Some laugh at the continued success of phishing emails, sometimes even blaming the victim for reading the spam and following the instructions – but blaming the victim is wrong.

For one, if antivirus software and spam filters were properly utilized and applied, there would be significantly less likelihood of dangerous emails reaching people’s business inboxes in the first place – and making that transition is a technological issue, not a people issue.

But it’s also become challenging for us to sift and differentiate spam emails from everything else that comes into our inboxes, particularly when so many emails are related to office administration – and cybercriminals are well aware of this.

According to KnowBe4, a security awareness and phishing training provider, some of the most prevalent subject lines used in phishing emails over the previous year were messages concerning IT software upgrades, HR communications regarding performance, and messages claiming your boss has provided a link to attend a meeting.

Many of us are used to receiving and clicking on emails like this every day as part of our jobs; if you receive an email from your employer about an unexpected meeting, you’re likely to get worried and click through.

Users are often attempting to do the right thing when they get notifications claiming to be about software upgrades and security patches, but instead of helping to safeguard their machines from cyberattacks, they are inadvertently promoting them.

While it is feasible to give phishing training to employees, this program must be successful, and one multiple-choice question per year is not enough. In addition, ‘Gotcha’-style phishing tests, in which bogus phishing emails are meant to be indistinguishable from actual emails received every day, will also fail.

It’s doubtful that phishing attempts will ever be completely eradicated – at least not anytime soon – but there are actions that businesses and people can take to guarantee they’re as safe as possible against them.

To start, if you’re unsure about anything, don’t click on it right away; if the email appears to be from a colleague, use a route other than email to ask them whether they sent it. If you get an email requesting that you take immediate action due to a problem with your account, do not click the link in the email; instead, log in to the account using the official URL; if anything is wrong, it will notify you there.

Furthermore, although not fully foolproof against determined attackers, utilizing multi-factor authentication may go a long way toward preventing the usernames and passwords of both business and personal accounts from being stolen.

Phishing attacks exploit human nature, preying on our hopes and fears, which is why they work. They’re unlikely to go away until we find an alternative to email itself.