Here is something to consider during your next security awareness training

Top-Clicked Phishing Email Subjects for Q3 2018 

Holiday (Active scam/Phishing) Season - Time for Awareness re-training. Here is another useful article from Europol that you could use

TIPS

• Your bank  (or most organizations for that matter) will never ask you for sensitive information such as your online account credentials over the phone or email.
• If an offer sounds too good to be true, it’s almost always a scam.
• Check your online accounts regularly.
• Check your bank account regularly and report any suspicious activity to your bank.
• Perform online payments only on secure websites (check the URL bar for the padlock and https) and using secure connections (choose a mobile network instead of public Wi-Fi).
• Keep your personal information safe and secure.
• Be very careful about how much personal information you share on social network sites. Fraudsters can use your information and pictures to create a fake identity or to target you with a scam.
• If you think that you have provided your account details to a scammer, contact your bank immediately.
• Always report any suspected fraud attempt to the police, even if you did not fall victim to the scam.

https://www.europol.europa.eu/activities-services/public-awareness-and-prevention-guides/take-control-of-your-digital-life-don’t-be-victim-of-cyber-scams

Did you know: 60 percent of the business email compromise (BEC) attack are hard to detect because they don’t involve a malicious link.

• They are intended to start a conversation with the recipient — and eventually persuade the target to authorize a wire transfer or send sensitive information.
• 46.9 percent of attacks tried to initiate a wire transfer, while 40.1 percent pushed victims to click on a malicious link
• (Big surprise) Almost half of the impersonated roles and more than half of targets are not of ‘sensitive’ positions. 

https://threatpost.com/threatlist-60-of-bec-attacks-fly-under-the-radar/137156/

Is your "Security Awareness" Program going well? if not , may be you should read this.

6 Reasons Security Awareness Programs Go Wrong

1. Security Pros Get Too Technical with Top Management

2. Companies Don't Spend Enough Time Training Execs With Financial Responsibilities

3. Managers Across the Business Aren't Encouraged to Participate

4. Companies Don't Recruit Natural Leaders

5. Companies Don’t Sell the Personal Benefits of Security Awareness Programs

6. Companies Don't Plan Properly or Test Thoroughly Enough

https://www.darkreading.com/threat-intelligence/6-reasons-security-awareness-programs-go-wrong/d/d-id/1332644