Unmasking persuasion in phishing: a content analysis of principles of persuasion in emails and subject lines

Phishing, as defined by the Anti-Phishing Working Group (APWG, 2024), is a crime that employs social engineering and technical subterfuge to steal personal identity data and financial account credentials. This definition highlights the dual nature of phishing attacks, which exploit both human psychology and technological vulnerabilities to achieve their malicious objectives (Kheruddin et al., 2024). Social engineering tactics are particularly effective because they manipulate unsuspecting individuals into believing they are interacting with a trustworthy source. This often involves using misleading subject lines or crafting emails that appear legitimate, thereby increasing the likelihood that victims will disclose sensitive information (Ferreira et al., 2015).

Research indicates that despite ongoing efforts to educate users about phishing, many individuals still fall victim to these attacks. For instance, a report from the Australian Competition and Consumer Commission (ACCC, 2024) revealed that 66,286 phishing emails were reported in Australia by October 2024, resulting in significant financial losses totalling over $32m this year. Furthermore, the APWG recorded 877,536 phishing attacks in the second quarter of 2024, indicating a stable yet alarming prevalence of these incidents. This persistence suggests that while users may receive training to recognize phishing attempts, the sophistication of the tactics employed by phishers continues to evolve, necessitating a shift in research focus from user vulnerabilities to the characteristics of phishing emails themselves (Ojugo and Nwankwo, 2021; Zielinska et al., 2016).

The aim of this study is to analyse the phishing email samples based on Principles of Human Persuasion in Social Engineering, as they are applied to the content and subject lines of phishing emails. Ferreira and Teles (2019) provided a framework for understanding how social engineering exploits psychological and persuasive principles to manipulate individuals into complying with requests for sensitive information. By examining both the content and subject lines of phishing emails, this study seeks to identify the specific or combination of persuasion principles as social engineering tactics that phishers employ to effectively convince victims to disclose their personal information. This approach is crucial, as understanding the methods used by attackers can inform the development of more effective countermeasures and training programs (Alsharif et al., 2022).

Butavicius et al. (2016) found that individuals exhibiting lower impulsivity in decision-making were generally less likely to perceive fraudulent email links as safe and lower cognitive impulsivity can protect against spear phishing. This underscores the importance of considering individual personality differences and characteristics when developing tailored phishing awareness training programs. Valuable insights for personalizing such training can also be obtained by analysing the crafting techniques employed in phishing emails. Moreover, research highlights that while phishing awareness training significantly enhances users’ initial ability to identify phishing emails, the retention of this knowledge diminishes over time, particularly when encountering novel or sophisticated phishing techniques (Kalio, 2022), underscoring the necessity for continuous education and regular reinforcement aligned with evolving phishing trends to maintain user vigilance (Shi et al., 2021).

Furthermore, phishing attacks leverage psychological manipulation through social engineering, using deceptive tactics to exploit human emotions, obedience and vulnerabilities for accessing sensitive information such as usernames and passwords (Naz et al., 2024); attackers often employ emotionally charged language, creating urgency or fear to compromise rational decision-making (Sharma and Bashir, 2020), making the understanding of these psychological triggers critical to developing effective phishing countermeasures (Abroshan et al., 2021).

The complex nature of phishing attacks requires an extensive approach that addresses both user susceptibilities and the strategies used by attackers. This study focuses on the Principles of Human Persuasion in Social Engineering to explore how these tactics are leveraged by phishers to manipulate victims. Additionally, it aims to identify trends and conduct comparative analyses over different time periods, highlighting the latest developments.

Understanding combinations of persuasion principles is critical because real-world phishing emails rarely rely on a single tactic in isolation. Combinations create layered, more convincing messages that are harder for users – and automated systems – to detect. This complexity represents a significant challenge for cybersecurity awareness training programs, phishing simulation designers and anti-phishing software developers. By identifying the most common patterns of these combinations, our findings can inform training that exposes users to realistic, multi-cue attack scenarios, improving their ability to recognize sophisticated phishing attempts. Although teaching users to detect such intricate combinations may seem challenging, explicitly highlighting these patterns can increase awareness of subtle manipulation tactics and strengthen overall defensive strategies.

