Human Detection of AI-Generated Phishing

Urgency

Emails that manufacture artificial time pressure to force fast, unconsidered decisions. These messages typically invoke expiring accounts, unprocessed payments, immediate action requirements, or looming security events. The tell is structural: the email wants you to act before you think. In a controlled quality environment, where the prose is polished and the framing is plausible, urgency becomes harder to isolate as a signal because it also appears in legitimate transactional emails: password resets, shipping updates, calendar reminders.

Authority Impersonation

Messages that impersonate a figure whose instructions carry implicit compliance pressure: executives, IT departments, HR, legal teams, government agencies, or established institutions. The attack exploits deference. Recipients are conditioned to respond to certain names and titles without scrutinising the request itself. In the dataset, all sender names and organisations are plausible rather than obviously spoofed, which removes the low-effort check of looking for misspelled brand names.

Credential Harvest

Classic credential phishing: an email directing the recipient to a login page, verification flow, or account recovery process. These messages are the backbone of most real-world phishing campaigns because they work. The dataset focuses on the email layer, not the destination. Cards present the message itself and reveal forensic signals (SPF/DKIM/DMARC status, reply-to analysis, URL characteristics) after the player classifies it. The goal is to test whether players can detect the phishing intent from the message alone, before they ever click.

Hyper-personalization

Emails that reference contextually plausible personal or professional detail to establish authenticity. These might reference a recent purchase, a shared connection, a project name, an industry, or a role-specific process. The technique exploits the cognitive shortcut of recognising familiar context as a legitimacy signal. Hyper-personalized phishing is expensive to produce at scale with human writers, but AI makes it trivially cheap. This category tests whether the presence of relevant-sounding context meaningfully lowers detection rates.

Pretexting

Multi-step social engineering that establishes a believable backstory before making the ask. The email arrives as part of an implied ongoing interaction: a follow-up to a meeting that may or may not have happened, a response to a request the recipient may or may not remember making, a continuation of a vendor relationship. The pretext does the work. The request itself is often mundane. Detection requires recognising the setup as artificial rather than evaluating the request on its own terms.

Fluent Prose

Phishing with no urgency cues, no authority figure, no personalization, and no pretext. Just polished, neutral email language making a request. This is the hardest category to classify because it removes every conventional heuristic simultaneously. The email reads like a normal business communication. The study hypothesis is that fluent prose phishing will have the highest bypass rate precisely because it offers nothing obvious to flag. If that hypothesis holds, it has significant implications for how security awareness training frames the "what to look for" question.

Self-selected sample

Participants are players who discovered Retro Phish and opted into Research Mode. This is not a random sample of the general population. Results will over-represent people who are security-aware or curious about phishing, which likely biases detection rates upward compared to a general workforce sample.

Game context

Players know they are classifying emails in a game environment. This may produce different cognitive engagement than real-world email triage, where classification competes with other tasks and attention is not guaranteed. Game context may inflate detection rates by focusing attention on the task.

AI-generated cards

All cards, including legitimate ones, are AI-generated. This produces a controlled dataset but means the legitimate emails do not carry the full contextual richness of real correspondence. In practice, recipient-specific context (knowing the sender, expecting the email, recognising internal references) is a strong legitimacy signal that the dataset cannot replicate.

Self-reported background

Professional background is self-reported and not verified. Players may misclassify their background or select options that do not accurately reflect their day-to-day exposure to security concepts.

Highest bypass rate within the study

Pretexting and Fluent Prose are expected to produce the highest bypass rates in the game context. Both techniques remove or obscure the conventional tells that security awareness training targets. Fluent Prose strips out every surface-level heuristic simultaneously. Pretexting buries the malicious intent inside a plausible narrative. Neither gives the classifier an obvious hook to flag.

Hyper-personalization deserves a separate note here. In real-world deployments, it would likely be the most effective technique of all: an email that references your actual name, role, recent activity, or known colleagues is substantially harder to dismiss than a generic message. But that advantage depends on the email actually being personalized to the individual reader. In this dataset, it is not. Cards labelled hyper-personalization use plausible contextual detail, not detail drawn from the specific player seeing the card. That distinction collapses the core advantage of the technique. A “hyper-personalized” email that does not actually reference anything about you reads more like a plausible-but-generic message than a targeted attack. This is a known limitation of studying personalization in a fixed dataset, and it means the in-study bypass rate for hyper-personalization will likely understate its real-world effectiveness.

Lowest bypass rate

Credential Harvest is expected to be the most detectable technique. It is the attack pattern most consistently covered in security awareness training, and players are conditioned to scrutinise login prompts and link destinations more than any other element of an email. Even in a controlled environment where prose quality is held constant, the structural fingerprint of credential phishing is recognisable: there is always an ask to authenticate somewhere.

Group differences

Security professionals (INFOSEC group) are expected to outperform both technical non-security users and general users in overall detection rate. Daily exposure to threat patterns, incident reports, and phishing simulations should produce better intuition across most technique categories. The more interesting question is whether that advantage is uniform or concentrated: security professionals may show dramatically better detection on some techniques while performing comparably to other groups on techniques that exploit cognitive shortcuts rather than technical knowledge.

Confidence calibration

Players will be overconfident when wrong. Incorrect classifications are expected to skew toward LIKELY and CERTAIN rather than GUESSING, meaning players will not just miss phishing emails but will miss them while feeling sure they are right. This pattern is expected to cluster on techniques that produce the most plausible-looking output: pretexting and fluent prose. If a well-constructed pretext reads like a normal email, the player who misclassifies it has no signal telling them they should be uncertain. That confident wrongness is a meaningful finding in its own right, separate from raw bypass rates.