Most of us like to think we’re far too sharp to get caught out by a dodgy email, assuming anything fake will arrive full of terrible spelling, broken formatting, or wild claims about distant royalty.
In a busy office, though, the reality looks entirely different. A massive security test has shown that workers are still getting caught out in droves, especially when the bait looks like a routine workplace update, an invitation to a health check, or an unexpected prize. Scammers have largely ditched the obvious red flags and moved straight onto everyday office curiosity.
When a message blends seamlessly into the daily inbox clutter—promising a shiny new work gadget or asking you to confirm an internal appointment—that natural instinct to pause and double-check completely evaporates. Learning how these traps actually play on our daily habits is the only reliable way to catch them before you click.
Why some phishing emails work so well
Every phishing email relies on two things. It needs a sense of urgency, so that you act before you think, and it needs you to believe you will either miss out on something or end up in trouble. A message that says your account will close or a prize will vanish is designed to hurry you.
No two scam emails are equal, though. A security firm called Kaspersky used a training tool to send realistic but harmless fake emails to staff at many organisations, then counted who clicked. The results showed which themes caused the most slips, so that businesses can see where their people are most at risk.
The five topics that trick the most people
Five subjects came out on top: artificial intelligence and technology, healthcare and insurance, IT rules and compliance, gifts and promotions, and staff or human resources news. They have one thing in common. Each one feels like it belongs in a normal working day, so it doesn’t seem odd to open.
Scammers choose topics that match what people expect to hear about at work. They also tailor messages to local events and workplace routines, which makes them harder to spot. The more personal and relevant an email looks, the more likely it is to be believed.
Technology and AI lures lead the way.
Emails about technology and AI did best of all. One message, announcing the arrival of next-generation artificial intelligence, was clicked by 45% of the people who received it. That’s nearly one in two.
These messages play on curiosity and a fear of being left behind. Everyone is hearing about new tools, so an email about a big upgrade feels believable and exciting. Clicking a link like that could install harmful software or take you to a fake login page that steals your details.
The health and insurance trap is a big one as well.
Messages about healthcare and insurance caught an average of 28% of people. One email stood out far above the rest. It claimed to be a report from a sanitary inspection, and 92% of recipients clicked on it.
Anything that sounds like an official check, a medical matter or an insurance claim gets attention fast because people worry it could affect them or their workplace. Scammers use that worry. If you get a surprise report or claim you didn’t expect, pause and confirm it with the organisation through a number or website you already know.
Prizes, rules, and staff news catch plenty of people out.
Emails about IT rules and compliance fooled 26% of people, and gifts and promotions fooled 24%. One of the most successful messages invited staff to wear their national football team’s shirt for a chance to win a prize, and 66% clicked. Fun and free offers are hard to resist, especially when they feel like part of office life.
Staff and human resources messages caught 22%. The most dangerous were those about sensitive subjects that people care about, such as pay, rules, or changes inside the company. When an email touches something personal, it’s natural to open it quickly, and that’s just what the sender hopes for.
How AI has changed the warning signs
In the past, scam emails were often easy to spot. Many were written by people who didn’t speak English well, so the wording was clumsy, and the tone was wrong. That made it simple to tell them apart from messages from a real company.
Artificial intelligence has changed that. Scam emails can now sound polished, friendly and almost identical to real ones. That means the clues have moved from the writing itself to the links, the attachments and the overall feel of the message, and experts expect scams to become even more personal as the tools improve.
There are red flags that still give scams away.
Some tell-tale signs haven’t changed. Be wary of any message that pushes you to act quickly, such as a warning that your account will be shut within 24 hours. Real organisations rarely threaten their customers in that way.
Look closely at the sender’s address. Many scam emails come from a stolen account or a free email service, and the postal service will never write to you from a free webmail address. Be careful too if a message points you to documents stored on a site you don’t recognise, or sends a file that opens as a program rather than a normal document.
How training makes a difference
The best news in the tests is that training works. According to the security firm’s figures, regular lessons and practice attacks cut the number of people who fall for phishing from around 60% to just 5 to 7%. That is a huge drop for very little effort.
You don’t need a company course to get the benefit. Take a moment before you click, check the sender, hover over links to see where they really go, and ask a colleague or friend if you’re unsure. If you spot a suspicious message at work, report it to your IT team so that others are warned. A short pause is often all it takes to stay safe.
