Clicking on phishing emails tops the list of unsafe behavior.