Ironically, the most successful phishing emails of Q3 2017 told recipients that they had been victims of a data breach.
This finding comes from aĀ report from KnowBe4Ā that investigated the most effective phishing email subject lines. The report looked at tens of thousands of emails from simulated and custom phishing tests, and discovered that the most clicked subject line was āOfficial Data Breach Notificationā.
Phishing subject lines
The top ten most clicked subject lines were:
- Official Data Breach Notification
- UPS Label Delivery 1ZBE312TNY00015011
- IT Reminder: Your Password Expires in Less Than 24 Hours
- Change of Password Required Immediately
- Please Read Important from Human Resources
- All Employees: Update your Healthcare Info
- Revised Vacation & Sick Time Policy
- Quick company survey
- A Delivery Attempt was made
- Email Account Updates
KnowBe4 also evaluatedĀ phishing email subject lines specifically from social networks. The most clicked subject lines were messages ostensibly from LinkedIn. This is worrying for organisations, as many people link their work email address to their LinkedIn account, and a successful phishing attack could expose the company to a data breach or further phishing emails.
Other common social media phishing emails claimed that someone had attempted to log in to their accounts, that theyād been tagged in a photo or that theyād received free pizza.
āNearly impossibleā for technology to protect you
Commenting on the study, KnowBe4ās chief evangelist and strategy officer, Perry Carpenter, said: āThe level of sophistication hackers are now using makes it nearly impossible for a piece of technology to keep an organization protected against social engineering threats. Phishing attacks are smart, personalized and timed to match topical news cycles. Businesses have a responsibility to their employees, their shareholders and their clients to prevent phishing schemes.ā
You can take action against targeted phishing attacks by enrolling your staff on ITG Phishing Staff Awareness Course.
This online course shows your staff how phishing works, what to look out for and how to respond when they receive a malicious message. Itās ideal for all employees who use the Internet or email in their day-to-day duties and, as such, itās delivered in simple terms that everyone in your organisation can understand.
Find out more about our Phishing Staff Awareness Course >>
