Phishing exploits cognitive biases that override rational thinking. Urgency creates panic — "Your account will be suspended in 24 hours" forces a snap decision. Authority triggers compliance — an email from "your CEO" requesting a wire transfer bypasses normal skepticism.

Fear of loss is a common trigger. Telling someone they have been compromised can make a "security link" feel urgent, and curiosity works too — a subject line promising leaked salary data will tempt many people.

Recognizing the emotional trigger is one of your best defenses, because once you notice the manipulation, the spell weakens.