Original title: Engineered Persuasion: Evaluating Personalized Pretexts in LLM-Generated Spear Phishing
Jerson Francia, Derek Hansen, Benjamin Schooley, Shydra Valynn Murray · September 2026
Phishing emails try to trick people by pretending to be real workplace messages, but it is unclear if adding personal details always makes them believable. Researchers tested how people react to fake phishing emails written by artificial intelligence. They asked workers to review simulated emails built with different layers of personal data, ranging from basic workplace info up to names of real coworkers and shared projects. Workers then graded how convincing each email felt and shared what action they would take. The team found that more personalization made emails more believable and made people much more likely to say they would click a link. Emails from a specific person mentioning a coworker worked best. However, extra details backfire if they are vague or slightly wrong for someone's daily job routines. Real persuasion depends on whether details actually fit the person's real work context.
You're at a party and a stranger claims to be a friend of your coworker. If they mention the right details — your coworker's name, the project you're on — you relax; if they get something wrong, you get suspicious. In this paper, the same thing happens with scam emails: each added personal detail makes the email more convincing, but only when it matches the recipient's real work life. A detail that's incorrect, vague, or out of place makes people more suspicious, not less.
Most people know to be suspicious of generic spam, but a personalized email that mentions your actual job and coworkers feels legitimate. This research shows that the danger isn't just how much a scammer knows — it's whether the details match your real work life. That distinction can help cybersecurity training teach people to spot the wrong kind of detail, not just any detail.
The abstract doesn't say. It does describe a disclosed survey with simulated emails and a post-hoc descriptive analysis, but it does not state limitations.
Ask anything about this paper. Answers come from its abstract, and say so when the abstract doesn't cover your question.
Engineered Persuasion: Evaluating Personalized Pretexts in LLM-Generated Spear Phishing — Jerson Francia, Derek Hansen, Benjamin Schooley et al.
Abstract licence: CC0
Explanation generated by Synthesis from the abstract — it is not the original paper. This is a preprint, so it hasn't necessarily been peer reviewed.