Data-Driven Analysis of Linguistic Patterns and Psychological Triggers in Dutch Phishing Emails

Despite technological advancements in cybersecurity, phishing emails remain a primary vector for cyberattacks due to their sophisticated exploitation of human psychology. While existing research has examined phishing susceptibility, studies have typically relied on small scale datasets and text analysis methods, limiting our understanding of how these attacks evolve and target specific cultural contexts. This paper addresses this gaps of knowledge by investigating phishing emails targeting the Dutch population through an analysis of linguistic patterns, thematic content, and psychological manipulation techniques. Using a dataset of 8,000 phishing emails, we employ advanced natural language processing techniques, including BERTopic modelling and frequency analysis. Our findings reveal that phishing emails predominantly utilize business and financial terminology, emphasising essential Dutch services. Our thematic analysis of the email contents identifies eight distinct narratives, demonstrating the attackers' detailed understanding of Dutch institutional frameworks. The analysis of psychological triggers shows a sophisticated evolution beyond simple urgency-based tactics, combining elements of authority, trust, and urgency. These insights contribute to understanding modern phishing tactics and suggest the need for improved, contextually aware security training approaches.