A UK-Focused Myth-Buster
Introduction
Phishing and social engineering attacks are rising in the UK, but misinformation about how they work, and how to stop them, often leaves individuals and businesses vulnerable.
This myth-buster separates fact from fiction, using UK-specific data, expert insights, and real-world examples to help you stay safe.
“Myths about cybersecurity can be as dangerous as the threats themselves.”
🚨 Common Myths vs. Facts
❌ Myth 1: “Phishing emails are always poorly written and easy to spot.”
✅ Fact: AI-generated phishing emails are now indistinguishable from legitimate ones.
- Why it’s wrong: While some phishing emails contain spelling errors, AI tools (e.g., WormGPT, FraudGPT)now craft grammatically perfect, highly personalised messages.
- UK Example: In 2025, a UK law firm lost £2.1 million after employees clicked on a flawlessly written emailimpersonating the managing partner (Verizon DBIR 2026).
- Statistic: 300% increase in AI-generated phishing emails in 2025 (IBM Cost of a Data Breach Report 2026).
“We’ve seen phishing emails so well-written that even cybersecurity professionals have fallen for them.”
❌ Myth 2: “Only gullible people fall for phishing scams.”
✅ Fact: Anyone can be tricked—even cybersecurity experts.
- Why it’s wrong: Phishing exploits human psychology (e.g., urgency, authority, fear), not just naivety.
- UK Example: In 2024, a cybersecurity researcher at a UK university clicked on a fake conference invitation, leading to a data breach (The Register, 2024).
- Statistic: 90% of cyber breaches in the UK involve human error (NCSC, Annual Review 2025).
“It’s not about intelligence—it’s about being human. Even the most tech-savvy people can be caught off guard.”
❌ Myth 3: “If I have antivirus software, I’m safe from phishing.”
✅ Fact: Antivirus alone can’t stop phishing—user awareness is key.
- Why it’s wrong: Antivirus software scans for malware, but phishing often relies on tricking users into handing over credentials (no malware needed).
- UK Example: In 2025, a UK SME with up-to-date antivirus lost £50,000 after an employee entered login details into a fake Microsoft 365 portal (Action Fraud, 2026).
- Statistic: 43% of UK businesses that experienced a breach had antivirus installed (Cyber Security Breaches Survey 2025).
“Antivirus is like a seatbelt; it’s essential, but it won’t stop you from crashing if you drive recklessly.”
❌ Myth 4: “Phishing only happens via email.”
✅ Fact: Phishing occurs across multiple channels, including texts, calls, social media, and even in person.
Phishing Method | Example | UK Prevalence |
Smishing (SMS Phishing) | Fake “Royal Mail parcel delay” texts | 40% of UK adults received a smishing text in 2025 (Ofcom, 2026) |
Vishing (Voice Phishing) | AI voice cloning of a “bank manager” | 200% increase in 2025 (Which?, 2026) |
Social Media Phishing | Fake LinkedIn job offers from “recruiters” | 1 in 3 UK professionals targeted in 2025 (LinkedIn, 2026) |
In-Person SocialEngineering | USB drops in car parks, tailgating into offices | 60% of UK employees would plug in a random USB (Palo Alto Networks, 2025) |
“Cybercriminals go where the victims are. If you’re on WhatsApp, LinkedIn, or even dating apps, you’re a potential target.”
❌ Myth 5: “Small businesses aren’t targeted by phishing attacks.”
✅ Fact: SMEs are the most common targets; 43% of UK cyberattacks in 2025 were against small businesses.
- Why it’s wrong: Cybercriminals see SMEs as “low-hanging fruit” due to weaker security, lack of training, and limited budgets.
- UK Example: In 2025, a Bristol-based SME lost £80,000 after an employee clicked on a fake HMRC tax refund email(BBC News, 2025).
- Statistic: 60% of UK SMEs that suffer a cyberattack go out of business within 6 months (FSB, 2026).
“Small businesses often think they’re too small to be targeted, but that’s exactly why they’re at risk.”
❌ Myth 6: “If I don’t click on links, I’m safe.”
✅ Fact: Some phishing attacks don’t require clicking; just opening an email can be enough.
- Why it’s wrong: Zero-click attacks (e.g., malicious email headers, embedded images, or pre-loaded scripts) can infect devices without any user interaction.
- UK Example: In 2024, a UK council’s IT system was compromised by an email that automatically downloaded malware when opened in the preview pane (NCSC, 2025).
- Statistic: 1 in 5 phishing attacks in the UK in 2025 required no user interaction (Proofpoint, 2026).
“The most dangerous phishing attacks are the ones you don’t even notice.”
❌ Myth 7: “Multi-Factor Authentication (MFA) makes me completely safe from phishing.”
