Hook, Lineand Sinker – Phishing Attacks at 4:55 pm on a Friday

Massive face palm moment – it’s not stupidity, it’s human psychology

Stress, tiredness, engaging in tasks under timepressure, experiencing an environment with multiple sources of stimuli have all been proven to increase errors in human judgement. This is not just a cybersecurity problem. Researchers studied 21,000 doctor visits and found that doctors prescribed more antibiotics as the a long workday wore on. Once decision fatigue sets in, tipping people over into the realm of bad decision making becomes easier. In a different study of 62,000 employees, authority cues made people more likely to click. Another study by the University of Verona, found urgency worked even better. Sleep-deprived people are worse at resisting pressure from authority figures.  One lab study found heavy workload alone didn’t raise clicks across the board. But people DID click more on fakes that looked like part of their to-do list. Which is EXACTLY what a toll bill looks like.

What is YOUR family’s attack surface?

In enterprise security we obsess over the “attack surface” – every server, portand laptop a cybercriminal can attack. Now walk around your home. The router is patched (right?), you set it to happen automatically ... maybe? What about that smart TV? And the smart speaker? Those app connected light bulbs? We don’t have to go too far down the list of connected devices in our home before we start to see that we don’t have the answer to these questions. These devices come with the ability to secure them, so where is the failing? The most exposed attack vector in the house is the tired, rushed, distracted and trusting humans. That’s you. That’s me. Phishing was the NUMBER ONE crime reported to the FBI in 2025: 191,561 complaints. A staggering number of phishing attacks don’t get reported at all. Over a million phishing sites were identified in just Q2 2026 alone and people aged 60+ lost over $7.7 billion as per the FBI.

‍

Three levers, three sample headlines,one point of failure

Tipping us over in to the realm of dubious decisionsonce we hit our limits of decision fatigue is something used by marketers toget us to buy more stuff but also by criminals. So, what tips us over?

Urgency: That toll text example is real. I have got them multiple times myself! Inspring 2024 the FBI warned of over 2,000 complaints about fake toll texts in barely a month, each threatening a late fee. Some people did fall for it. The point of failure? A human being.

Authority: A finance employee at Arup’s Hong Kong office joined a video call with his“CFO” and several colleagues. They looked like his co-workers, spoke like his co-workers and the employee had no reason to believe anything was amiss. Problem was, every single person on the call was an AI generated deepfake impersonation. Fifteen transfers later, $25.6million was GONE and the employee had just executed what they thought was their boss’s orders. Point of failure? Again a human being.

Fatigue: Marks & Spencer, a European retailer, identified a cyberattack over Easter weekend 2025, after attackers social engineered their way past a third-party IT help desk. The bill? Roughly £300 million. Point of failure? You get it.

The techniques are many but fundamentally all of these attacks leveraged a prime moment of vulnerability of a human being to execute an attack – 4:55pm on a Friday is but one of those moments. The odds are also in favor of criminals. As adept as you may be in spotting phishing attacks yourself, the criminals can fail a million times and it costs them almost nothing whereas you cannot fail even once.

Red flags (and how to spot them)

We human beings are the first and last lines of defense. Developing the muscle memory to automatically identify warning signs is key.

• A ticking clock (“today,” “late fee,” “suspended”). Real institutions give you days to resolve an issue. Go to the official site yourself, never through a link you get in a message.
• The boss, the bank or the government. Hang up and call back on a number you already have when you are pushed to make a critical decision.
• A sudden new channel (“hey, let’s move to WhatsApp”). Verify on a channel you already trust.
• A familiar face or voice with an unfamiliar ask.  Again, call them back on a number you already have. If it is family, agree on a family safe word that only your family can recognize. It is two factor authentication done differently.
• Perfect timing for them, terrible for you: Friday evening, holidays, dinner time be suspicious of any messages that involve     money or passwords or accounts.
• A suspiciously tiny amount. $7.51 is designed to feel too small to question. Overcome the urge to just pay it and get it over with.

Let’s make “Pause, Verify, Engage to confirm and THEN Act” part of your family’s cyber hygiene muscle memory. It is not about feeling good in how effectively we can spot the phish but rather being expert enough to never fall for it. Even professional atheletes who can accomplish an athletic feat with awe inspiring accuracy and consistency fail a few times. But what we are training our muscle memory towards in this endeavor is a lifelong 0% failure rate. Hygiene is essential but we will need help as well. More on that part later ... stay tuned.