Phishing is a persistent organizational threat, yet most empirical work emphasizes post-exposure susceptibility rather than the confidence judgments that shape behavior when suspicious messages arrive ...