Research Questions:

Recent studies have increasingly focused on understanding the principles of persuasion used in social engineering attacks across different cybersecurity fields (Khadka et al., 2023). Cialdini’s six principles of persuasion authority, social proof, liking/similarity, commitment/consistency, scarcity and reciprocation are among the most studied principles in phishing. Among these, authority and distraction have been identified as particularly effective in phishing emails (Ferreira et al., 2015). Meanwhile, the use of commitment/consistency and scarcity has increased over time, while reciprocation and social proof have seen a decline (Zielinska et al., 2016).

Research has consistently demonstrated that use of these principles as manipulation tactics significantly enhances the effectiveness of phishing attacks. Cialdini’s six principles authority, social proof, scarcity, liking, commitment and reciprocity have been adapted by attackers to exploit human vulnerabilities and induce compliance (Bayl-Smith et al., 2021; Lawson et al., 2017). Phishers often utilize heuristic cues including authority, urgency and familiarity to persuade users into acting swiftly without fully analysing the content of the message (Frauenstein and Flowerday, 2020). Individuals with personality traits like neuroticism or openness may be particularly vulnerable to these tactics due to heightened emotional reactivity or curiosity. Persuasive strategies are often customized to elicit emotional responses or appeal to a user’s desire for novelty or exclusivity. According to Frauenstein and Flowerday (2020), personality traits, such as agreeableness, also play a significant role in determining an individual’s susceptibility to phishing attacks. Individuals with specific characteristics may be more easily swayed by persuasive tactics and cognitive biases, for example, attackers often impersonate familiar individuals or brands to foster trust (social proof) or simulate a crisis to instil fear (Frauenstein and Flowerday, 2020), suggesting the need for tailored interventions based on individual needs.

Content analysis has been instrumental in revealing the range of strategies used to elicit emotional responses in phishing attacks. Kim and Hyun Kim (2013) conducted an in-depth analysis of phishing messages, categorizing them into rational and emotional appeals. They found that emotional appeals, such as the fear of loss or the promise of rewards, were particularly effective in persuading recipients to engage with phishing content. These findings align with Taib et al. (2019), who emphasized that phishing emails often leverage established psychological principles to enhance perceived credibility while reducing recipients’ critical evaluation.

The role of subject lines in phishing emails is crucial as well, as they serve as the first point of engagement. Studies have found that subject lines invoking urgency or fear, such as “Immediate Action Required: Verify Your Account,” are more likely to elicit responses than neutral or vague alternatives (Atkins and Huang, 2013; Williams and Polage, 2019). This effectiveness is further corroborated by Harrison et al. (2016) and Ferreira and Teles (2019), who highlighted how persuasive elements in subject lines affect users’ cognitive processing of phishing emails and effectiveness of it.

The impact of phishing emails is further amplified when messages are tailored to fit the recipient’s context or interests, a tactic referred to as contextualization and personalization or spear phishing (Khadka et al., 2023). Tambe Ebot (2019) argued that personalized messages, especially those referencing recent interactions or transactions, significantly increase perceived legitimacy and reduce scepticism. By making phishing email attempts appear relevant to the recipient’s recent activities, attackers can effectively lower their guard and prompt action.

The application of persuasion principles extends beyond email phishing to other types of social engineering attacks. Research shows that social engineering attacks exploit these principles to manipulate targets, significantly influencing risk-taking behaviours across different cultural contexts (Goodman-Delahunty and Howes, 2016).

The development of detection systems based on three principles (i.e. Authority, Reciprocation and Scarcity) out of Cialdini’s six principles of persuasion has shown promising results in identifying phishing emails through the presence of manipulative tactics (Li et al., 2020). Such insights have applications in user training, improvement of security software and the design of effective defences against phishing (Ferreira and Lenzini, 2015; Zielinska et al., 2016).

While Cialdini’s principles provide a strong foundation for understanding phishing, they were originally developed for marketing and general communication, which may not fully capture the nuances of phishing in electronic contexts. To address this gap, Ferreira and Teles (2019) proposed a specialized framework called Principles of Human Persuasion in Social Engineering that draws upon foundational research by Cialdini (2007), Gragg (2003) and Stajano and Wilson (2011), offering a more targeted approach for social engineering.

