The phishing reporting gap and why awareness training isn’t the fix

Has your phishing reporting flatlined? Before you book another “spot the phish” session, read this.

When phishing reports dry up, the usual verdict is that people don't care (or they don't notice, or can't be bothered).

The new Oh, Behave! 2026/27 data says something more interesting. People report things all the time, just not the things you need them to.

When it's personal, people report…

This year we surveyed 5,000 adults across the UK, US, India, Brazil and Singapore. Of the cybercrime incidents in the study, 89% were reported to at least one channel, usually a bank or card company.

Hardly the behaviour of people who can't be bothered.

And it's not hard to see why it works – your card gets cloned, the number to call is on the back, the reason to call is obvious and the problem is unmistakably yours. Nobody needs a training module to report that.

…When it’s a suspicious message, they don’t

Suspicious messages are a completely different story. Across the five countries, only 41% of people regularly report suspicious messages, yet 61% regularly check them for warning signs.

Read that again: more people are checking than reporting. So the hard part (actually noticing something is off) is already happening. Then the message gets deleted, ignored, or shown to the person at the next desk and forgotten about.

The breakdown happens between spotting and reporting, so what would close that gap? When asked what would make them start, people who don't regularly report said they would if:

• It helped stop cybercriminals (65%)
• They understood how to report them (60%)
• They trusted the process (58%)
• Something would actually happen when they reported (57%)

Most of these are design choices. Which is good news, because you can change a design choice this quarter. Changing how people feel about security? That’s a much longer project.

The UK: strong habits, low phishing reporting

The UK numbers prove the point for us. The UK has the lowest regular reporting rate of the five countries (37%) and the highest share of people who rarely or never report (24%).

And yet the UK leads on MFA (59%) and safe passwords.

These are not careless people – they've done the fiddly, unglamorous stuff. But turning on MFA is one clear action with an obvious payoff. Reporting asks for a judgement call every single time, through a route people don't often use, with no visible result.

Same people, different design, different outcome.

More training won't close this gap

Here's the bit awareness leads tend to find uncomfortable (we did too).

Of the people who completed security training, 88% found it useful. But most key behaviours weren't adopted by the majority of attendees.

Because liking training and changing what you do are two oh-so-different things. If reporting is low, another phishing module may land well and change very little, because spotting isn't the bottleneck – most people are already checking.

What to tell your CISO about click rate

This is the conversation worth having upwards.

Click rate measures how convincing your simulation was. Change the template and the number moves. But it will never reach zero, and chasing it there is a good way to burn goodwill.

Reporting rate measures whether your organisation can turn what people notice into something the security team can actually act on. One early report of a real campaign gives the team time to pull the message from every inbox before anyone else opens it.

The two are related but not the same. Someone who clicks and then reports straight away has done one of the most useful things they can do. (Yes, really.)

If you need it in one line: we can't stop every click, but we can make sure that when something gets through, we hear about it fast.

Worth putting on the dashboard alongside (or instead of) click rate:

• Reporting rate on simulations and on real suspicious messages.
• Time to first report when a campaign lands.
• Never-report rate: the share of people who haven't reported anything in a set period.
• Click-then-report rate: how often people who click still raise the alarm.

Four changes that make reporting worth doing

1. Steal what makes bank reporting work. People report to their bank because something happens next. At work, a report usually meets silence. Set up an automatic acknowledgement for every report, and a short, regular round-up of what reports caught. If something was real, say so. That one change does more for reporting than any poster.

2. Make “not sure” a reason to report. Say it plainly: a false alarm is a good report, so count them and celebrate them. That removes the worry about wasting someone's time and will reassure the 58% of non-reporters who would report if they trusted the process.

3. Make click-then-report the report you celebrate most. Never penalise someone for reporting after clicking. That report buys the team the most time of any, so treat it that way …in public.

4. Find the people who never report and ask them why. The never-report group is where the biggest gain is hiding. The reason is usually specific and fixable, but you won't find it by sending them a module.

Make reporting at work feel like reporting to the bank

People already report when the channel is clear, the reason is obvious and something happens as a result. Your job is to make reporting at work feel like that.

‍

That's a much smaller job than changing how people feel about security. And it gives you a number your CISO can actually trust.

Read the full Oh, Behave! 2026/27 report for the complete findings on reporting, training and security behaviour across all five countries.

‍