• by Ray Schultz , Columnist, July 25, 2022

Email senders struggle year in and year out to find the right subject lines. 

They should search no further. Email security firm KnowBe4 has identified some very effective ones. The trouble is, they’re all phishing scams, and they’re designed to mimic internal company emails. 

Here are the most clicked-on phishing subject lines globally:  

HR: Vacation Policy Update—15% 

HR: Important: Dress Code Changes—15%

Password Check Required Immediately—13%

HR: Your performance evaluation is due—10% 

Weekly Performance Report—9%

LinkedIn: Who’s search for you online—8%

IT: Internet Report—8% 

HR: Please update W4 for file—8% 

Acknowledge Your Appraisal—7% 

Employee Expense Reimbursement for [[email]]—7% 

Now it can be argued that few savvy people would respond to these emails. About the only one that might get this writer is the LinkedIn one—my inclination is to never answer anything from HR.   

But people apparently fall for them, causing untold damage to their companies. They also fall for these common “in the wild” attack lines:  

Google: You were mentioned in a document: “Strategic Plan Draft”

IT: Inventory Form

Microsoft 365: Microsoft 365 has new password requirements 

Amazon: Balance paid on your seller account

Xerox: New document was processed for [[email]] 

Zoom: [[manager_name]] has sent you’re a message via Zoom Message Portal 

Facebook: Your recent Facebook login 

Your fax is pending for preview 

Money has been successfully withdrawn from your bank account

Want to protect yourself at work? Here are the top 5 attack vector types: 

• Link 
• Phishing Hyperlink in the Email  
• Spoofs Domain 
• Appears to Come From the User’s Domain 
• Branded 
• Phishing Test Link Has User’s Organizational Logo and Name 
• PDF Attachment 
• Email Contains a PDF Attachment 
• Credentials Landing Page 
• Phishing Link Direct Users to Data Entry or Login Landing Page 

Here’s the takeaway from all this:  

"We already know that more than 80% of company data breaches globally come from human error," says Stu Sjouwerman, KnowBe4's CEO. "New-school security awareness training your staff is one of the least costly and most effective methods to thwart social engineering attacks.”