Gragg (2003) identified key psychological triggers that enhance the effectiveness of social engineering, such as strong affect, overloading, reciprocation, deceptive relationships, diffusion of responsibility, moral duty, authority and integrity. Stajano and Wilson (2011) added a broader perspective, analysing how victims fall prey to fraudsters. Ferreira and Teles (2019) adapted these insights into a framework specific to phishing, recognizing the limitations of broad principles of persuasion and focusing on those directly relevant to manipulating email recipients.

Although significant research has explored the psychological underpinnings of phishing, gaps remain in understanding how these principles adapt to evolving communication technologies and sophisticated attack. Consequently, education and awareness become crucial for enabling users to recognize the subtle discrepancies present in phishing attempts. Our earlier literature review shows that much of the current research has focused on users’ profile like demographic factors that influence susceptibility to phishing rather than the evolving strategies and the complex mechanics of phishing attacks as well as sources of the phishing attacks itself which is designed using the persuasive tactics (Lawson et al., 2019). Moreover, the adaptability of phishing methods is evident in the shift from generic attacks to more targeted campaigns such as spear phishing, advanced persistent threats (APTs) and whaling (Do et al., 2022).

The literature review highlights that previous studies have primarily focused on Cialdini’s principles of persuasion. However, there is a significant gap in research exploring how combinations of these principles are applied in phishing attacks. Most studies examine individual principles in isolation, overlooking their potential synergistic or antagonistic interactions. Additionally, earlier research has largely centred on how users are affected by these principles; this study shifts the focus to understanding the phishers’ approach. This perspective is crucial as traditional automated detection systems often depend on identifying technical errors, such as spelling and grammatical mistakes. However, with the advent of generative artificial intelligence (AI), such errors are likely to diminish, necessitating a deeper investigation into the use of persuasion tactics throughout the entirety of phishing emails.

This study seeks to extend the framework of Principles of Human Persuasion in Social Engineering, as integrated by Ferreira and Teles (2019), by conducting a comprehensive analysis of both the subject lines and full content of phishing emails. This dual-level analysis provides a holistic perspective on how attackers craft their messages to exploit principles of persuasion effectively. The study enhances our understanding on how specific tactics, including combinations of different principles, are employed to manipulate recipients effectively. By comparing and analysing trends over time between subject lines and full email content, this research intends to reveal temporal differences in the application of persuasive strategies, thereby providing insights that may contribute to the development of improved phishing detection and defence mechanisms.

This study examines and analyses data collected from both the full email content and email subject lines to address the research questions. A qualitative research approach was employed, utilizing content analysis as the primary method. NVivo software was used to conduct this content analysis, allowing for systematic coding, categorization and examination of persuasive elements in phishing emails based on the principles of persuasion. NVivo is a qualitative data analysis software developed by QSR International, designed to facilitate the organization, management and analysis of qualitative data. It provides researchers with a comprehensive set of tools that support various analytical approaches, including thematic analysis and coding, which are essential for extracting meaningful insights from qualitative data (Limna, 2023). The data were analysed using deductive content analysis, guided by the Principles of Human Persuasion in Social Engineering as defined by Ferreira and Teles (2019). Deductive analysis, or deductive reasoning, in qualitative research involves applying pre-existing theories or frameworks to analyse data systematically. In this study the email content and subjects were studied qualitatively, based on defined Principles of Human Persuasion in Social Engineering. Specifically, five major principles were used to analyse the phishing emails and their subjects. Two study was conducted: first, the email subject lines was examined just like Ferreira and Teles (2019) has conducted the study. In a subsequent study, the entire email content, along with the subject, was analysed once. For the coding process, to guide the deductive reasoning, the following main principles and sub-principles integrated by Ferreira and Teles (2019) were used:

1. Authority (P1)

2. Social Proof (P2)

   • Herd (P2.1)

   • Diffusion of Responsibility (P2.2)

   • Moral Duty (P2.3)

3. Deception (P3)

   • General Deception (P3.1)

