A tripartite account of phishing detection: the importance of glucose in supporting the algorithmic mind

Despite substantial investment in technical safeguards, employees continue to fall for phishing emails at high rates, and the cognitive decision-making processes that drive this susceptibility remain comparatively understudied relative to technical countermeasures. The present research addresses this gap by applying the tripartite model of dual-process theory and prospect theory to examine cognitive responses to phishing and legitimate emails. Two studies were conducted. Study 1 shows that deliberative (as opposed to intuitive) thinking enhances detection accuracy but also increases false positives due to heightened scepticism and risk aversion, and that deliberative thinking is more effective for loss-framed than gain-framed emails. Study 2 experimentally manipulates glucose levels to influence the algorithmic mind (the computational power underlying deliberation) while controlling for the reflective mind (the attentional control underlying deliberation); results confirm a correlation between the reflective mind and detection accuracy and a causal link between the algorithmic mind and detection performance. These findings underscore the dual impact of deliberative thinking: improving phishing detection while increasing susceptibility to false positives. Furthermore, the study indicates that physiological states, such as glucose levels, can modulate deliberative thinking, offering organisations insight on human-centric approaches to enhancing detection accuracy.