Losing a single hour of sleep may be enough to make you more vulnerable to an online scam, according to new research from the University of California, Irvine.
The study, published in the Proceedings of the National Academy of Sciences, found that employees were more likely to click on fake phishing links on the Monday after daylight saving time began, when clocks jump forward and most people lose an hour of rest. The findings suggest that small, everyday sleep shortfalls have real consequences for our judgment.
How the study worked
Researchers did not recruit volunteers into a lab. Instead, they partnered with a large company that was running a cybersecurity awareness programme for more than 11,000 employees. Several times a year, the firm’s IT department sent staff emails that imitated phishing attempts, then counted how many people clicked the malicious-looking links.
The team compared results from the Monday before the clocks changed with those from the Monday after. Before the switch, employees clicked about 15.5% of the time. The Monday after, the rate rose to roughly 17.7%. That may sound small, but in relative terms it represents an increase of more than 10% in the number of people falling for the bait.
Why a small loss matters
The researchers say the finding is striking because the sleep loss involved was modest. An hour of lost sleep is similar to what many people experience on an ordinary night.
“Our results demonstrate that even though you may not be aware of it, lack of sleep leads to impulsive choices,” said UC Irvine neurobiologist Eitan Schechtman, a co-author. He added that although the team focused on cybersecurity, many daily decisions are probably affected in similar ways.
That reasoning fits a broader body of sleep research, which has linked tiredness with weaker attention and a greater tendency to act on impulse. Scam emails depend on exactly that: they create urgency, such as a fake delivery problem or an account warning, and hope the recipient acts before thinking.
Why it matters now
Cybercrime is growing. The FBI’s Internet Crime Complaint Center received more than one million reports in 2025, nearly 25% more than five years earlier. Scams are also becoming more convincing, which makes the human factor even more important.
The study also has a practical point for employers. Schechtman hopes companies and security firms will consider events that routinely disrupt sleep, including clock changes, holidays and big primetime sporting events, when they plan phishing awareness campaigns. A training email sent on a groggy Monday may land differently from one sent midweek.
Caveats worth noting
As with any single study, there are limits. The research looked at one company, and it measured clicks on test emails rather than losses from real scams. The researchers used daylight saving time as a convenient natural experiment, which means other factors on that Monday could also play a role, even if sleep loss is the most plausible explanation. More work would be needed to show how far the effect extends to other age groups, workplaces and types of fraud.
Practical steps for readers
The findings do not mean a tired person is doomed to fall for a scam, but they do suggest a few sensible habits:
- Slow down when you are tired. If an email or message demands urgent action, wait before clicking.
- Verify through another route. Contact your bank, courier or employer using a number or app you already trust, not the link provided.
- Avoid big financial decisions on poor sleep. Payments, transfers and password changes can wait until you have rested.
- Use extra protection. Turn on two-factor authentication and use a password manager, so one mistaken click is less costly.
The bottom line
Sleep advice usually focuses on energy, mood and long-term health. This study adds a financial and security angle: being short of sleep can make people easier targets for fraud. As Schechtman put it, better sleep likely leads to better decisions, and in an age of constant phishing attempts, that could be worth protecting.