   • Deceptive Relationship (P3.2)

   • Liking and Similarity (P3.3)

4. Distraction (P4)

   • Scarcity (P4.1)

     • Scarcity of Time (P4.1.1)

     • Scarcity by Other Factors (P4.1.2) (excluding scarcity of time)

   • Overloading (P4.2)

     • Overloading by Time (P4.2.1

     • Overloading by Other Factors (P4.2.2) (excluding the time)

   • Strong Affect (P4.3)

   • Need and Greed (P4.4)

5. Integrity (P5)

   • Integrity (P5.1)

   • Consistency (P5.2)

   • Commitment (P5.3)

     • Commitment by Dishonesty (P5.3.1) (excluding commitment by other factors)

     • Commitment by Other Factors (P5.3.2) (excluding commitment by dishonesty)

   • Reciprocation (P5.4)

This coding process allowed for a structured analysis of the phishing emails based on established principles of persuasion in social engineering. These principles are particularly suitable in a social engineering context because they bridge gaps between different aspects of human vulnerabilities and weaknesses making them a comprehensive tool for analysis. Notably, other researchers, namely, Ahmad et al. (2023), Akdemir and Yenal (2021), Ferreira and Teles (2019) and Jones et al. (2020), have validated these principles across various social engineering attacks, including vishing (voice phishing), email subjects, coronavirus themed phishing emails and mobile instant message phishing, further validating their applicability and relevance in broader cybersecurity studies.

This study analysed 200 phishing email samples, systematically selected to ensure representative coverage over a ten-year period (2014–2023). This sample size is consistent with standard practices established by Ferreira and Teles (2019) and Akbar (2014) in phishing email research, where the typical range analysed in literature is between 200 and 250 samples. Furthermore, variability analysis demonstrated that stable patterns were observed after 180 samples, supporting the selection of a 200-sample data set. Specifically, 20 phishing emails were randomly sampled from each year using a random sampling tool available at Link to calculatorsoupLink to the Website. The decision to sample 20 emails per year was guided by the need to balance manageable qualitative coding with the goal of identifying temporal trends over a ten-year period. This consistent yearly sampling ensures the ability to detect variations in persuasive strategies over time while maintaining depth of analysis. Additionally, preliminary variability analysis demonstrated stable patterns after approximately 180 samples, supporting the adequacy of our 200-sample data set for capturing representative trends. We acknowledge, however, that larger yearly samples might further refine detection of subtle temporal shifts, which future research could explore. These emails were obtained from the Millersmiles.co.uk archive, a comprehensive database consisting of approximately 285,641 phishing emails collected from 2003 to 2024. From the various categories of emails in the Millersmiles.co.uk database, the phishing email category spanning March 2005 to November 2024 was used, containing a total of 33,363 phishing email samples. Then, last ten-year frame from January 2014 to December 2023 was selected. The selection process was conducted twice: once for analysing the full email content and another for analysing only the email subjects.

The next step involved case classification based on the entities of the ontological model of social engineering by Mouton et al. (2014). The entities used are target and goal of the phishing attacks. The entity “target” attribute values were either individuals or organizations, while the goals of the phishing attacks were categorized as financial gain, unauthorized access or service disruption. Following these classifications, each email sample was individually coded.

From the 200 phishing emails, while looking at the entities of the phishing email attacks based on the ontological model in accordance with Mouton et al. (2014), three primary goals were identified: service disruption, with very minimal cases; financial gain, observed in 78 cases; and unauthorized access, accounting for 121 instances. Notably, all phishing emails in this sample specifically targeted individuals not the organization.

The study by Ferreira and Teles (2019) identified common social engineering principles used in phishing email subject lines. In the following section, their findings will be compared with the results from this study’s analysis of email subject lines data as shown in Table 1, to highlight changes.

Ferreira and Teles (2019) identified Authority in 119 sources and 139 references, suggesting that phishing subject lines effectively leveraged the credibility of authoritative figures or entities to gain users’ trust. In this analysis (2024), there was a slight decline (104 files, 105 references).

