KnowBe4 identifies email and SMS security risks for APAC

KnowBe4 has released new research which has found more than half of APAC office workers (59%) don't believe using their work email for personal activity is a security risk to their employer.

Furthermore, less than four in ten (39%) say they always report suspicious emails and SMSs to the IT team responsible for cyber security.

More than half (51%) say they engage with suspicious emails and SMSs. Almost half of APAC office workers (46%) say they are not confident in identifying which emails are legitimate and which are scams, and 48% feel the same way about identifying SMSs.

However, when tested, that number fell even more with only 3% able to correctly identify all the real and scam emails and SMSs.

KnowBe4 security awareness advocate for APAC Jacqueline Jayne says this is concerning. She says, "The obvious first issue with this is that if APAC office workers are unable to identify scam emails and SMS messages then they are at significant risk of getting phished or smished, risking both their security and that of their employer."

'Smished' refers to malicious SMSs, phishing refers to malicious emails and vishing describes malicious phone calls (live or recorded).

According to the ACCC, Australians lost a record $323 million to scams in 2021 (up a massive 84% from the previous year).

Meanwhile, 790 Singaporean victims fell prey to the recent OCBC smishing scam with a total loss amount of SGD$13.7 million, so the potential cost to APAC businesses is huge.

In addition, more than one in ten admit to using their work phone (14%) and their work email address (11%) for personal activities and more than one in three (34%) APAC office workers admit to using the same password for more than one account.

Jayne continues, "When employees are using their work email address for personal activities such as online shopping, they are much more likely to fall victim of a phishing attack that uses a hook such as delivery delays to entice the victim to click through.

"Having a clear separation between work and personal activities makes it much easier to spot when an email is a scam if you know you never shop online using your work email address then you know that email from Amazon can't be real."

KnowBe4 states that awareness is the number one way to avoid falling for a phishing or spam email so it is imperative employees are educated to stop and think before they act on anything.

Users need to be very careful of any emails or text messages that ask the reader to click a link, open an attachment, share login details, or change a password.

Here are some examples of the wording used in these tactics:

• Your credit card has been used in fraudulent activities, update your details now.
• Open the attachment to see all of the people in your suburb with COVID-1919.
• Click here to claim your $200 shopping voucher.
• Like, share and comment to go in the draw to win a $50,000 car.
• Unsubscribe from this mailing list.
• You can jump the queue for your COVID-1919 vaccine, click here.
• Account Deactivation Notification click here to confirm your details.
• You have a new connection request on LinkedIn click here to find out more.
• Password change notification your account has been compromised.
• Congratulations! You have won a computer click here to claim your prize.