Why are more employees falling for phishing scams—and what can you do about it?
Have you ever considered how many phishing scams your employees face daily? The reality might be more alarming than you think.
Over the past year, the number of employees clicking on phishing links has tripled—and businesses are feeling the impact.
But before we dig into what’s driving this trend, let’s take a step back.
Phishing involves cybercriminals pretending to be a trusted source to trick people into giving up sensitive details—like passwords or payment information.
Picture this: One of your staff receives an email that appears to come from Microsoft, complete with a convincing link to a login page. Once they enter their credentials, that information is handed straight to scammers… effectively giving them the keys to your business.
Here’s what’s even more concerning: phishing attacks aren’t just increasing—they’re also becoming far more sophisticated and difficult to detect.
While email phishing is still a major issue, attackers are expanding their tactics. They’re hiding malicious links in search engine results, social media posts, online ads, and even website comment sections. They know that staff are more alert to email scams, so they’re adapting their methods to catch people off guard.
So, why are more employees falling for these scams?
Fatigue plays a big role. With phishing attempts showing up constantly, it’s tough for anyone to stay vigilant all day. On top of that, scammers are getting better at creating realistic-looking fake websites and emails that are almost indistinguishable from the real thing.
And now, they’re targeting platforms like Microsoft 365—home to a wealth of sensitive business data.
Your team can either be your strongest line of defence or your biggest risk. An educated, vigilant workforce can spot phishing attempts before any harm is done. But if employees aren’t properly trained, a single careless click can lead to stolen data, financial losses, and major disruption for your business.
What can you do about it?
Start with awareness. Help your staff recognise phishing attempts—across emails, websites, social platforms, and ads. Encourage them to question unusual requests for login details, double-check suspicious links, and report anything that doesn’t look right. Don’t assume one training session is enough—make regular updates part of your cyber security strategy.
Also, don’t place all the responsibility on your employees. Implementing tools like multi-factor authentication (MFA) provides an extra layer of protection. Even if a password is compromised, MFA can prevent access. Combine this with regular software updates and a robust cyber security framework, and you’ll significantly reduce your business’s risk.
Phishing scams aren’t going away—but with the right measures in place, you can keep your organisation from becoming the next target.
