A tired brain clicks on scam emails more often, study finds

A tired brain is easier to trick. Researchers at the University of California, Irvine found that employees clicked on fake scam emails more often right after daylight saving time began, when clocks move forward an hour and most people lose a little sleep.

What the study found

The study was published in the Proceedings of the National Academy of Sciences. It used data from a security awareness campaign at a large US institution, covering more than 11,000 employees. The organization regularly sends staff fake phishing emails as training. Phishing means a message that tries to trick you into clicking a harmful link or giving up information. The organization tracks who clicks.

Researchers compared the Monday before the clock change with the Monday right after. The click rate rose from 15.56 percent to 17.76 percent. That is a relative increase of about 13 percent in the odds of clicking a simulated malicious link.

Why a small change matters

The time change is a mild disruption. It is not months of poor sleep. Eitan Schechtman, the lead researcher and an assistant professor of neurobiology and behavior at UC Irvine, said the findings suggest that lack of sleep may also affect everyday decisions. Researchers say sleep loss can lead to impulsive choices, which may make people less careful when judging a suspicious message.

The money at stake is large. The FBI's Internet Crime Complaint Center says US cybercrime losses topped $20 billion in 2025. Even a modest rise in clicks could add up for businesses and individuals.

Who it affects

Anyone with an inbox. Schechtman urged employers and cybersecurity companies to be especially vigilant around daylight saving time changes and other times when people are likely to lose sleep, such as holidays and big sporting events. The researchers also noted that the findings raise questions about changing clocks twice a year. Permanent daylight saving time would end the disruptive switch, but standard time is more in sync with the body's internal clock.

What to do

• Skip unexpected links, especially after a bad night of sleep.
• Slow down on email after a short night, a time change or a holiday.
• If a message feels urgent, pause before you act on it.
• Businesses can time extra security reminders around clock changes and busy events.

Sleep alone will not stop phishing. The study points to something often overlooked in security: the person making the call. A rested person is simply more likely to make a careful one.