Estimated reading time: 8 minutes
A Token For The Pause Button: Social Engineering Losses And The Click Habit
It’s 2003. Stage. Steve Jobs. Black turtleneck. Mock turtleneck? And words of digital gospel: buying should be easy. No pause. No friction. Steve didn’t invent impulse. He just helped us lean further into it. Maybe it was even a leap.
In 2003, the iTunes Store declared war on friction. One tap and the song was yours. Companies everywhere bowed their heads and joined the play for smooth.
It worked. Goodness me, did it work. In time, online shopping went from “I wonder if I need this?” to a package at your door before you’d finished wondering.
Amazon had patented the one-click buy button in 1999. Then they licensed the trick, pardon, mechanism, to Apple for the iTunes Store. By 2011, Uber was on its way to upending an industry. No haggling, no flagging, no corner competitions as your flight’s departure time ticked agonizingly closer, just a bit of thinking, a tap or two, and the ride was on. If you’ve been around long enough to have had the misfortune of needing a NYC taxi around 4 PM, you know. A blessing, it was.
Every year since Jobs, we have sought to make rough surfaces smoother. That’s not new; eagerness for efficiency is an old habit. But the pace and race for it over the last 25 years has been unrelenting.
Remove the pause. Remove the thought. And you remove the moment where a person might reconsider.
The Pause Was Doing A Job
In our haste, we failed to remember the pause had a job. Our judgment, in some respects, lived there. And it worked well for us. But we spent a generation’s worth of venture capital hunting it down and killing it. Every checkout flow. Every app. And every “click here to continue.”
Turns out human beings, deprived of friction, don’t get more careful. They get worse. We conditioned an entire species to click first and think never. We made ourselves easy marks. That’s all well and good if you are making the purchase, ill-advised or not; you bought it. But this habit to click found other benefactors. Cybercriminals took note.
We were handed a phishing email formatted exactly like every other frictionless prompt. A website for our bank that appeared identical to the naked eye, the eyes attached to a body eager to just get it done. Conditioned to click, reply, act now, we did. And we do. Decades of conditioning will do that.
Recently, cyber insurer Resilience found that phishing, social engineering, and transfer fraud drove 85.3% of the losses in its cyber insurance portfolio this year. Not exotic malware. A person, click, click, clicking. Exactly as taught.
The field of behavioral psychology is an open book. Everything the supermarkets know about laying out a store to drive impulse purchases, the criminals know as well. We are conditioned to click, and that makes it easy for us to be tricked.
The bad actors didn’t have to build anything clever. They just imitated. Perhaps flattering. Definitely costly. Very costly.
Let’s put a number on it. The number gets silly fast. Cybersecurity Ventures projected the cost of global cybercrime would hit $10.5 trillion last year. I’ve called it the Moby-Dick of statistics. A number so large it stops meaning anything. It is just big. Really big.
Plenty of serious people think that figure is inflated. Fine. Take a hatchet to it. Cut it in half. You’re still at $5.25 trillion. Hell, let’s cut it by 90%. That’s still one trillion and fifty billion. You’d hit the brakes and stop the car for that.
Smarter People Saw This Coming
Much smarter people than me have been banging on about this for years. Some of them have been dead thousands of years. Timeless wisdom is how it’s billed. Way back, Seneca wrote On Anger, arguing that delay was the only real cure for it. That the first impulse is always the worst one. That the waiting brings wisdom. Allows judgment to come back online.
We’ve baked the idea into our language. Look before you leap, sleep on it, count to ten, measure twice – cut once, don’t send the email tonight.
Take a breath!
We might be wise to embrace that I will call henceforth Zoneoutmaxxing (trademark pending); Utilizing the part of your brain that only switches on when you stop fixating on the problem. When you pause. Don’t think more. Don’t think at all about it.
Turns out these cliches, and my new yet-to-be-monetized, or even thought-out, maxxing trend, are more than just folksy wisdom. Neuroscientists call it the default mode network. This part of our brain lights up when we step away from the matter at hand; you know this moment of inspiration, in the shower, on a walk, half-asleep.
