Digital Mindfulness · Research

The Susceptibility Atlas

Why do some people fall for phishing, scams and fake news while others don't? The Atlas maps what the published research shows so far: which human factors have been studied, how much evidence sits behind each, and what has been tried to help.

The map

What has been studied

Every factor the research has examined, grouped into six families: how people think, who they are, what they do, their circumstances, demographics, and the message itself. The size of a bubble shows how many studies looked at that factor. What each one found is in the full Atlas. The map covers phishing and scams, and misinformation. A third area, manipulative design in apps and online shopping ("dark patterns"), has just been added with studies so far: too few to show separately yet.

Bubble size = number of studies. Hover or tap a bubble for its name.
Headlines

Six things the research agrees on

The short version. Each of these rests on multiple studies across both phishing and misinformation; the detail, the exceptions and the open questions are in the full Atlas.

  1. Reacting without thinking is the one vulnerability every area shares. Fast, intuitive, reflexive judgement is the most consistent predictor of falling for phishing, scams and fake news alike.
  2. Knowing is not the same as feeling confident. Tested knowledge protects; how aware or capable people say they are mostly does not.
  3. Who you trust matters more than how trusting you are. Trust in the apparent sender, source or side is what raises risk, not a trusting personality.
  4. Standing back from your own reactions helps. People who are more mindful of, and more able to regulate, their own impulses fall for less in both areas. The effect is real but modest, and a few minutes of a breathing exercise is not enough to produce it.
  5. Most interventions make people more cautious, not more accurate. Warnings, tips and training tend to raise suspicion of everything, including the real thing.
  6. Being scammed once does not teach. Past victims are more likely to be targeted and to fall again.
What helps

What has been tried

Warnings and labels, training, simulated attacks, inoculation games, accuracy prompts, corrections, feedback, incentives, mindfulness and more. The full Atlas includes a practitioner's playbook: choose who you want to protect and against what, and see how consistent the evidence is for each kind of intervention.

One less-studied approach looks promising: training people to notice their own reactions before they act. In around ten studies, mindfulness and metacognitive training mostly protected, including against real phishing attacks, although brief one-off exercises did not. Promising, not yet proven.

Who the evidence covers

Phishing interventions have mostly been tested in real workplaces. Misinformation interventions have mostly been tested on online panels and students. Almost nothing crosses over, and that gap is one of the Atlas's main findings.

About

About the Atlas

What's in it

A plain-English summary of the evidence on every factor, which way it points and how strong it is; a practitioner's playbook by audience and threat; filters for recent or high-quality research only; and the classical roots of each idea. This page is the public overview; the full Atlas is available by invitation while the research is being written up.

Who it's for

Researchers, security-awareness and trust-and-safety teams, journalists and policy people, and anyone trying to understand why people fall for things online.

About

A systematic review of the published research on susceptibility to phishing, scams and online manipulation, part of a PhD at Nelson Mandela University. Ongoing research, updated as studies are coded. Not professional advice.

Collard, A. (2026). The Susceptibility Atlas. Digital Mindfulness. Data as of .