Are you good at multitasking?
Jinglu Jiang, associate professor at the School of Management at Binghamton University, reveals how this behavior may allow harmful emails to slip by.
Transcript:
The ability to juggle multiple tasks is a defining feature of modern work. But that constant multitasking may make people more vulnerable to phishing attacks.
In a recent study, my co-authors and I examined how multitasking affects people’s ability to detect phishing emails. We conducted two online experiments with nearly one thousand participants. In both experiments, participants worked in multitasking settings. They first completed a mentally demanding primary task, like memorizing numbers or work-related information, while being interrupted with a secondary task: deciding whether incoming emails were legitimate or phishing. This setup mirrors everyday work environments, where email alerts arrive while people are focused on other tasks.
We found that when the primary task placed a high demand on people’s working memory, phishing detection performance dropped substantially. However, we also identified an important countermeasure. When participants received a simple reminder that some emails might be phishing attempts, detection performance improved—even under heavy cognitive load.
We also found that message design plays a role. Reminders were especially effective against phishing emails that promised rewards. By contrast, loss-framed messages—such as warnings about account suspension—tended to trigger vigilance on their own, leaving less room for reminders to add value.
Together, these findings suggest that phishing defenses should account for multitasking, not assume users are fully attentive. Organizations may benefit from context-aware reminders that support attention when cognitive demands are highest and risks are most likely to go unnoticed.
