When Daylight Saving Time (DST) begins each March and the clocks spring forward, people lose an hour of sleep. This sleep deprivation has been linked to a higher rate of fatal car accidents the week after—but that’s not the only lingering effect of lost sleep.
A new study published in Proceedings of the National Academy of Sciences, where phishing emails were sent to more than 10,000 people, found that the Monday after DST began, people were 13% more likely to click on the links within a suspicious message.
What the new study showed
The idea for the study was inspired by a routine cybersecurity test, says study author Eitan Schechtman, a professor of neurobiology and behavior at University of California, Irvine. “My university runs this program in which they send phishing emails every few months,” he says, in order to educate employees about how to spot them. Phishing emails resemble legitimate messages and are designed to spoof recipients into giving up personal data. “I was wondering, as a sleep researcher, what sleep would do to that,” he says.
He arranged with the university’s IT team to have spoof emails sent to half of recipients the Monday before the transition to DST in 2026 and half the Monday after, to compare how people responded. The DST shift is a well-established source of mild sleep deprivation, making it a simple way to test the idea.
The time change made no difference in terms of how likely people were to open the fishy emails, nor did it change how likely they were to report them as spam. But it was linked to a greater likelihood of clicking on links in the emails—which, if the emails had been real scams, would have taken recipients to fake websites or otherwise compromised their security.
“Our interpretation of this is that sleep loss rendered people more impulsive and less likely to carefully think about their decisions, so they open the email and they’re like, ‘OK, here’s this link. I’ll just click it.’” Schechtman says. “They didn’t have their full mental capacity to critically examine whether this might be an email that’s trying to lead them astray.”
A number of factors can play into whether people fall for phishing scams, including stress levels and high workloads, as well as differences in personality traits like impulsiveness, says Jason R.C. Nurse, a professor at the University of Kent in the U.K. who was not involved in the new study. “Sleep deprivation can fit this profile in some ways because it has a direct impact on our decision-making and state of mind,” he says. “If we’re not thinking properly or rationally about what we’re seeing in our inboxes, there’s every chance that we might get caught out and fall for a phishing attempt.”
Does it apply in the fall as well?
When clocks fall back, as they did on Nov. 1 in the U.S., people hypothetically have more time to sleep—not less. Does that mean people would be less likely to click on the links afterward?
Schechtman suspects not. “When you are given an extra hour, you unfortunately rarely use it to sleep more. A lot of times you use it to stay awake longer or enjoy your weekend a bit more,” he says. “My guess is, and previous studies have shown, that you don’t gain as much sleep from the fall transition as you lose in the spring.”
That said, “I asked the journal to delay publication until right now, because we collected data for this last transition as well,” he says. “None of my colleagues, none of my students knew that we were running this, because I wanted it to be secret,” he says, to enable this last round of data collection to happen before people learned about the work.
He hasn’t analyzed the new data yet; they will appear in a later study. And because his colleagues now know what he was secretly up to, he doesn’t think he’ll be able to do a similar study again. “But I hope that other institutions will follow suit and replicate this,” he says. “It would be really cool to see.”
The post Getting Too Little Sleep Makes You Easier to Scam appeared first on TIME.
