More than half engage with suspicious emails and SMSs . Only 5% can correctly identify which emails and SMS are legitimate or scams
KnowBe4, the provider of the world’s largest security awareness training and simulated phishing platform, today announced new research which has found more than six in ten Australian office workers (63 per cent) don’t believe using their work email for personal activity is a security risk to their employer.
Furthermore, only four in ten (40 per cent) say they always report suspicious emails and SMSs to the IT team responsible for cyber security. More than half (52 per cent) say they engage with suspicious emails and SMSs. In addition, 43 per cent say they are not confident in identifying which emails are legitimate and which are scams, and 46 per cent feel the same way about identifying SMSs. However, when tested, that number fell even more with only five per cent able to correctly identify all the real and scam emails and SMSs.
Jacqueline Jayne, Security Awareness Advocate for APAC at KnowBe4 is concerned: “The obvious first issue with this is that if Australians are unable to identify scam emails and SMS messages then they are at significant risk of getting phished or smished*, risking both their security and that of their employer. According to the ACCC, Australians lost a record $323 million to scams in 2021 (up a massive 84 per cent from the previous year) and the FBI reported smishing alone in the US cost Americans more than $50m in 2020 so the potential cost to Australians is huge.”
In addition, more than one in ten admit to using their work email address (14 per cent) and their work phone (14 per cent) for personal activities and one in three (34 per cent) Australian office workers admit to using the same password for more than one account.
Jayne continues: “When employees are using their work email address for personal activities such as online shopping, they are much more likely to fall victim of a phishing attack that uses a hook such as delivery delays to entice the victim to click through. Having a clear separation between work and personal activities makes it much easier to spot when an email is a scam – if you know you never shop online using your work email address then you know that email from Amazon can’t be real.”
Millennials the highest risk:
Research reveals that Millennial office workers may pose the highest risk as they are more likely than their older counterparts to:
- Use their work email address for personal activities (Millennials 19 per cent compared to Gen X 11 per cent and Baby Boomers 7 per cent);
- Engage with suspicious emails (Millennials 53 per cent compared to Gen X 39 per cent and Baby Boomers 20 per cent) and SMSs (Millennials 51 per cent compared to Gen X 42 per cent and Baby Boomers 23 per cent) ;
- Say they are not confident that they could identify suspicious emails (Millennials 48 per cent compared to Baby Boomers 30 per cent) and suspicious SMSs (Millennials 50 per cent compared to 36 per cent); and,
- Believe that using work email for personal activity is not a security risk to their employer (Millennials 66 per cent compared to Baby Boomers 49 per cent).
Advice to stay safe:
Awareness is the number one way to avoid falling for a phishing or spam email so it’s imperative employees are educated to stop and think before they act on anything. You need to be very careful of any emails or text messages that require you to click a link, open an attachment, share your login details, or change your password.
Here are some examples of the wording used in these tactics:
- Your credit card has been used in fraudulent activities, update your details now.
- Open the attachment to see all of the people in your suburb with Covid19.
- Click here to claim your $200 shopping voucher.
- Like, share and comment to go in the draw to win a $50,000 car.
- Unsubscribe from this mailing list.
- You can jump the queue for your Covid19 vaccine, click here.
- Account Deactivation Notification – click here to confirm your details.
- You have a new connection request on LinkedIn – click here to find out more.
- Password change notification – your account has been compromised.
- Congratulations! You have won a computer – click here to claim your prize.
*Phishing – malicious emails. Smishing – malicious SMSs. Vishing – malicious phone calls (live or recorded)
