Australian football fans share passwords, survey finds

ExpressVPN has published survey findings showing that 17% of Australian football fans have shared passwords so someone else could watch sport. Among those Australian sharers, 36.9% also used the same password on another account.

The survey covered 6,000 football fans across Australia, the US, the UK, France, Germany and Spain, with 1,000 respondents in each market. Australia recorded the lowest rate of password sharing among the six countries, behind the US at 18.6% and Spain at 23.7%.

Even so, the data points to broader account security risks linked to password reuse. Across all six countries, about 44% of people who had shared a password said they also used it on another account, such as email, online shopping or banking.

Australia also stood out in another part of the survey. Only 11.2% of Australian fans said they had used football-related information in a password, well below the 25% or more recorded in the other markets surveyed.

That contrasts with the broader pattern of password reuse. About two-thirds of Australian respondents reused a password or a close variation on at least one other account, despite the country posting the lowest overall figure among the six markets.

Age divide

Younger fans were far more likely than older ones to share access. In Australia, 26.9% of respondents aged 18 to 29 said they had shared a password, compared with 3.4% of those in the oldest age group covered by the survey.

Similar gaps appeared in other countries. In the US, 34.9% of younger fans said they had shared a password, compared with 2.2% of older respondents. In the UK, the figures were 35.6% and 2.1% respectively.

The findings suggest password sharing tends to cluster among younger users, who manage more of their viewing, ticketing and online sports activity through connected services. The survey also found signs that sharing and reuse can overlap within these groups.

Global comparison

The cross-market results showed that no country led on every risky behaviour. Spain had the highest rate of password sharing, but its sharers were the least likely to use the same password elsewhere, at 34.8%.

The US showed a different pattern. While a smaller share of American fans said they had shared passwords, 65% of those sharers said they also used the same password on another account, the highest figure in the group.

France recorded the highest overall level of password reuse at 73.7%, though most countries clustered closely together. Australia remained the lowest on that measure, but still had roughly two-thirds of respondents reusing a password or variation elsewhere.

Security concern

The report linked password reuse to the risk of credential stuffing, where attackers test login details exposed in one breach across multiple services. Email accounts were identified as a particular concern because they are often used to reset access to other services.

"Password reuse is what allows one exposed credential to become a wider account-security problem. Attackers can automatically test credentials leaked from one service against others, and email is especially valuable because it's often used to reset access elsewhere. Sharing passwords increases the number of people and devices that may hold that password; in doing so, users are putting their security into the hands of others. Multi-factor authentication doesn't undo reuse, but it can prevent a stolen password from being enough on its own," said Aaron Engel, Chief Information Security Officer at ExpressVPN.

The survey also asked respondents about football-themed passwords, including team names, player names, shirt numbers and memorable years. Across all six countries, nearly one in four fans said they had used football-related information in a password.

Among those who had done so, 56.8% said someone who knew their football interests could guess one of their passwords either very easily or somewhat easily. In Australia, that figure was 63% among respondents who said they had used football-related details in a password.

The research was conducted in May through online market research provider Pollfish and targeted people who follow football or soccer closely or casually. It found that the combination of sharing, reuse and predictable password choices can widen exposure beyond a single streaming or sports account.

One related piece of research cited by the company involved a public database containing details linked to 22,000 football fans associated with a major football club.