Losing just one hour of sleep made employees click on fake scam emails more often than when they were well rested.
Story Snapshot
- A University of California, Irvine study tracked over 11,000 employees before and after the spring clock change.
- Clicks on simulated phishing links rose from 15.56% to 17.76%, about a 13% jump, the Monday after losing an hour of sleep.
- The time change did not affect whether people opened emails or reported them as spam, only whether they clicked suspicious links.
- Outside experts note the study did not directly measure individual sleep loss, leaving some questions about the exact cause.
What The Researchers Actually Found
Researchers at University of California, Irvine compared employee behavior on two nearly identical Mondays. One came right before the spring daylight-saving-time switch. The other came right after, when workers had lost about an hour of sleep. The difference in simulated phishing clicks was measurable and specific. People did not open suspicious emails more often. They did not report fewer scams as spam. They simply clicked the bad link more.
That narrow pattern matters. It suggests the tired brain is not failing at every step of spotting a scam. It is failing at the exact moment of decision, the click itself. The researchers believe tired employees became more impulsive and less careful right when it counted most, a small lapse with outsized consequences for anyone running a company network.
Why This Hits Close To Home For Working Americans
Most adults already know they feel groggy after springing forward. What this study adds is a dollar sign to that grogginess. Scammers do not care if you are tired. They send the same phishing email whether you slept eight hours or six. The study shows your defenses, not their tactics, are what change after a bad night. That is a sobering thought for anyone who handles money, passwords, or company data at work.
The sample size backs up the finding. More than 11,000 employees took part, giving researchers real-world behavior instead of guesses from a small lab group. That is a serious strength compared to many workplace studies that rely on surveys or self-reported habits. People were not told they were being watched for sleep effects. They simply went about their normal Monday, and their clicks were recorded as part of an ongoing cybersecurity-awareness program.
The Honest Gaps In The Evidence
No study is perfect, and this one has real limits worth naming. Researchers never directly measured how much sleep each employee actually lost. They used the clock change as a stand-in for sleep loss, which is reasonable but not proof. Some workers may have adjusted their bedtime in advance. Others may have felt no difference at all. The link between the calendar event and individual tiredness is assumed, not confirmed.
Outside experts have raised similar concerns. Jason Nurse, a cybersecurity professor at the University of Kent, pointed out that stress, workload, and personality traits like impulsiveness can all affect whether someone falls for a phishing email, separate from sleep. He had not yet reviewed the full dataset when he made that comment, so his point was more caution than contradiction.
Sleep researcher Dr. Killgore raised another fair question. Did tired employees click because their judgment was impaired, or because they simply missed warning signs due to lower alertness? Those are two different problems with two different fixes. The study cannot yet tell us which one was really driving the extra clicks, and that distinction matters for anyone designing training to stop it.
What This Means Before You Open Your Next Email
It is also worth remembering these were simulated phishing emails, not real scams. Nobody in the study actually lost money or had an account hacked. Clicking a test link is a warning sign, not a disaster. Real-world scam losses involve additional steps, like entering a password or wiring funds, that this study did not measure directly.
Still, the basic lesson lines up with common sense. Tired people make worse snap decisions, whether behind the wheel, at the register, or in their inbox. Companies spend millions training employees to spot scams, yet a single lost hour of sleep can quietly undo some of that training. The fix is not complicated. Treat sleep as part of your security plan, especially right before and after the clock changes twice a year.
Sources:
time.com, news.uci.edu, everydayhealth.com, govtech.com, popsci.com, digitaltrends.com, wisevoter.com
