ABSTRACT Research on phishing, a prevalent cybercrime, has not addressed which dispositional and knowledge antecedents are related to reporting suspicious emails to their organizations and has provided limited attention to emotions as a predictor of being phished. Our prospective design involved two phases where employees and students at a university (N = 538) first completed a survey and then, after 1 month, were sent three phishing emails spaced weeks apart without their knowledge. Trained members were more likely to have knowledge about safe URLs and this accurate knowledge was associated with a lower rate of being phished and a higher rate of reporting phishing emails. Untrained members had a higher rate of clicking on links and a lower rate of reporting suspicious emails than recently trained members, though training efficacy dissipates over time. Members with high generalized anxiety were more likely to click on links and less likely to report phishing emails, suggesting a gap in training curriculum. High avoidant cognitive styles were less likely to report phishing emails, and these styles are more prevalent among those with high anxiety. Policies and training curriculum need to address anxiety to create a stronger defense against phishing and hacking attacks.