A 2012 UC Santa Barbara study found people solved problems better after a break, while doing something boring and automatic, rather than grinding away. The brain needs the boring bit. It needs the pause where nothing is being asked of it. Call it your own organic agent, working away in the background while you rinse your hair.
Tristan Harris has spent a decade explaining that every screen is a slot machine with better lighting, engineered the same way a casino floor is, to get you to act, not think. Cal Newport keeps politely suggesting that maybe, just maybe, a species built for effort, and apparently for boredom, wasn’t supposed to live entirely without either. Shoshana Zuboff wrote the book on what happens when removing friction becomes the whole economic model.
Petitions or letters signed by many at AI firms have recently entered the conversation. A call for more thought. But multi-billion-dollar valuations and IPOs don’t blend well with go slow and be thoughtful. But the fear seems to be, for some, “we are going too fast, and we might break everything.”
Tech Age – Middle Age
Here’s the human angle. If you peg the 90s as the dawn of all this, the internet for all starting point, it’s right to say we have entered a sort of middle age. A time when, in the human context, a reckoning often happens. Our knees are a bit wonky. Burgers need to give way to some lentils.
In the sense of our technological lives, the “blood draw” has revealed a bit too much bad code. Call it an inflection point, to keep this billable. And a misspent youth, to some degree, is coming back to haunt us. We can buy almost anything from a toilet seat and have it delivered in days. But virtually everything about our tech is designed to make it work and be cheap.
Thirty years of software built on cheap, fast, frictionless. But not so secure. Secure was friction. Now the bill’s due. We click when we shouldn’t. All this payable in ransoms, wire fraud, and even when it’s legit, there’s the debt. AI, and specifically agentic AI, add a new specter to this, and the future that haunts many is one where this same unbridled drive comes at an ever higher cost than a few bitcoin to get your files unencrypted by a ransomware gang.
Time to eat the fruit and vegetables. Sprinkle in a pause button or two. Nothing fancy. Just enough grit to make the next click a little less automatic. We can do this, and we should do this.
We’ve had enough “click first, ask questions later.”
FAQ – Social Engineering Losses
What share of cyber losses come from social engineering?
Resilience reported that phishing, social engineering and transfer fraud accounted for 85.3 percent of incurred losses across its portfolio in the first half of 2026. That figure stood at 17.7 percent in the first half of 2024.
Is AI creating new types of cyber attack?
Not yet, according to Resilience claims data. The firm recorded no incurred losses from AI-specific vectors including prompt injection, model exploitation or agentic misuse during the period. AI is making familiar attacks more convincing rather than inventing new ones.
Why do people click on phishing emails?
Because they were trained to. Twenty-five years of interface design removed friction from every transaction, on the reasonable theory that friction cost sales. The pause that friction created was also where judgment lived.
What is the default mode network?
A pattern of brain activity that engages when attention moves away from a task. Research on incubation effects suggests people solve problems better after an undemanding break than after grinding continuously at the problem.
Does adding friction actually reduce fraud losses?
Controls that force a pause, such as callback verification and dual sign-off on payments, are widely recommended for exactly this reason. Resilience names both as mitigations. Published loss data comparing organisations with and without them remains thin.
Related Cyber Insurance Posts
- Payment Fraud Controls Have To Work When Nobody Notices Anything Wrong
- Deepfakes, Emails, and Lies: Social Engineering’s Corporate Help Desk Takeover(Opens in a new browser tab)
- CISO: AI Risk Reshapes Cybersecurity Strategy In Retail And Hospitality(Opens in a new browser tab)
- New Data Shows Training Cuts Phishing Risk by 86% – A Big Win for Cybersecurity(Opens in a new browser tab)
- Top Strategies for Identity Verification in the Age of Deepfakes, Remote Work, and AI Threats(Opens in a new browser tab)
Great piece, Martin. One thing that jumps out at me is the movement in the loss data. Going from 17.7% to 85.3% in two years raises an important question: are we spending enough time trying to identify where these trends are going next? We have increasingly rich historical threat and loss data, and we’re getting better at understanding which security controls materially affect outcomes. That creates an opportunity to move threat intelligence beyond simply describing what happened toward forecasting what is likely to happen next. AI may be the headline, but as you point out, sometimes the more important story is how AI accelerates threats we already understand.