agency reported, citing the minister on the sidelines of the St. Petersburg International Economic Forum. […]

Opec Secretary General Haitham Al Ghais says peak oil 'is not on the horizon'

Upstream oil and gas ‘needs more annual investment’

Annual capital expenditure for exploration and production in the upstream sector of the oil industry needs to increase by 22 percent by 2030 because of growing demand and cost inflation, experts say. A cumulative $4.3 trillion needs to be invested between 2025 and 2030, according to a report by the International Energy Forum (IEF) and […]

Rothschild Saudi

Edmond de Rothschild to run funding vehicle for Saudi projects

The Edmond de Rothschild Group is establishing a funding vehicle for infrastructure projects in Saudi Arabia along with the local firm SNB Capital, as part of a deal in which the Swiss investment bank will set up offices in the country.  Saudi Arabia’s massive economic diversification programme has run into financial obstacles as it faces […]