When you are sleep-deprived, that dodgy email promising an urgent account update might look a little more legit. A small decrease in sleep may make people more likely to click on phishing links, raising new concerns about how fatigue impacts online security, researchers at the University of California, Irvine, say.
Published in the Proceedings of the National Academy of Sciences, the study looked at employee behavior following the switch to daylight saving time, when clocks are set forward an hour. The results show that cybersecurity threats aren’t always high-tech hackers or elaborate scams. Sometimes all it takes is a tired brain to make an otherwise avoidable mistake.
One hour less sleep = 13% more susceptible to phishing
Researchers analyzed results from a cybersecurity awareness campaign with more than 11,000 employees at a large US institution. The organization regularly sends simulated phishing emails to staff as part of its regular security training and monitors whether they click on suspicious links.
Researchers compared employee responses on the Monday before the daylight saving time switch and the Monday directly after. The results were fascinating. The phishing click rate rose from 15.56 percent to 17.76 percent, a relative increase of about 13 percent in the odds of clicking a simulated malicious link.
This is especially important because the study examined a rather mild disruption associated with the one-hour time change, not a long-term lack of sleep. Eitan Schechtman, the study’s lead researcher and assistant professor of neurobiology and behavior at UC Irvine, said the findings suggest that lack of sleep may also affect everyday decisions. Researchers say sleep loss can foster impulsive decision-making, which might lead people to be less cautious when evaluating suspicious messages.
Why your sleep schedule may be a cybersecurity issue
The implications are more than just for individual inboxes. According to the FBI’s Internet Crime Complaint Center, US cybercrime losses in 2025 topped $20 billion. So a moderate increase in susceptibility to phishing might have financial consequences for businesses and individuals.
The findings also question the twice-yearly changing of clocks seen across much of the United States. Making daylight saving time permanent could eliminate the disruptive transition, but standard time is more in sync with the body’s internal clock, the researchers noted.
Schechtman urged employers and cybersecurity companies to be especially vigilant around daylight saving time changes and other times when people are likely to lose sleep, like holidays and big sporting events. The takeaway for the average user is simple: tiredness can influence how carefully you review emails that appear questionable. Don’t click on unexpected links, particularly after a bad night’s sleep.
But the study doesn’t mean just better sleep can prevent phishing attacks. But it is indicative of a factor in digital security that is often overlooked: the person making the call. And sometimes the best way to protect your inbox is to get a good night’s sleep.
