If you ask a security team which colleagues concern them most, they probably won’t mention the 23-year-old who rebuilt the reporting dashboard in just one afternoon.

In most organizations, the youngest employees are seen as safe online. They grew up using smartphones and turned on multi-factor authentication on their own.

But attackers don’t see them that way.

A Yubico survey of 18,000 working adults in nine countries found that 62% of Gen Z said they fell for a phishing message in the past year, compared to 44% of all workers.

We confused being tech-savvy with being safe online, and attackers picked up on this before we did.

 

The lure is opportunity

It’s rarely a fake invoice that tricks them. More often, it’s a polished LinkedIn message about a well-paid freelance project “matched to your profile,” arriving just when every opportunity feels too important to pass up.

These messages look nothing like the phishing emails shown in the day-one compliance training.

When asked why they fell for these scams, Gen Z respondents most often said they were in a rush. The next most common reason was that the messages offered something valuable, like a job or a prize.

Consider the world this generation is entering.

Entry-level jobs are harder to get, rent takes up more of every paycheck, and many young people have to live with their parents well into their twenties. For them, an offer of better pay or extra income feels real, and scammers know exactly how to target that.

The FTC’s numbers show how effective these scams are: US losses to job scams jumped from $90 million in 2020 to $501 million in 2024. People in their twenties report losing money to fraud more often than those over 70.

The fluency and security dilemma

None of this means Gen Z lacks skill. Seven out of ten Gen Z respondents use multi-factor authentication on their personal accounts, which is the highest rate among all generations surveyed.

When shown a phishing attempt, Gen Z recognized it just as often as other generations, with all groups scoring between 45% and 47%. The difference is in what they’re exposed to and the kind of bait used.

Growing up online makes people confident, but not necessarily skeptical.

Constant notifications teach people to respond quickly instead of pausing to think. That speed is a skill, and early in a career, it’s expected, reply fast, say yes, and try to impress. Attackers know this and time their messages accordingly.

The more connected you are, the more ways attackers can reach you. Gen Z often gets targeted through social media messages, QR codes, and email.

Only 30% of Gen Z use only work-approved devices. This means a scam that starts in a personal inbox can end up inside the company’s network.

 

Closing the gap

Most awareness programs already teach about the threats every organization faces, like fake messages from the CEO, urgent invoices, or bogus IT resets.

Those lessons are still important. The next step is to cover the scams that target new employees and make sure young hires get full onboarding, no matter how comfortable they are with technology.

Their tech skills are a great starting point. Training should focus on the scams young employees really see, like fake recruiters, freelance gigs, prizes, and side-income offers on LinkedIn, WhatsApp, and other social platforms. Use short, mobile-friendly, peer-led formats, and ask young staff to help design them. Also, help everyone keep personal and work accounts separate.

Most importantly, make it safe for someone to say, “I clicked.”

For someone who wants to prove themselves, the fear of seeming incompetent can delay reporting a mistake long enough for it to become a real problem.

 

The best-defended generation

The people joining your organization today arrive with real skills, sharp instincts, and a strong appetite to do well, and attackers have noticed that appetite.

Security teams have the chance to reach them first, and to be the people a new colleague remembers for having their back. A little focused attention now, built around the lures young employees actually face, can turn the most targeted generation into the best-defended one.

This article was written by Cywareness, a company specializing in cybersecurity awareness.

As part of its mission, Cywareness continues to monitor emerging trends, analyze real-world attacks, and share practical insights to help organizations stay ahead in today’s evolving threat landscape.