Phishing Scams: 22% Of Your Employees Are Likely To Fall For Them, New Study Shows

How Do Phishing Scams Work?

Phishing is a cyberattack in which threat actors pose as a trustworthy entity or person, using several ways of online communication to spread malicious links or attachments that can perform a variety of functions, but to one single end: stealing the victim’s data for financial gain.

This type of online fraud uses subtle and cunning social engineering strategies that allow cybercriminals who leverage human trust to steal the victim’s sensitive data, which is a lot easier than breaching a computer’s or a network’s defenses.

It usually starts with an email that looks harmless enough to open and take the requested action. It can look like it comes from an executive (CEO fraud or BEC – business email compromise), a supplier, or any other trusted person or company. However, the message contains either a link to a credential-stealing website or an attachment hiding malware.

22% of employees are likely to fall fro phishing scams.

Almost A Quarter Of Your Employees Would Take The Bait

According to a new study from Phished, an AI-driven cybersecurity company, a jaw-dropping 22% of employees globally are likely to fall for phishing scams, exposing their organization to the risk of a devastating cyberattack.

The report shows that of workers who open a phishing email, 53% will click a poisoned link within it, while 7% will download and open a malicious attachment.

When prompted to provide sensitive data, for instance on a spoofed login page, 23% of recipients fill in their information.

“Although these figures already point to a systematic problem among the working population, perhaps most concerning is the fact that no less than seven percent of all employees open a suspicious email attachment. While phishing — usually — requires an extra step before the real damage is done, a malicious attachment can have serious consequences immediately,” says Arnout Van de Meulebroucke, CEO of Phished.

The analysis found that workers in the public sector are 3% more likely to fall victim to phishing scams than those in the private sector. UK public sector employees were 2.5% less likely to be tricked by phishing attempts than the global 3% average.

The most successful attacks use topics revolving around the COVID-19 pandemic. Emails about testing facilities and vaccinations made it to the top of the list, followed by messages regarding measures and IT controls associated with working from home.

Experts urge companies to implement security awareness training programs ASAP.

“The task for the coming year is clear: organizations must focus explicitly on awareness among their employees,” adds Van de Meulebroucke. “In recent years, the volume of phishing attacks has increased exponentially and without a radical countermovement, these campaigns will continue to claim more victims, resulting in major losses for organizations. A one-off workshop does not help against phishing. People need thorough, repeated training to help them recognize increasingly sophisticated phishing messages,” the report concluded.

Protect Your Business With ATTACK Simulator’s Security Awareness Training

Our realistic phishing simulations will expose your employees to life-like hands-on fake phishing attacks, so they can be prepared for the real thing.

Here are some awesome perks of choosing us:

Automated attack simulation – we simulate all kinds of cyberattacks: phishing, malware, ransomware, spear-phishing, identity theft, online privacy attacks, online scams etc.
Real-life scenarios – we evaluate users’ vulnerability to give company-related or pesonal data away using realistic web-pages.
User behavior analysis – we gather user data and compile it in extensive reports to give you a detailed picture of your employees’ security awareness level.

Malicious file replicas – our emails contain malware file replicas, to make the simulation as realistic as it can be.
Interactive lessons – if employees fail to recognize our traps and fall into one, they will be redirected to landing pages with quick reads on the best security practices.
We impersonate popular brands on our simulated phishing pages – the user will be more tempted to click on the URL or open the attachment in the email.

ATTACK Simulator’s Security Awareness Training program will help you equip your employees with the necessary security knowledge and up-to-date security practices to keep your company safe from scammers and avoid potentially irremediable damage.