By Heidi Mitchell

FOMO, or fear of missing out, isn't just a painful feeling -- it's also a big phishing vulnerability for young adults on social media.

Two recent studies of Instagram users between the ages of 16 and 29 show that the promise of a social opportunity can be so alluring that it can cause many young people to let down their guard and fall for a phishing scam.

We spoke with the lead author of both studies, Jennifer Klütsch, a Ph.D. candidate and research associate in the work and engineering psychology department at RWTH Aachen University in North Rhine-Westphalia, Germany, about her research. Here are edited excerpts of that conversation.

WSJ: What makes young people vulnerable to phishing scams on social media?

KLÜTSCH: Young adults use most social-media services more than any other age group, which makes them good targets. The issue is that frequent social-media use leads to people making quick, instinctive decisions instead of systematically evaluating risks. Rather than scrutinizing a suspicious link, they often simply check if the sender is familiar.

In my study, 82.9% fell for a suspicious link in a message at least once, and particularly for those that appeared to be from a friend or a follower. They interacted without a second thought because they trust the Instagram platform.

Additionally, young adults in particular have an intense fear of missing out on social experiences. One of my studies showed that phishing messages promising social opportunities -- like an invite that says, "Check out this private event happening tonight!" -- were the most successful. FOMO drives impulsive decision-making, making young adults particularly easy targets for social-engineering attacks.

WSJ: How do scammers set up one of these social-media phishing scams?

KLÜTSCH: Phishing on social media typically happens in three stages. First, scammers send a friend request or "follow" a target. Then, they send a direct message, often containing a link that promises something appealing. Finally, if the user engages, they might be tricked into entering login credentials or downloading malware.

What's particularly concerning is that some phishing scams involve hacked accounts of real friends or followers. So even if the victim only trusts messages from people they know, they're still at risk.

WSJ: What advice do you have for young adults to protect themselves from phishing scams?

KLÜTSCH: First and foremost, slow down. Social media encourages fast, habitual interactions, but taking an extra moment to think before clicking a link can make a huge difference. Ask yourself: Why am I receiving this message? Does this look normal?

Also, don't be afraid to verify messages with your friends. If someone sends you a suspicious link, ask them directly through a different messaging app if they actually sent it.

Lastly, be aware that phishing can happen anywhere -- not just in emails. People tend to think phishing is only a problem for older adults with email scams.

WSJ: What should tech companies do to prevent phishing on social media?

KLÜTSCH: Instagram introduced a feature that alerts users about a suspicious link before they leave the app, such as a warning when an account sends a deceptive link. This is a promising technical implementation to prevent phishing because it interrupts the user's habitual response. However, research suggests that warnings or information should be further complemented by simple visual depictions, such as a phishing meter, to facilitate an immediate and quick risk assessment.

WSJ: What about educators and parents? How can they help?

KLÜTSCH: Cybersecurity education should be a priority in schools and universities. The problem is that people assume young adults are "digital natives" who automatically know how to avoid scams.

Parents should also talk to their kids about social-media risks. If parents can explain that anyone can be a target, it might encourage more caution.

Heidi Mitchell is a writer in London and New York. She can be reached at reports@wsj.com.

(END) Dow Jones Newswires

March 18, 2025 12:00 ET (16:00 GMT)

Copyright (c) 2025 Dow Jones & Company, Inc.