You trust your team, right?

They’re smart, capable, and they know better than to click on suspicious links or open unexpected attachments.

They already know that phishing emails look trustworthy on purpose. To trick them into giving away sensitive data or downloading malicious software.

So, they’re not the type to fall for it.

At least, that’s what they think…

Here’s the problem: Just because someone’s confident they could spot a phishing attack, it doesn’t mean they can. It’s a false sense of security – and it’s exactly what cyber criminals count on.

New research has found that a huge 86% of employees believe they can confidently identify phishing emails… yet over half of them have fallen for some form of scam in the past.

Think about that for a second.

These are people who knew about phishing, felt sure they wouldn’t be tricked, and yet still got caught out. That’s because cyber criminals aren’t just sending out the obvious “foreign prince” emails anymore. They’re using sophisticated tactics like:

• Emails that look like they’re from your bank or suppliers.
• Fake invoices that appear totally legitimate.
• Messages that seem to come from your own colleagues.

Because phishing scams have evolved, they’re much harder to spot. And when someone thinks they’re too smart to fall for one, that’s when they’re most at risk.

Overconfidence in cyber security is a classic case of the Dunning-Kruger effect – a psychological phenomenon where people tend to think they know more than they do.

What’s the problem with being too confident?

Well, when people believe they’re invincible to scams, they don’t take the necessary precautions. Instead of double-checking links or questioning unexpected emails, they just assume “I’d never fall for a scam” and carry on clicking. This is how cyber criminals end up accessing business systems and data.

So, what’s the good news?

You can lower the risk of getting hit by a phishing attack. But it starts with a shift in mindset. Instead of assuming your people know what they’re doing, make sure they’re properly informed. Regular phishing awareness training can make a massive difference, helping your staff to recognise newer and more subtle scams before it’s too late.

Training alone isn’t enough, though. Your employees also need to feel comfortable reporting anything suspicious, or they might stay quiet about a potential scam. And that gives cyber criminals the upper hand. Creating a workplace culture where security concerns are welcomed (not criticised) is just as important as education.

Cyber security isn’t about intelligence; it’s about vigilance. Even the most tech-savvy employee can be caught off guard by a well-crafted scam. The key is to assume a threat is real, remain cautious, and never rely on confidence alone. 

The moment someone thinks “I’d never fall for that” is often the moment they do.