Participants sorting personalized text messages correctly identified which came from GPT-4 about half the time, approximately the same result as what guessing would produce.

 

What happened

A pilot study at Brigham Young University asked 25 volunteers to sort twelve personalized text messages by how likely they were to click, then guess which had been written by an AI model, Help Net Security reported on August 7, 2026. Each participant first completed a survey covering their job, workplace, hobbies, city, and something they had recently posted online, and those details fed a short prompt template. GPT-4 produced six messages per person from that template. Undergraduates enrolled in a deception course wrote the rest under a fifteen-minute limit, with their output screened by a review team including two cybersecurity professors and roughly a third discarded as unusable. Across 300 judgments, participants correctly identified the AI-written messages 52% of the time, against the 50% that random guessing would deliver. The research appears in the Journal of Cybersecurity and Privacy.

 

Going deeper

The click-likelihood comparison is where the headline number sits, and it needs handling with care. Messages from GPT-4 landed above each participant's stated click threshold 28% of the time, against 21.3% for the student-written messages, a gap of 6.7 percentage points. The confidence interval on that gap runs from 2.9 points favoring the students to 16.3 points favoring the model, meaning the study cannot establish which side performed better, only that both landed in similar territory. What deserves more attention than the gap is the asymmetry behind it. The AI side consisted of one prompt template, filled from a survey and run once per person, while the human side required instructed students, a review process, and the discarding of a third of the output. A single prompt reached comparable ground, and it can be run repeatedly for the cost of an API call.

 

What was said

One participant, a banker at a credit union, stopped while sorting at a message that mimicked a fraud notification from their own institution, saying the "alert literally looks like the alert we get [at work] when there's a fraud." Asked afterward how they had judged which messages were machine-written, participants offered contradictory theories, with some saying AI writes too formally and others saying it writes too generically, some reading perfect grammar as a machine tell and typos as proof of a person. Twelve of the 25 acknowledged at some point in the interview that they were working mainly on instinct.

 

In the know

The one comparison that survived statistical adjustment concerns the theme of the message rather than its author. Job-related messages cleared the click threshold 38% of the time, against 19% for hobby-based messages and 17% for those built on social media activity. Spear phishing that references work is doing something the other categories are not. The failures point in the same direction, since messages fell apart when personal details were wrong rather than absent. One participant dismissed a message naming a coworker who did not exist, another knew there was no such person on the team it referenced, and a message pitching a dance opportunity went to the bottom for someone who had stopped dancing. Emojis showed how poorly the instincts were calibrated, appearing in 66% of the AI messages against 2% of the human ones, while only five participants mentioned them at all, two reading them as machine-written and three as human.

 

The big picture

Security awareness training is a required administrative safeguard under the HIPAA Security Rule, and the HHS Office for Civil Rights has pointed regulated entities to the requirement at 45 CFR 164.308(a)(5) covering awareness programs and periodic security reminders for all workforce members. Much of what fulfills that requirement asks staff to assess whether a message looks legitimate, and the study's central finding is that people cannot perform that evaluation. Researchers converted the 300 messages into numerical representations and trained a classifier that reached 88.7% balanced accuracy under strict test conditions, including standardized URLs, stripped emojis, and testing only against people whose messages it had never seen, which suggests the distinguishing pattern exists but sits below human perception. Those results came from one message set, one model, and one prompt design, so nothing about them establishes a working detector. The practical guidance carries less uncertainty. Staff should check the sender, the channel, the link, and the request against what they would expect to receive, and should stop trying to judge whether the writing sounds like a machine.

 

FAQs

How much weight should a 25-person study carry?

Enough to inform training design, not enough to settle the question of whether AI writes better lures than people. The authors note that detecting a difference the size of the one observed would require roughly 100 completed participants. The detection result at 52% is the more robust finding, since it rests on 300 individual judgments rather than a between-groups comparison. Significantly more research needs to be done in order to truly know the likelihood of correctly identifying AI.

 

Why would work-themed messages outperform personal ones so clearly?

Work correspondence arrives constantly, carries implied authority, and often demands prompt action, so an unexpected work message triggers less suspicion than an unexpected message about a hobby. In a clinical setting that covers scheduling changes, credentialing notices, payer correspondence, and system alerts, all of which staff is conditioned to act on quickly.

 

Does the study measure actual clicking?

No. Participants sorted printed cards and stated where their click threshold sat, with no phones involved, no sender numbers displayed, and no working links. Stated intent is a common proxy in phishing research and remains a proxy, likely differing from behavior under real-time pressure.

 

Could the AI-detection classifier be deployed as a filter?

Not on this evidence. It was trained and tested against one dataset from one model with one prompt design, and research cited in the paper shows that paraphrasing AI text with a detector in the loop degrades several such tools substantially. Treat it as a finding about the existence of a pattern rather than a product.

 

What should replace "spot the suspicious message" in training?

Verification habits tied to the request itself, including confirming banking or credential changes through a known channel, checking that a link's destination matches the claimed sender, and treating urgency as a reason to slow down. Those steps hold regardless of how well the message is written.