In Ferreira and Teles’ study, the Deception principle was minimally used in subject lines (seven sources, seven references). Conversely, this study found Deception in 21 files, reflecting a significant increase.

Distraction was used frequently in Ferreira and Teles’s study with 139 sources and 146 references. In this analysis, the occurrence decreased (109 files, 120 references), suggesting attackers are now complementing distraction with other principles. The use of Integrity increased slightly from 88 sources to 94 sources in the current study, indicating an increased effort by attackers to appear credible.

A comparison between 2019 and 2024 data reveals evolving phishing tactics see Figure 1: while the use of Authority has declined, Deception has increased significantly in subject lines and the Integrity principle’s growth suggests a strategic shift towards creating a false sense of honesty. The General Deception sub-principle was rarely present in Ferreira and Teles’s (2019) study but showed a substantial increase in this study. The sub-principles like Scarcity and Overloading by Time were notably present in this study data but not in Ferreira and Teles’s study.

The comparison between the subject line and the entire email content analysis highlights few key insights. The Authority, Distraction and Deception principles are commonly used across both subject lines and entire email content, but their application differs significantly (see Table 1 and Table 2). Authority is often employed in subject lines; whereas, in the full email content, the Deception, Distraction and Reciprocation were used equally.

Subject lines primarily employ tactics that can achieve instant results, such as creating urgency or exploiting authority, to prompt the reader to open the email. Entire email content, however, is more strategically designed to establish a narrative that influences the recipient’s decision-making process, encouraging deeper engagement with the content.

As shown in Table 3 and Figure 2, Authority is used moderately across all years, beginning with 11 in 2014, then showing a decline to 5 in 2016. A peak appears in 2020 at 14, indicating a resurgence in the usage of authority-based tactics to influence recipients to engage with phishing emails. The high value in 2020 might indicate a preference for leveraging authority during a period of global uncertainty, possibly to exploit the environment of crisis, such as the COVID-19 pandemic. According to Parsons et al. (2019), the presence of authority in the subject line is particularly compelling because the first impression is crucial, which directly supports the consistency of Authority in our data set.

Deception remains relatively low throughout all years, with values peaking at 6 in 2015 and then declining significantly thereafter, becoming absent in 2022 and 2023. This indicates that overt deception in subject lines might not be an effective tactic for phishing campaigns in recent years, possibly because such direct deception is more easily recognized by both recipients and automated filters. Williams et al. (2017) highlighted that deception tactics may be more effective when subtle in the subject line, as an overtly deceptive subject can increase the risk of being flagged by automated spam detection systems. The observed low frequency may also be due to the effectiveness of subtle emotional triggers in phishing emails, rather than explicit deception, as noted by Bakhshi et al. (2009).

Distraction shows a consistent presence throughout the years, with its highest usage at 14 in 2017 and 2021. This principle remains a steady tool, varying between 10 and 14 in most years. The findings by Vishwanath et al. (2011) suggested that distraction as a tactic works particularly well when attackers attempt to overwhelm recipients with an ambiguous or vague message. In the subject line, such distraction could serve as a means to stimulate curiosity (e.g., “Regarding your recent purchase”), which is reflected in moderate use across multiple years.

Integrity starts high in 2014 at 17 and continues with some fluctuations, peaking again in 2018 at 16. However, its usage decreases to a lower value of 4 by 2021 before slightly recovering to 8 in 2023.

Social proof is entirely absent across all years in email subject lines. This outcome suggests that this tactic, which relies on demonstrating group behaviour or consensus, is not suitable or effective for phishing email subject lines. Attackers might find it difficult to convincingly convey a sense of social endorsement within the short and direct format of a subject line. Cialdini (2007) describes social proof as contextually powerful, particularly in environments with visible peer actions.

Figure 3 depicts the trends in the use of five different principles of persuasion Authority (P1), Deception (P3), Distraction (P4), Integrity (P5) and Social Proof (P2) in phishing emails from the years 2014–2023. Each line represents the frequency of usage for a particular principle in phishing email subject lines over these years.

