Losing as little as one hour of sleep may increase the likelihood of falling for an online phishing scam, according to research published Monday, November 9, 2026. Scientists at the University of California, Irvine found that employees were approximately 13% more likely to click suspicious email links after the spring transition to daylight saving time.
The findings, published in the Proceedings of the National Academy of Sciences, suggest that even modest disruptions to sleep may affect everyday decision-making. Researchers examined the responses of more than 11,000 employees participating in a workplace cybersecurity training program and found a noticeable increase in risky clicking behavior immediately after the clocks moved forward.
The study adds another concern to the debate over sleep deprivation and seasonal clock changes. While previous research has connected poor sleep with impaired attention and decision-making, the new findings suggest that those effects may also create vulnerabilities in digital security.
Phishing Risk Increased After Daylight Saving Time
Researchers examined records from a large U.S. organization that regularly tests employees using simulated phishing emails. The messages resemble fraudulent communications designed to trick recipients into clicking suspicious links.
The organization's information technology department sends these messages several times a year as part of an ongoing cybersecurity awareness program. Employees who click the links are recorded in the training system, allowing security staff to measure responses to potential online threats.
The research team focused on the spring 2026 transition to daylight saving time, when clocks moved forward by one hour. This annual change can shorten people's sleep and temporarily disrupt their normal schedules.
The researchers compared employee responses on the Monday before the time change with those on the following Monday. The difference was substantial enough to raise concerns about how a relatively minor sleep disruption could affect cybersecurity behavior.
Before the transition, approximately 15.56% of employees clicked simulated phishing links. On the Monday after the clocks moved forward, that figure increased to 17.76%.
That represents an increase of 2.2 percentage points in the observed click rate, or approximately 13% in relative terms as reported by the researchers. The distinction matters because the study did not find that 13 additional employees out of every 100 clicked a suspicious link.
Instead, the researchers observed a smaller increase in the proportion of employees who responded to fraudulent-looking messages. Even that difference could have meaningful consequences for organizations with thousands of workers receiving potentially dangerous emails.
Why Less Sleep May Affect Online Decisions
Eitan Schechtman, an assistant professor of neurobiology and behavior at UC Irvine, led the research. His work examines how sleep influences memory, cognition and human behavior.
Schechtman explained that even relatively small reductions in sleep may affect choices without people necessarily recognizing the change. A person who feels capable of completing everyday tasks may still be more vulnerable to making impulsive decisions.
Phishing messages often depend on convincing recipients to act before carefully examining the information presented. Fraudulent emails may imitate familiar organizations, create a false sense of urgency or encourage recipients to follow a link without questioning its destination.
Recognizing such messages requires attention and judgment. When those abilities are weakened, an individual may be more likely to overlook warning signs or respond automatically.
The researchers believe the findings may extend beyond cybersecurity because the mental processes involved in evaluating suspicious messages also influence other decisions. However, the study directly measured phishing-related behavior rather than financial choices or other real-world outcomes.
Schechtman suggested that protecting sleep deserves greater attention in daily life, particularly when people face situations requiring careful judgment. He also encouraged employers and cybersecurity specialists to consider periods when workers may be experiencing unusually disrupted sleep.
What the Study Can and Cannot Prove
The research provides evidence of a relationship between the daylight saving time transition and increased vulnerability to simulated phishing messages. However, there are important limits to what the results establish.
The researchers used an existing workplace training program rather than deliberately assigning participants to different amounts of sleep. This allowed them to study behavior in a realistic organizational setting, but it also meant they did not directly control each employee's sleep duration.
Although the spring clock change provides a useful opportunity to examine sleep disruption, not every employee necessarily lost exactly one hour of sleep. Some may have adjusted their schedules, while others could have experienced greater or smaller changes in rest.
The study also measured clicks on simulated phishing emails, not actual financial losses or successful criminal attacks. Clicking a training link is an indicator of potentially risky behavior, but it does not establish that an employee would have disclosed personal information or lost money.
Other factors associated with the time change could also influence behavior, including altered schedules or temporary disruptions to the body's internal clock. The findings therefore support an association with modest sleep disruption without proving that sleep loss alone caused every additional click.
The research involved workers at one large organization, making it uncertain whether the same increase would occur across different industries, age groups or countries. Additional studies could help establish how widely the pattern applies.
FBI Reports More Than One Million Internet Crime Complaints
The findings arrive as federal authorities continue to report substantial losses from online crime. According to the FBI's 2025 Internet Crime Report, its Internet Crime Complaint Center received 1,008,597 complaints during the year.
That represented an increase from 859,532 complaints in 2024. Reported financial losses reached approximately $20.9 billion in 2025, an increase of 26% from the previous year.
Phishing and spoofing were among the most frequently reported categories of internet crime. These schemes commonly involve criminals impersonating legitimate businesses, government agencies or other trusted sources.
A phishing email may appear to come from a bank, delivery service or workplace administrator. The message often asks the recipient to verify an account, update payment details or respond to an alleged security problem.
The links may lead to fraudulent websites designed to collect passwords, financial information or other personal details. Some attacks also attempt to install malicious software on computers or mobile devices.
Although the FBI figures demonstrate the scale of internet crime, they do not establish how many incidents were caused by sleep deprivation. The UC Irvine research addresses a narrower question: whether people appear more likely to make a risky cybersecurity decision after a common sleep disruption.
Employers May Need to Consider Sleep-Related Security Risks
The findings could have practical implications for organizations that regularly train workers to identify online threats. Most cybersecurity programs emphasize suspicious links, unusual requests and the importance of verifying messages before responding.
The new research suggests that training may be less effective when employees are tired or dealing with disrupted schedules. Even workers who understand common phishing techniques may make errors when their attention is reduced.
Schechtman encouraged employers and cybersecurity companies to consider predictable periods of sleep loss when planning security awareness efforts. These may include the spring daylight saving time transition, major holidays and mornings after late-night sporting events.
Organizations could respond by reinforcing reminders about suspicious emails during those periods. Automated email filtering, multifactor authentication and independent verification procedures can also reduce the consequences of an employee clicking a fraudulent link.
Such protections are important because preventing online fraud should not depend entirely on individuals making perfect decisions. Security systems that recognize suspicious messages or limit unauthorized access provide additional safeguards when employees make mistakes.
For individuals, checking the sender's address and avoiding unexpected links remain useful precautions. When a message requests sensitive information, contacting the organization through its official website or an independently verified phone number can help establish whether the request is legitimate.
Research Adds to Debate Over Seasonal Clock Changes
The findings also contribute to ongoing discussions about whether Americans should continue changing their clocks twice each year. The spring transition has attracted particular attention because advancing clocks can interfere with sleep and established daily routines.
Researchers have long examined the relationship between the body's internal clock and health. The UC Irvine study adds cybersecurity behavior to the list of areas that may be affected when normal sleep schedules are disrupted.
However, eliminating seasonal clock changes and choosing permanent daylight saving time are not necessarily the same issue. Sleep researchers have often supported permanent standard time because it more closely aligns morning daylight with natural biological rhythms.
The latest research does not establish which national clock policy would produce the best overall outcomes. It does indicate that the transition itself may have consequences extending beyond temporary fatigue.
The study's central finding is that a relatively small disruption to sleep coincided with a measurable increase in risky online behavior among thousands of employees. Researchers now have a starting point for examining whether better sleep and additional security protections can reduce similar risks in other workplaces.