It’s easy to think that only newbies and innocents will fall prey to a phishing scam, and that you are safe. After all, you know better than to believe there really is a Nigerian Prince who wants to give you free money.

But it’s not just the ‘send me your bank account information’ that can cause issues. Phishing scams can include password captures and sabotaging systems, among other malware. It’s estimated it costs one trillion dollars worldwide.

Part of the problem is that there really is little proof that training and explaining what the threats look like actually helps prevent the crimes. There is a chance, actually, that by ‘knowing what to look for’ and feeling confident you won’t get scammed, you are actually more likely to be a victim. (This has actually been common for centuries, and played on by confidence artists and magicians both.)

So, while I do not want to contribute to this ‘I know more therefore I am immune’ idea, here are some things modern research are showing that allow otherwise smart people to get scammed.

The belief that email is pretty much safe. It leads people to think that that their email is perfectly safe and to ignore red flags within messages. I’m writing this partially because I got an email from someone I knew asking me to open an attachment because it was what I had requested. I had recently asked for a file to be sent to me, and I gleefully went to open it, before I noticed the spelling was atrocious. Two days later came the message ‘don’t open any attachments from me!’

Being on autopilot. You know, you aren’t really paying attention because you are checking email while doing something else and you are clicking on things before you even realize what it is you just clicked on. I know I have done that, and close out of it very quickly, hoping no damage done.

And checking your email constantly actually contributes to this. If you do it all the time, like a habit, you can easily simply ignore red flags and click where you shouldn’t.

So your best bet is to remember all the signs you already know and all the ways to verify that an email is from who it says it is, that links go where they say they will, and that it hasn’t been hacked. And to be aware— it’s still a dangerous thing. If you are just cleaning up email in between other jobs and not paying real attention, you can get burned. No matter how smart you are. Because, in the long run, we users are the weakest link in security.