As shown in Table 4, the use of authority as a persuasive principle has shown a steady increase over the years, particularly peaking in 2021. From a relatively low usage in 2014 and 2015, its frequency rose significantly by 2021, indicating that phishers might have begun increasingly relying on authoritative messages to gain users’ trust. In a study by Parsons et al. (2019), authority was highlighted as one of the most influential principles used in phishing attacks.

The Deception (P3) principle has had notable peaks, particularly in 2019 and 2021, suggesting that during these years, there was an increased focus on misleading recipients as part of the phishing strategy. The sudden spike in 2019 followed by a drop in 2020 and a subsequent rise again in 2021 indicates fluctuations that may be related to varying strategies based on user response to previous phishing campaigns or global context of that period. Bakhshi et al. (2009) noted that deception is a core element in social engineering attacks, often involving misleading or impersonating trusted sources. The consistent high frequency observed here aligns with research findings that deception is a foundational strategy in phishing. According to Jakobsson and Myers (2007), phishing is inherently deceptive, involving false promises and forged identities.

Distraction (P4) has generally remained at a moderate frequency throughout the observed years, but it saw a notable increase in 2019 and 2021. This could imply that attackers used distraction alongside deception during these years. Research by Vishwanath et al. (2011) highlighted the use of cognitive overload and distraction as a means of influencing target behaviour in phishing. While our study shows moderate use, Vishwanath’s work suggested that attackers use distraction to exploit divided attention, which can be context specific. The variability in distraction could be influenced by factors such as the target’s environment or broader social factors, as suggested by Vishwanath et al. (2011), where people with heavy workloads or multitasking tendencies are more vulnerable to distraction tactics.

The principle of Integrity (P5) also follows a consistent pattern with a moderate level of use across the years, but it saw a peak in 2021. Aleroud and Zhou (2017) described how attackers often try to appear trustworthy or sincere in phishing emails to foster credibility. The frequency in this study data set may represent attempts to balance apparent integrity with other manipulative techniques. The moderate and fluctuating use of integrity also aligns with Workman (2008), who argued that maintaining a facade of trustworthiness is important for some types of attacks, but it may not be as necessary in all phishing contexts, leading to the observed variability.

Social Proof (P2) appears to be almost non-existent, with only a few instances recorded across all years, specifically in 2016, 2018 and 2022. This suggests that phishers rarely rely on social proof in while creating phishing email, possibly because it is less effective or harder to leverage in email compared to other principles. The lack of social proof usage could also be linked to the nature of the email context. Research by Williams et al. (2017) showed that social proof, such as testimonials or herd behaviour, may be more effective in social media scams rather than emails, which may be the reason of minimal use in phishing emails.

As shown in the Table 5 and Figure 4; the most frequently used combination in email subjects is Authority (P1) + Distraction (P4), which appear 52 times. Authority (P1) + Integrity (P5) is the second most common combination, with 46 occurrences. The combination Distraction (P4) + Integrity (P5) occurs 24 times, indicating a strategy where phishers aim to create confusion while presenting a trustworthy facade in the email subject.

Authority (P1) + Deception (P3) appears 12 times. Authority (P1) + Distraction (P4) + Integrity (P5), with 9 instances, implies a subtle approach where the subject line uses authority and credibility to gain trust while also introducing an element of distraction to limit critical thinking.

Deception (P3) + Integrity (P5), appearing 7 times, shows that deception in subject lines is often paired with an attempt to create trust.

Combinations involving three principles, such as Authority (P1) + Deception (P3) + Integrity (P5) and Deception (P3) + Distraction (P4), occur relatively infrequently, with 5 and 4 occurrences, respectively.

Combinations such as Authority (P1) + Deception (P3) + Distraction (P4) and Deception (P3) + Distraction (P4) + Integrity (P5) occur only once, likely because combining multiple principles in a concise subject line is difficult without making the subject overly complex or suspicious.

