Many of the decisions we make online are not the result of slow, deliberate reasoning. They often happen in contexts of haste, distraction, and information overload.
Under these conditions, our brain relies on mental shortcuts known in psychology as cognitive biases.
Biases are not random mistakes or signs of naivety. They are systematic distortions of judgment that allow us to decide quickly — but they can also make us predictable and vulnerable, especially in digital environments.
System 1 and System 2: How We Decide Online
According to the dual-process theory proposed by Daniel Kahneman1, our decision-making relies on two different systems of thinking.
System 1 is fast, automatic, and emotional.
It is the system we use for most everyday activities: it recognizes familiar patterns, reacts to stimuli, and allows us to act with little cognitive effort.
System 2, by contrast, is slow, reflective, and analytical.
It activates when we need to evaluate complex information, control an impulse, or question a first impression.
In digital contexts, System 1 is almost always dominant.
Constant notifications, short messages, urgency cues, multitasking, and the absence of face-to-face interaction make it difficult to slow down and activate System 2.
It is precisely in this space that cognitive biases become particularly powerful.
Cognitive Biases and Online Scams
Digital scams are designed to exploit these decision-making mechanisms. Some biases, in particular, appear frequently2:
Scarcity bias
Pushes us to act quickly when a message creates urgency or threatens an imminent loss.
Authority bias
Leads us to trust communications that appear to come from authoritative figures, such as companies, institutions, or supervisors.
Confirmation bias
Makes messages more convincing when they align with our expectations, desires, or personal beliefs.
Overconfidence bias
Causes us to overestimate our ability to recognize a scam, lowering our level of attention.
For a long time, scarcity bias was the most widely used mechanism in phishing scams: urgent messages, “act now” requests, threats of account suspension or financial loss pushed people to respond without verifying.
But today, the landscape is changing.
More Information, More Security?
In recent years, awareness of scams has increased significantly. Many people are familiar with common techniques, know what phishing, smishing, and vishing are, and can recognize obvious warning signs.
This increased awareness is an important achievement.
But it also produces a less visible side effect: the feeling of being able to recognize a scam instantly.
An implicit thought increasingly emerges:
“I know how these scams work. It won’t happen to me.”
When Confidence Becomes Overconfidence
This is where overconfidence bias comes into play: the tendency to overestimate our abilities and underestimate risks, especially in contexts we perceive as familiar or well understood.
When we believe we “already know how scams work,” System 1 becomes even more dominant: it recognizes familiar patterns, lowers our alertness, and reduces the likelihood that System 2 will intervene.
In the past, this excessive confidence was more common among individuals with specific technical expertise. Today, partly due to widespread information and public discussion about scams, this belief is extending to a much broader audience.
The paradox is that feeling prepared can become a vulnerability.
Scams Evolve, Vulnerabilities Shift
Digital scams are no longer just crude or easily recognizable attempts.
The use of artificial intelligence enables increasingly credible, personalized, and context-consistent communications.
In this scenario, vulnerability no longer stems only from a lack of information, but increasingly from excessive confidence in one’s ability to detect danger.
Understanding the shift from the dominance of scarcity bias to the rise of overconfidence helps us better interpret current online scam dynamics.
Once again, this is not about individual fault, but about the interaction between cognitive mechanisms, digital environments, and increasingly persuasive technologies.
Further reading
If you would like to explore some of the concepts mentioned in this article:
System 1, System 2, and cognitive biases
Daniel Kahneman, Thinking, Fast and Slow.
A foundational text for understanding how fast and reflective decisions work — and why biases influence our judgment, especially online.
https://doi.org/10.1007/s00362-013-0533-y
Human Cognition in the Digital Era
This volume analyzes the relationship between human cognitive processes and digital environments, showing how technologies influence the way we think, decide, and evaluate information.
https://www.researchgate.net/publication/385706111_Human_Cognition_In_the_Digital_Era
Overconfidence and phishing
Wang, Li & Rao (2016) show how excessive confidence in one’s ability to recognize phishing emails can lead to riskier behaviors.
https://aisel.aisnet.org/jais/vol17/iss11/1/
Related biases in phishing
A study on optimism bias and the tendency to feel less vulnerable than others — useful for comparison with the classic “it won’t happen to me” mindset.
https://doi.org/10.1108/ICS-02-2023-0023
- Kahneman, D. (2011). Thinking, fast and slow. Farrar, Straus and Giroux. 10.1007/s00362-013-0533-y ↩︎
- Uniyal, S., & Singh, D. (2024). Human cognition: In the digital era. Clever Fox Publishing ↩︎