When it comes to reporting security incidents, most people do a quick calculation: what will this cost me, and what will it achieve? If the answer looks poor, they stay silent. This applies to employees within organisations just as much as to citizens dealing with the police. And, as I have to admit, it applies to me as well.
Praise for a Student Who Did More Than I Did
In November 2025, I spoke to students at Hochschule Fresenius, a private university in Munich. One student described how she had been cheated out of a few hundred euros on an online classifieds platform. Afterwards, she had gone to the police.
I praised her explicitly for that, because many victims do not. I am one of them.
Two Close Calls, Two Reports Never Filed
The first case was a fake email in my name asking my accountant for 5,000 euros. Fortunately, she spotted the fraud in time. I describe the case in detail in my article on CEO fraud.
The second attempt arrived by post. It was a letter, supposedly from apoBank, a German bank for healthcare professionals, featuring a QR code. The bank has been warning its customers about exactly this kind of letter for months.
I reported neither case.
In Bavaria, where I live, online police reports are only possible for a handful of offences, such as fraud in online auctions, a stolen bicycle or a scratch on a car. An attempted fraud in my name is not among them. So I would have had to go to the police station, wait there and file the report in person. And that despite the fact that no damage had occurred and the perpetrators were probably sitting somewhere abroad. I briefly weighed up what the trip would cost me. Then I stayed in the office.
That was reasonable. And that is precisely the problem.
A fake letter sent by scammers on behalf of ApoBank. Photo: AI-generated recreation based on the original document.
The Calculation From the Other Side
Let us look at my decision from the opposite direction. Because I did not report it, the case appears in no statistics. Germany’s Federal Criminal Police Office, the BKA, itself describes the number of unreported cybercrime cases as very high, and earlier studies on unreported crime found a reporting rate of around ten percent.
If nine out of ten cases are missing, however, policymakers plan staffing for only the tenth. As a result, the police cannot follow up on many cases at all. At the police station, the student was told there was unfortunately nothing they could do. And the next victim then wonders why they should bother going at all.
I helped keep that cycle turning myself. Twice.
Reporting Security Incidents at Work: The Same Calculation
Now simply replace the police station with the IT department.
An employee clicks on a link, realises the mistake two seconds later and closes the window. Nothing happened, or so he believes. Reporting it, on the other hand, would mean a ticket, follow-up questions and perhaps a pointed remark at the next team meeting. On top of that comes a feeling I know from many people affected: “I feel so stupid.”
So he reports nothing. Your security picture looks clean as a result, at least until someone does eventually notice.
When did someone in your organisation last come forward and say: “I almost fell for it”? If no case comes to mind, that by no means proves there was none.
Not Every Trifle Is a Case
To avoid any false impression: not every spam email belongs with the police, and not every misclick belongs in a crisis meeting. Anyone who reports every trifle creates noise, and the real case gets lost in that noise. What matters, rather, are the cases where it was close.
In my case, it was close twice.
Four Ways to Get Employees Reporting Security Incidents
The goal is simple: reporting must be cheaper than staying silent.
- Time it. How long does it take in your organisation to report a suspected incident? Try it yourself. If it takes longer than deleting the email, you already know your reporting rate.
- One channel, one minute. An address, a number or a button is enough. A form with twelve mandatory fields, by contrast, prevents reports.
- The first response is a thank you. Do not start by asking how this could have happened.
- Share your own near miss first. As soon as the boss starts, the others will share theirs too.
So at your next meeting, do not ask whether there were any incidents. Instead, ask who almost fell for something.
And then thank the person who raises their hand.
Dr. Nikolai A. Behr CSP® ist Keynote Speaker, Kommunikationsexperte und Medientrainer für Führung, Vertrauen und empathische Kommunikation in Zeiten von Wandel und KI.