Why Smart People Still Click

5 signals to spot

1. 1A lookalike sender domainThe display name matches a real colleague, but the address sits on northgate-apps.example. Northgate mail actually comes from northgate.example. Internal impersonation works because the name checks out and almost nobody expands the address field.
2. 2A meeting that really happenedThe lure anchors to a Teams call the recipient actually attended that morning. AI drafting makes this kind of specific, plausible context cheap to produce, so the message reads like a continuation of real work rather than an interruption.
3. 3Borrowed authorityA senior name turns a routine request into a quiet order. Questioning the message now feels like questioning the CFO, and most people would rather comply than escalate.
4. 4A tight, specific deadlineThe pressure is precise rather than loud: a near-term cutoff that moves the message to the top of the pile and discourages a quick verification call. This is the rushing trigger the click data describes.
5. 5The routine actionOpening a shared deck is something the recipient does every day, which is exactly why it works. In a live attack the button leads to a fake sign-in page that harvests credentials.