✅ Fact: MFA significantly reduces risk, but it’s not foolproof – attackers can bypass it.
- Why it’s wrong: While MFA blocks 99.9% of automated attacks (Microsoft Security, 2025), advanced phishing techniques can still trick users into approving MFA prompts or stealing session cookies.
- UK Example: In 2025, a UK financial services firm suffered a breach after employees approved MFA requests from attackers who had stolen their credentials via a fake login page (NCSC, 2026).
- Statistic: 15% of successful phishing attacks in the UK in 2025 bypassed MFA (CrowdStrike, 2026).
“MFA is essential, but it’s not a silver bullet. Attackers are constantly finding new ways to bypass it.”
❌ Myth 8: “Phishing attacks only come from external hackers.”
✅ Fact: Insider threats (e.g., disgruntled employees or contractors) can also launch phishing attacks.
- Why it’s wrong: Insiders (current or former employees, contractors) have legitimate access, making their phishing attempts harder to detect.
- UK Example: In 2024, a former IT contractor at a UK healthcare provider sent phishing emails to colleaguesto steal patient data before leaving the company (The Guardian, 2024).
- Statistic: 20% of UK cyber incidents in 2025 involved insider threats (Verizon DBIR 2026).
“Insider threats are particularly dangerous because they exploit trust. A phishing email from a colleague is far more likely to be clicked.”
❌ Myth 9: “Once I’ve reported a phishing email, the threat is over.”
✅ Fact: Reporting is just the first step—you must also take action to mitigate risk.
- Why it’s wrong: Even after reporting, malicious links may still be active, or your credentials could already be compromised.
- What to do next:
- Change passwords for any accounts that may have been exposed.
- Run a malware scan on your device.
- Monitor accounts for suspicious activity (e.g., unauthorised logins).
- UK Example: In 2025, a UK university employee reported a phishing email but did not reset their password. Attackers used the stolen credentials to access student records a week later (Jisc, 2026).
“Reporting a phishing email is like calling the police after a burglary; you still need to check if anything was stolen and secure your home.”
❌ Myth 10: “Cybersecurity training is a one-time thing.”
✅ Fact: Cyber threats evolve rapidly, so training must be continuous.
- Why it’s wrong: New phishing tactics emerge daily (e.g., AI deepfakes, zero-click attacks). Annual training is not enough.
- UK Example: A 2025 study found that UK employees who received quarterly phishing simulations were 50% less likely to click on malicious links than those trained annually (KnowBe4, 2026).
- Best Practice: Monthly phishing tests + real-time feedback (e.g., NCSC’s Cyber Aware resources).
“Cybersecurity training isn’t a tick-box exercise. It’s an ongoing process to keep pace with attackers.”
🔍 How to Test Your Knowledge: Quick Quiz
Answer True or False to these statements:
- “If an email looks professional, it’s probably safe.” (False – AI makes phishing emails look legitimate.)
- “Antivirus software can block all phishing attacks.” (False – Phishing often relies on social engineering, not malware.)
- “SMEs are less likely to be targeted than large corporations.” (False – SMEs are targeted more due to weaker defences.)
- “MFA makes my accounts 100% secure.” (False – Attackers can bypass MFA in some cases.)
- “Phishing only happens via email.” (False – It also happens via SMS, calls, social media, and in person.)
How did you do?
- 5/5 correct? 🎉 You’re a phishing-proof pro!
- 3-4 correct? 👍 Good start—brush up on the myths you missed.
- 0-2 correct? ⚠️ Time to revisit this myth-buster!
🛡️ Actionable Takeaways: What You Can Do Today
For Individuals:
✅ Assume every unexpected message is a scam until proven otherwise.
✅ Enable MFA on all accounts (use app-based or hardware tokens, not SMS).
✅ Report phishing emails to [email protected] (NCSC’s Suspicious Email Reporting Service).
✅ Check if your data has been leaked on Have I Been Pwned.
✅ Educate family and friends, especially vulnerable groups (e.g., elderly relatives, students).
For Businesses:
✅ Conduct monthly phishing simulations (use tools like KnowBe4, Proofpoint, or NCSC’s free resources).
✅ Enforce MFA + Zero Trust across all systems.
✅ Train employees on the latest threats (e.g., AI deepfakes, vishing, USB drops).
✅ Monitor for insider threats (e.g., unusual login activity, data exfiltration).
✅ Report breaches to the ICO within 72 hours (UK GDPR requirement).
For Policymakers & Educators:
✅ Integrate cybersecurity into school curriculums (e.g., NCSC’s CyberFirst programme).
✅ Fund free cybersecurity training for SMEs and charities.
✅ Strengthen penalties for cybercriminals (e.g., longer sentences for phishing-related fraud).
✅ Promote public awareness campaigns (e.g., NCSC’s Cyber Aware).