Google Study Finds Most Malaysian Internet Users Have Poor Password Habits

More than 90% of Malaysian internet users surveyed for a new study on digital responsibility admit to bad online habits such as sharing passwords, reusing them and choosing ones that are easy to guess. That is despite 57%, almost three in five, having suffered a personal data breach themselves or knowing someone who has.

Google commissioned the research, which market research firm YouGov carried out in September to highlight what poor password health leads to. It surveyed more than 13,000 adults aged 18 and over in 11 Asia Pacific markets: Hong Kong, Japan, Korea, India, Indonesia, Malaysia, the Philippines, Singapore, Taiwan, Thailand and Vietnam.

The study urges people to drop bad digital habits, particularly with fourth-quarter ecommerce sales forecast to rise by 20%, a peak season for fraud.

Reused and guessable passwords

COVID-19 drove a large jump in ecommerce. Online activity rose so sharply that the typical internet user now has 25% more passwords than before the pandemic, around 80 in total, which is a lot to remember.

In that context, the study found that 80% of Malaysian respondents use the same password on more than one site, and 45% admitted reusing a password on as many as 10 different sites. Of those who reuse passwords, 40% said they did so because they feared forgetting new ones, and 41% because it is simply easier.

Just over half (51%) of local respondents said they use guessable passwords, drawing on some of the easiest combinations to crack, such as important dates, partners' names, pets' names and even postcodes. A quarter keep their passwords in their phone's Notes app, which in most cases is not encrypted by default. The consequences show up in the numbers: people who reuse passwords are almost twice as likely to have financial data stolen online (13% against 7%).

Passwords passed around

Breaches often happen wherever data is shared, and respondents share a great deal. Nearly three in five (57%) are happy to give passwords to friends or family. The same people also share passwords for streaming platforms, food delivery services and ecommerce shopping sites, while only 7% use a password manager.

When buying online, 60% admit to paying on pages that do not show the secure symbol, an easy opening for fraudsters to steal their details. In addition, 70% of those who store financial information online also share passwords with friends and family, which raises their risk of a breach when those passwords are used across several devices. Taken together, these habits may explain why 57% of Malaysian respondents have been through a breach or know someone who has.

Chuah Jia Wen, Industry Head of CPG and Retail at Google Malaysia, said earlier research shows that people whose data has been exposed in a breach are 10 times more likely to have their accounts hijacked. Sharing, reusing and choosing guessable passwords, she said, puts personal information, payment data included, at exponentially greater risk.

Signs of better habits ahead

The findings also show that many respondents want to behave more responsibly online. Some 64% said they would probably adopt two-factor authentication (2FA) even where it is optional. Four in five said they would change their password straight away if faced with a possible breach. Among those who would not, 33% are thought to be holding back out of caution, suspecting that the breach notice itself might be a scam. And while only 7% use a password manager today, 40% said they were likely to start.

According to Chuah, the results show that Malaysian internet users want to manage their digital health better. The difficulty is the gap between knowing and doing, and closing it depends on tools that offer security and convenience together. She said Google concentrates on easy-to-use tools that help people take control of their safety online, and urged everyone to make full use of them, especially over the year-end season when protecting against holiday hacking matters most.

Google's three tips

With cybercrime expected to rise alongside year-end shopping, Google recommends three steps using freely available tools.

Build stronger passwords. Reusing a password is like using one key for a home, a car and an office: if someone obtains it, everything is exposed. Weak passwords carry the same risk. Giving each account its own strong password reduces it. Each should be hard to guess and preferably at least eight characters long, and a password manager can generate strong passwords, keep them safe and track them all. Password Checkup in Google's Password Manager, for example, checks the strength and security of every saved password, flags any that have been compromised, for instance in a third-party breach, and shows where passwords are reused across sites. It also picks out weak passwords that leave accounts exposed and suggests what to do about them.

Switch on two-factor authentication. 2FA, also called 2-Step Verification, greatly reduces the chance of someone getting into an account without permission. Google says its automatic sign-in protections are enough for most users, but 2FA adds another layer of verification. Each sign-in requires a second step beyond the username and password, such as an SMS message, a six-digit code from an app, a prompt on a trusted device or a physical security key.

Run the Google Security Checkup. This step-by-step tool, which takes about two minutes and can be used as often as needed, strengthens the security of a Google Account. It gives personalised recommendations, prompting users to review connected devices, risky third-party sites and apps with access to sensitive information, and their 2FA options. Further tips are available in Google's Safety Center, and the settings and tools mentioned can be found in the Google Account.