Table 6 and Figure 5 illustrate the top ten combinations of principles of persuasion used in the entire content of phishing emails, providing insights into how multiple persuasive tactics are deployed in combination to manipulate recipients. Deception (P3) + Distraction (P4) appears 151 times, making it the most frequently used combination. Deception (P3) + Integrity (P5) follows closely with 147 occurrences and Distraction (P4) + Integrity (P5) also appears frequently (145 times). Deception (P3) + Distraction (P4) + Integrity (P5) is the most frequently used three-principles combination, appearing 128 times. Similarly, Authority (P1) + Deception (P3) (105 times), Authority (P1) + Integrity (P5) (102 times) and Authority (P1) + Distraction (P4) (100 times) are also prominent combinations. Authority (P1) + Deception (P3) + Distraction (P4) and Authority (P1) + Deception (P3) + Integrity (P5) each occur 92 times, indicating more complex strategies where attackers use authority combined with deception to either overwhelming or trust-building elements. The dominance of Deception (3) and Distraction (P4) in combinations shows that these two principles are fundamental to phishing emails. Authority (P1) is consistently present in several combinations, often alongside other principles such as Deception, Distraction or Integrity. To sum up, the analysis of the top combinations of principles of persuasion in phishing email content reveals a sophisticated mix of deception, credibility and authority tactics. The most frequent combinations are those that leverage Deception and Distraction, often with Integrity to build credibility. The presence of Authority in various combinations underlines its effectiveness in compelling compliance, while Distraction and Integrity work as supporting elements to mislead or reassure the recipient.

Our analysis of phishing email subject lines and full content over a ten-year period highlights important trends in how attackers use persuasion principles and, crucially, how they combine them. Compared to earlier research that often looked at these principles individually (e.g., Ferreira and Teles, 2019), our findings show that phishers increasingly layer multiple tactics together to make their messages more convincing. For instance, combinations like Deception with Distraction and Integrity are especially common in full email content, suggesting attackers carefully construct narratives that both mislead and build trust.

This move toward more complex, multi-principle strategies aligns with work by Vishwanath et al. (2011), who emphasized that attackers exploit cognitive overload and divided attention to reduce critical thinking. Our study quantifies these combinations over time, showing how attackers adapt their approaches as users become more aware of simple, single-cue phishing tactics. For example, the decline in overt use of Authority in subject lines alongside rising use of Deception and Integrity in full content suggests phishers are responding to increased user vigilance by crafting subtler, more credible attacks.

These findings have direct practical implications. Cybersecurity training and phishing simulations need to move beyond teaching users to spot obvious cues like urgent language or fake authority. Instead, training should incorporate realistic scenarios that reflect the layered nature of real attacks, helping users recognize patterns where multiple persuasive techniques are used together. This is consistent with calls from Frauenstein and Flowerday (2020) to design interventions that account for the ways personality traits and cognitive biases can increase vulnerability to such nuanced manipulation.

For detection systems, our results also suggest that rules and algorithms should be sensitive to combinations of persuasion principles rather than single features. By identifying common patterns such as Authority paired with Distraction in subject lines or Deception with Integrity in full content security solutions can better flag sophisticated phishing attempts that might otherwise bypass traditional filters focused on technical errors.

Overall, this study contributes to the field by shifting the focus from individual persuasion principles to understanding how attackers combine them strategically over time. By mapping these evolving patterns, we provide actionable insights that can help improve both training programs and technical defences against phishing, making them better equipped to handle the complex, adaptive nature of modern attacks.

In terms of limitations, this study focuses on a specific data set of phishing emails from millersmiles.com.uk [Link to millersmiles.com.uk], providing a detailed analysis based on key persuasion principles. While the sample size is suitable for qualitative insights, future work could expand on this by including more diverse data sets to capture additional variations in phishing tactics. Furthermore, future research could explore real-time phishing detection systems that incorporate the identified principles of persuasion, thereby enhancing practical applications of this study’s findings.

This study advances our understanding of phishing by examining how principles of persuasion are deployed as social engineering tactics across both the full email content and subject lines of phishing emails. The findings confirm that principles such as Distraction, Deception, Integrity and Authority are commonly used to manipulate users. Specifically, subject lines tend to rely on principles like Authority and Distraction to quickly capture attention, while full email content utilizes more elaborate narratives involving Deception and Integrity to establish credibility and maintain manipulation. These insights highlight the necessity for a focused, psychologically informed approach to phishing defence strategies that can adapt to evolving phishing methodologies.