Dutch People Open the Door Online for Criminals: 3/4 of Users Do Not Enable Two-Step Verification for Email

Recent research by the Dutch government shows that people do not see the necessity of double securing their email. 4 in 10 (38%) believe their email is not interesting to criminals, and only a quarter (25%) enable two-step verification for email. Access to a mailbox is attractive to criminals because they can log in under your name to online services and commit identity fraud. The government wants to raise awareness among all Dutch citizens about the importance of double securing their email and encourages them to set up a double lock.

Password Provides Insufficient Protection

Half of users (51%) assume their password is enough to secure their email. However, due to data theft passwords increasingly end up in the wrong hands.

Koen Sandbrink, strategic cybercrime advisor at the National Cyber Security Centre (NCSC): “In over 3/4 of all online crimes, a stolen password is misused. Setting up two-step verification, or a double lock, offers protection against this misuse.”

Almost half of users (48%) think their email contains little important information; among users aged 65+, this is even 61%;
1 in 3 users (32%) think criminals cannot do much with access to their private email. Among users aged 65+, this is significantly higher (43%);
Users aged 65+ secure their private email with two-step verification much less often (12%) than users younger than 65 (28%).

Access to Email is Gold for Criminals

Many Dutch people underestimate what a criminal can do with access to their email. The majority of users (61%) do not know that a criminal with access to a personal mailbox can log in to linked online services. Many users (49%) are also unaware that a criminal can change passwords of accounts linked to those services. This allows criminals to place orders, causing financial damage. Furthermore, a criminal can steal sensitive personal information, commit identity fraud, or attempt to blackmail you or others. Two-step verification offers protection against this.

Double Secured is Twice as Safe

With the multi-year campaign ‘Double Secured is Twice as Safe’, the Dutch government emphasizes the importance of setting up two-step verification, also called ‘Two-Factor Authentication’ or 2FA. 2FA means that after entering a username and password, you must confirm your identity in another way. This can be done by entering a security code received via SMS or an authenticator app. Want to know how to better protect yourself with 2FA? Visit Veiliginternetten.nl.

About the Research

The study Use of 2FA in the Netherlands was conducted in October 2025 by Motivaction on behalf of the Dutch government. The representative sample consists of 1,048 respondents aged 18 and older and 822 respondents aged 65 and older.

Of respondents aged 18 and older in this study, 81% used email in the past year; among respondents aged 65 and older, this is 73%. This group is referred to in this news report as ‘(email) users’.

Saturday, November 15: Two-Step Day with Barbara de Loo

At the Kaapse Bossen in Doorn, the presenter of Nederland in Beweging, Barbara de Loor, encourages people this Saturday to literally and figuratively take steps toward online safety. On behalf of the Dutch government, a team will be present to help set up a double lock on email. The walking day starts at 11:00 AM and lasts about 1 hour.

Interested parties are welcome from 10:00 AM at Het Wapen van Sandenburg in Doorn. Teams will also be present this Saturday at the Amsterdam Water Supply Dunes in Vogelenzang and the Sallandse Heuvelrug in Holten to explain the importance of two-step verification and provide practical help in setting it up.