Abstract: Whether users can correctly identify phishing is the last line of defense against their attacks， and frequent and unavoidable interruptions pose a serious challenge for users to quickly process large amounts of emails and identify phishing. Task interruption has been proven to have both positive and negative effects on the main task， and research conclusions are inconsistent. Therefore， the role of task interruption in identifying phishing needs further explorations. This article is based on the drift diffusion model and constructs a research model for interrupt state， behavior selection， behavior selection， and interrupt state. Bayesian estimation of model parameters is used to analyze the drift rate， boundary height， starting point deviation， and non-decision time of user identification phishing in the presence or absence of interruptions. The analysis of online experimental data found that task interruption has a double-edged sword effect on correctly identifying phishing emails for users. When there is interruption， the user’s reaction time becomes shorter and there is no significant difference in accuracy， but the drift rate decreases， leading to higher boundary heights. In addition， relevant analysis on differences in accuracy， gender， susceptibility， and knowledge and experience found that when there is no interruption， the individual is male， the higher the accuracy， the lower the susceptibility， and the lower the knowledge and experience， the drift rate is faster， and the non-decision-making time for coding is shorter. However， when there is interruption， the individual is female， the lower the accuracy， and the lower the knowledge and experience， the drift rate is faster. This study extends the perspective of third-party task interruptions beyond the subject and object to explore the environmental factors that affect user identification of phishing， provides practical guidance for improving users’ ability to recognize phishing attacks.

Key words: phishing identification, task interruption, drift diffusion model, phishing susceptibility, knowledge and experience