We all worry about cybercrime. So why are we still missing the warning signs?

That comment came from a regional Victorian who participated in auDA's latest Digital Lives of Australians research. It captures something many Australians recognise. We know cyber security matters, but many of us feel ill equipped to protect ourselves online.

The latest auDA Digital Lives report - the sixth study conducted since 2021 - shows 83 per cent of consumers could not imagine life without the internet, while 68 per cent of workers say they could not do their job without it. We use the internet to bank, shop, work, study, access services, and stay socially connected with family, friends and our communities.

But as our reliance on the internet grows, so does our exposure to online threats.

This year's research reveals a gap between confidence and capability when it comes to detecting threats online.

At first glance, the findings appear encouraging. Seventy-three per cent of consumers say they are confident spotting an online scam. Yet when participants were shown examples of suspicious emails, many overlooked some of the most common warning signs.

While most recognised an urgent or threatening tone, 42 per cent did not identify suspicious links and 52 per cent did not recognise an incorrect or unofficial email address as suspicious, suggesting what may be a false sense of security.

At the same time, scams are becoming harder to detect. The report found 88 per cent of consumers and 86 per cent of small businesses believe cyber criminals are becoming more sophisticated and that people need to stay up to date with emerging threats.

That concern is well founded. The research shows almost one in five Australians (19 per cent) lost money to an online scam in the past year, whether through financial scams, romance scams or purchases from fake online stores.

Among people who experienced financial loss due to an online scam, 44 per cent did not contact their bank. Only 16 per cent contacted police, 18 per cent reported the incident to cyber.gov.au, and 18 per cent upgraded security settings on their device.

Similarly, only 47 per cent of people who received a notification that their password had been exposed in a data leak changed the affected password.

A participant from regional NSW captured the challenge many Australians face: "I know cyber security serves a pretty important role in my life and privacy, but I have zero clue on how it operates and what is required of me".

Their experience reflects a broader challenge identified in this year's research. Many Australians recognise cyber security risks but remain unsure what actions to take, where to find trusted information, or how to report a cyber security incident. They are looking for clear, practical guidance on where to start.

A similar sentiment is reflected by the Australian small business community in the research, who say time, cost and lack of knowledge are holding them back from implementing stronger online security measures. Only 50 per cent of small businesses report using multifactor authentication where available. Nearly one-third are not confident knowing where to report a data breach.

Building stronger cyber habits starts with a handful of practical actions that can significantly reduce risk.

The good news for Australians is, while it can take time to establish cyber security processes, reducing cyber risk can start with simple steps. Using multifactor authentication, creating strong and unique passwords for each online service, keeping software up to date, checking website and email addresses carefully, and pausing before clicking unexpected links can all help reduce the likelihood of becoming a victim of cybercrime.

Australians looking for practical guidance can access free advice through cyber.gov.au, which also provides information on reporting cyber incidents. For small businesses and website owners, auDA's Five Ps of website security sets out practical steps to strengthen online security.

But responsibility should not rest solely with individuals. Building cyber confidence and capability across the community must remain a national priority.

For policymakers, industry, online service providers and the education sector, that means continuing to invest in public education, trusted advice and simple pathways for reporting and responding to cyber incidents. It also means making security easier and more accessible for the people using digital products and services every day.

Just as modern vehicles include safety features as standard, digital products should be designed with security built in from the start. Secure by Design principles embed security into digital products from the beginning, rather than treating it as an optional add-on. The more security is integrated, the better equipped individuals and small businesses will be to withstand cyber risks.

Australia's scam prevention efforts are making important progress. Technology solutions and regulatory activity coupled with initiatives to build confidence and capability across the community should be core parts of Australia's overall approach to scam prevention.

While Australians do not need to be experts in cyber security, every Australian deserves to feel trust and confidence in our online environment.