UK participants in a cyber behaviour study were the most likely to check messages for signs of phishing and the least likely to report them. The findings are based on a survey of 5,000 people across five countries by CybSafe and the National Cybersecurity Alliance.
Among UK respondents, 68% said they check messages for signs of phishing very often or always. Only 37% said they report phishing with the same regularity, a gap of 31 percentage points between identifying a suspicious message and acting on it.
The survey covered 1,000 people in each of the UK, US, India, Brazil and Singapore. In the other markets, checking rates ranged from 56% to 61%, while reporting rates ranged from 39% to 43%.
In the UK, the data also pointed to a sizeable minority who do not report suspicious messages at all. Some 24% said they rarely or never report phishing, while 10% said they did not know how to report a suspicious message or had never seen a way to do so.
Reporting gap
The results suggest that spotting a scam does not necessarily lead to escalation, even in a market where other cyber habits appear relatively strong. That matters because unreported phishing attempts can still reach other users and systems.
Dr Jason Nurse, Director of Science and Research at CybSafe and Reader in Cyber Security at the University of Kent, said the pattern stood out in the UK data.
"The striking finding is the gap between checking and reporting. One good security habit does not tell us whether someone takes the next step. We need to measure behaviours directly, understand what gets in the way and test whether the support people receive makes a difference," said Dr Nurse.
The study also examined other security behaviours and found the UK performed relatively well on several measures. British respondents had the lowest use of personal information such as pet names or birthdays in passwords, at 31%, compared with 38% in the US and 50% in India.
Regular use of multi-factor authentication in the UK stood at 59%, the highest among the five markets surveyed. UK respondents were also the most likely to say they regularly install software updates, at 62%.
Those stronger habits sat alongside notable gaps in awareness and support. Despite the high rate of regular multi-factor authentication use, 19% of UK respondents said they had never heard of MFA.
Training shortfall
Access to cyber security training emerged as another weak point in the UK sample. Some 57% of respondents said they had no access to cyber security training at all, a figure exceeded only by Brazil at 64%.
That mismatch between relatively good day-to-day habits and limited formal training may help explain why some users detect suspicious activity but do not report it. The data does not identify the precise reasons, but it indicates that awareness of risk is not the same as knowing what action to take.
Oz Alashe, Chief Executive Officer of CybSafe, said organisations needed to remove practical barriers to reporting.
"The UK data shows people are already doing some of the right things. Organisations need to make it easier for them to take the next step. That means clear reporting routes, support when people need it and feedback that shows why reporting matters. Success is whether that support changes behaviour and reduces risk," said Alashe.
The survey also highlighted the growing role of scams that use fabricated audio or video. In the UK sample, 22% of respondents said they had received a deepfake scam call or video call.
Among those who had encountered that type of attack, 36% said they had lost money or data as a result. The figures point to the cost of scams convincing enough to prompt immediate action.
AI and scams
The National Cybersecurity Alliance linked the findings to broader changes in how people use digital tools at work and in daily life. It said the spread of AI tools and the volume of scams were shaping the environment in which individuals make security decisions.
"We're at a critical moment. AI is now part of how most people work, yet a large portion of workers are using it without their employer's knowledge or guidance on what's safe to share. At the same time scams are prominent, half of adults globally have already been victimized," said Lisa Plaggemier, Executive Director of the National Cybersecurity Alliance.
"The ability to spot a scam is a great first step, but cybercriminals count on us stopping there. This Cybersecurity Awareness Month, we want to turn awareness into action - report that suspicious message, ask your employer about AI policies, and make secure habits part of your everyday routine," said Plaggemier.