Monday 5 October 2026 | 4-minute read
Hello Champions! October is Cyber Security Awareness Month, so this is a great week to do what you do. And the research this week carries a genuinely encouraging message: scammers are creatures of habit. Their stories change constantly, but their tricks barely change. Once you know the habits, you can help everyone around you spot them. Here are five things worth knowing, each with a small action you can take.
1. Most of the risk sits with just a few people, and it moves around
A security company called Living Security studied records from more than 100 organisations and found that almost all the risky activity came from roughly one person in ten. Here is the twist: it was not the same people each year. About two in three of the "risky" group were new to it, usually because their job, tools or access had changed. So there is no such thing as a permanently careless colleague, just people whose circumstances changed faster than their habits.
Talking point: "Anyone can be the risky one this year, including me." Try saying it in your next team catch-up. It swaps blame for watchfulness, and it is a kind way to explain why security asks never really stop, even for people who have heard them all before.
2. Researchers read 2.9 million scam emails. The stories vary; the ask does not
A university research team analysed 2.9 million real scam emails collected over a year. The cover stories were endlessly varied: deliveries, invoices, prizes, urgent requests from the boss. But in about 7 out of 10 emails, the actual request was exactly the same: click this link. One trend to watch, though. Fake invoice emails increasingly ask you to phone a number instead, because a friendly voice on a call can talk people around in ways an email cannot.
Try this activity: Collect two or three recent scam emails (your security team will happily supply some) and ask your team one question about each: "Never mind the story, what is it asking me to DO?" It takes five minutes, and it teaches the single most useful habit there is: judge the ask, not the story. And if an unexpected invoice asks you to ring a number, treat that number as suspect too.
3. The newest trick: getting you to do the scammer's work
The European Union's cyber security agency published its big yearly review of online threats. One trick stood out as one to know about: fake error messages, or "fix it" pop-ups, that ask you to copy text and paste it into your computer to solve a problem. Doing so actually runs the scammer's commands. The review also flagged a rise in scam texts and phone calls from people pretending to be IT support.
Talking point: Share this one line with your team: "No real website ever asks you to copy and paste commands into your computer to fix something. If you see that, stop and report it." It is new enough that most people have never been warned about it, which makes you the person who got there first.
4. Feeling confident about scams is not the same as being safe
A global alliance of organisations that fight scams surveyed 1,200 adults in Japan. About 1 in 5 had run into a scam in the past year, and nearly 6 in 10 felt confident they would recognise one. Yet of the people who did meet a scam, more than half ended up engaging with the scammer anyway. Confidence and caution, it turns out, are not the same thing, and the same pattern shows up in country after country.
Evidence you can use: "More than half the people who met a scam engaged with it, even though most felt sure they would spot one." That single line is gold when someone says scam advice is only for other people. Programme leads, it also makes a strong case for keeping scam awareness in the plan even when confidence surveys look rosy.
5. Free, ready-made materials for Awareness Month
This year's Cyber Security Awareness Month theme is "Don't Make It Easy For Them", and it is a good one: you do not need to outsmart every criminal, just avoid being the easiest target. The organisers (a US non-profit and the US government's cyber agency, though the materials work anywhere) offer a free toolkit with posters, tip sheets and social media graphics, all built around four habits: strong passwords with a password manager, two-step login, spotting and reporting scams, and keeping software up to date.
Try this activity: Download the free toolkit and put one poster up (or one graphic in your team channel) this week. Pick the habit your team is weakest on. One poster, one habit, done by Friday.
That is your week. One talking point shared, one poster up, one question asked about a scam email: none of it looks like much on its own. But habits are catching, good ones included, and yours reach further than you think. Go make a splash.