Social engineering: why it works even with people who have been warned

In 2025, a team of researchers at UC San Diego Health measured what the training industry rarely measures: how much real behavior changes after training. The module that appears after clicking on a trap email reduced the probability of falling for it again by just 2%, and completing the annual training had no significant relationship with risk.

I’ve been hearing the same promise in other people’s sales pitches for years: train your people and risk goes down. It does go down, that’s true, but that phrase never says how much risk remains afterward, and the evidence says it is never zero.

This piece does not catalog specific techniques: it discusses why knowing them is not enough.

Training reduces risk, but never to zero

Training lowers the risk of falling for it, but neither of the two studies I cite here brought it to zero. The UC San Diego Health study, by Grant Ho and his team, came out in the IEEE Symposium on Security and Privacy, one of the top-tier academic security conferences.

It followed more than 19,500 employees for eight months through ten simulated campaigns and measured the module that appears after the click: it reduced the probability of falling for it again by 2%. Three quarters of people interacted with it for one minute or less; one third closed the page without reading.

A 2019 JAMA Network Open study, with nearly three million simulated emails across six health care institutions in the United States, measured something else: repeated exposure to phishing and smishing drills. After more than ten prior campaigns, the probability of clicking fell by about 67% compared with someone who had never seen a drill, but it did not reach zero: the most trained cohort was still clicking.

The two studies measure different interventions, a one-off module and habituation through repetition, and they do not contradict each other.

The reason is not lack of knowledge: it is that context turns off checking

NIST’s Phish Scale explains it. In addition to counting an email’s warning signs (errors, odd sender, poorly executed urgency), it measures how well the pretext fits the role and context of the person receiving it. The greater that alignment, NIST says, the less likely the person is to notice, attend to, or think about suspicious signs.

Knowing a technique means knowing generic signals, and that is the limit. The email that imitates the payroll provider, sent on payday, does not deceive because the victim does not know what phishing is: it deceives because the context turns off checking before the signals are processed.

The underlying mechanism is cognitive load: under time pressure or stress, the person processes the email quickly and heuristically instead of analytically. A 2025 experiment published in Information & Computer Security measured this with 200 people classifying emails with 15 or 7 seconds per message. Under pressure, detection sensitivity fell from 1.07 to 0.45 (p < 0.001).

Authority and reciprocity deceive more than scarcity

In that same experiment, the persuasion principles that were detected worst were reciprocity and authority: the favor to return and the request from a superior. Scarcity and social proof, contrary to expectations, were the ones people detected best.

Pressure degraded detection in general, regardless of the type of lure. The sample was mostly university-based: that the mechanism persists in already trained people is supported by the two previous studies, conducted in real organizations.

What does resist: a design where the stolen credential is useless

A 2023 joint guide from CISA, NSA, FBI, and MS-ISAC puts training first on a list of six controls, alongside DMARC, internal messaging monitoring, and credentials with phishing-resistant multifactor authentication. And it clarifies that ordinary MFA is not enough either if the second factor is the wrong type.

CISA calls FIDO/WebAuthn authentication the "gold standard" and asks organizations to prioritize migration. The protocol cryptographically verifies the domain before completing login: even if the victim clicks and enters their password on a fake site, the second factor is not completed against a domain that is not the legitimate one, unlike traditional MFA by SMS or code.

That is why social engineering is defeated with a design where successful deception stops mattering, more than by teaching people to recognize it better.

What VU does

At VU we work on authentication designed for this specific problem: ensuring the second factor does not depend on the person detecting the deception at the exact moment of the attack. Learn about VU authentication.

Training reduces risk. System design is the only thing that makes it irrelevant.

If your organization already invests in awareness and you continue to see phishing incidents, ask yourself what technical controls you have running underneath.
Let’s talk about your authentication.