Grammar of urgency: linguistics study dissects phishing texts to sharpen scam advisories

An exploratory study published in Humanities and Social Sciences Communications has analysed the language of phishing text messages collected in Australia, comparing 106 scam texts with legitimate messages sent by the organisations that scammers most frequently imitate. The research applied systemic-functional linguistics, a framework that examines how language choices construct meaning, to identify the linguistic features grounded in social engineering techniques that manipulate phishing recipients. Phishing texts are associated with substantial financial losses and reduced wellbeing globally, and the study set out to understand how their wording exerts that pressure.

The analysis identified a cluster of recurring linguistic features across the scam messages. Different clause types, markers of time, location and manner, high modality, and particular uses of conjunctions were found to be influential in creating a sense of urgency and authority. According to the study, these features are likely to manipulate phishing recipients through emotional and cognitive pressure.

The populations most exposed to these tactics are those the study singles out as vulnerable: older adults and people from non-English speaking backgrounds. These groups often struggle to recognise scam tactics because of technological and language barriers, rendering them susceptible to cyberfraud victimisation. Digital scams are described as a reality of a connected society, and the researchers frame their linguistic analysis as a way of understanding why current defences may fall short for the people most at risk.

A central concern of the study is the advisory material meant to protect the public. Many current advisory resources offer generalised advice and explanations of scam tactics, yet fail to include concrete examples of what such communications actually look like. By aligning linguistic analysis with human behavioural constructs and public policy, the study argues that advisory content could be enhanced to better reflect the specific linguistic patterns found in real phishing texts, giving recipients more concrete material to work with when judging the messages that reach them.

The findings also point toward technology. Because the identified features are systematic, the study suggests they could inform the development of automated scam detection systems that flag messages built on urgency and authority markers. The researchers are careful to describe their work as exploratory, and the results are presented as features likely to manipulate recipients rather than demonstrated causal effects on behaviour.

Even with those limitations, the study offers a structured vocabulary for describing scam texts, one grounded in observable grammatical choices rather than vague impressions of suspicious tone, and it connects that vocabulary to practical improvements in both public advisories and detection tools.

Subject of Research: Linguistic analysis of phishing text messages to improve scam advisories for vulnerable groups

Article Title: “Account suspension. Verify now”: using systemic-functional linguistics to improve phishing text advisories for vulnerable groups

Article References: Kawabata, D. (2026). “Account suspension. Verify now”: using systemic-functional linguistics to improve phishing text advisories for vulnerable groups. Humanities and Social Sciences Communications. https://doi.org/10.1057/s41599-026-09540-7

Image Credits: AI Generated

DOI: 10.1057/s41599-026-09540-7

Keywords: phishing, systemic-functional linguistics, scam advisories, cyberfraud, vulnerable groups, elderly, non-English speaking backgrounds, social engineering, text messages, Australia, automated scam detection, urgency