Phishing Statistics 2025: Attacks, Costs, AI Scams & Trends

• Record Phishing Volume: Global phishing attacks remained at historic highs in 2025, averaging around 1 million attacks per quarter. Q2 2025 hit 1.13 million incidents up ~13% from Q1 the largest quarterly total observed since 2023. Even a slight dip in Q3 892,494 attacks still kept volumes near peak levels. Overall, phishing has become a persistent background radiation of the digital ecosystem.
• Top Breach Entry Point: Phishing regained the #1 initial attack vector, accounting for roughly 16% of data breaches analyzed in 2025. It eclipsed even stolen credentials in frequency. An estimated 36% of all breaches now start with a phishing email, underscoring phishing’s role as the dominant front door for cyber intrusions.
• High Cost per Incident: A breach that begins with phishing costs organizations about $4.8–4.9 million on average, higher than the global average breach cost. These phishing related breaches take the longest to identify and contain median 254 days, which drives up remediation expenses. In the U.S., where legal and notification costs are steep, the average breach cost hit a record $10.22 million.
• Business Email Compromise BEC Fallout: BEC a specialized, financially motivated form of phishing continues to wreak havoc. The FBI tallied roughly $2.8 billion in reported BEC losses in 2024. Over the last three years 2022–2024 BEC has accumulated ~$8.5 billion in losses in the U.S. alone. The average dollar loss per successful BEC incident in the U.S. now stands around $137,000, an 83% increase since 2019, as attackers push for larger wire transfers. Notably, the average fraudulent wire transfer request nearly doubled from $42k in Q1 2025 to $83k in Q2 2025, indicating criminals are testing higher payout thresholds.
• Ransomware’s Gateway: 54% of ransomware infections in 2025 were traced back to a phishing email as the initial access method. Verizon’s data shows ransomware was present in 44% of breaches in 2025, up sharply from ~32% the year prior. Encouragingly, a record 64% of organizations hit by ransomware now refuse to pay extortion demands up from ~50% two years ago. This resistance drove the median ransom payment down to about $115,000. However, even without paying a ransom, breaches involving data theft/extortion still cost companies on the order of $5 million due to incident response, downtime, and recovery costs.
• AI Powered and Industrialized Phishing: 2025 saw threat actors weaponize AI at scale. Over 80% of phishing emails now contain some AI generated text, eliminating the telltale grammar mistakes of old. Some industry analyses even noted a 1,265% increase in phishing email volume since the advent of generative AI tools. Attackers also leveraged Phishing as a Service PhaaS kits to automate and customize campaigns, contributing to consistently high attack volumes. The use of deepfakes AI generated voices/videos in social engineering spiked e.g. deepfake voice scams rose ~15% in the last year, including a notorious incident where a fake video call of a CFO conned an employee into transferring $25 million.
• Omnichannel Threats Surge: Phishing expanded far beyond email. Roughly 40% of phishing campaigns in 2025 now extended to multiple platforms including SMS text smishing, voice calls vishing, messaging apps, or QR codes to ensnare victims on any reachable channel. QR code phishing quishing exploded in popularity: In a recent six month span, over 1.7 million unique malicious QR codes were detected, with an average of 2.7 million QR phishing emails sent per day. Likewise, vishing attacks skyrocketed reports range from +260% to +440% YOY growth as criminals used cheap AI voice cloning to impersonate executives by phone. Even SMS phishing grew ~19% in 2025, exploiting the relative lack of filtering on mobile devices.
• Targeted Industries: No sector is immune, but Manufacturing, Finance, SaaS/Cloud, and Healthcare were prime targets in 2025. Manufacturing endured the highest volume of email attacks, ~26% of malicious emails in one analysis, largely due to ransomware groups seeking to disrupt supply chains. Financial services and payment processors together saw about 30% of phishing attacks in early 2025, as attackers chased wire fraud and banking credentials. SaaS/Webmail platforms were another top target ~17–18% of phishing in Q1–Q2 since compromising cloud email accounts can unlock a trove of data. In Healthcare, phishing remains a leading cause of breaches and healthcare breaches are the costliest of any industry at ~$7.42M on average, amplifying the damage of successful attacks.
• Regional Highlights: Latin America experienced an unprecedented spike in cyber attacks, with phishing and fraud leading the surge. In Q1 2025, LATAM organizations saw a 108% YoY increase in weekly attacks averaging ~2,640 attacks per week per org. By mid 2025, LATAM was facing 39% more attacks weekly than the global average, reflecting quickly expanding threat activity. In the United States, high value targets and stricter breach disclosure mean phishing attacks are extremely costly, the average U.S. breach cost $10.2M is more than double the global mean. Notably, over half of all phishing sites continue to be hosted on U.S. based infrastructure for the fifth year running. Asia Pacific APAC sees the largest raw volume, over 117 million phishing links were clicked and blocked in APAC in 2025 alone, amid a wave of mobile banking and payment scams. Europe remains heavily targeted as well, for example, 79% of UK businesses that suffered cyber attacks in 2023 cited phishing as the cause. European organizations also face spillover from geopolitical tensions phishing coupled with DDoS by hacktivists targeting government and infrastructure sectors.
• Human Factor & Training Impact: The human element remains the weakest link. An estimated 68–74% of breaches in 2025 involved some human error, stolen credentials, or social engineering. In simulated phishing tests, about 33% of untrained users still click on phishing links. Critically, the median time for a user to click a phishing email is measured in seconds, while the time to report it to IT is measured in minutes, a gap that attackers exploit. On the positive side, organizations that invested in security awareness training saw phishing click rates drop dramatically by ~40% in just 90 days, up to 86% over a year of sustained training and reporting rates improved fourfold, according to industry benchmarks. In short, the data shows that educating users and conducting realistic phishing simulations can reduce phishing risk by more than half, turning users from liabilities into assets in detecting attacks.

Phishing has evolved in 2025 from a scattershot nuisance into a sophisticated, industrialized cyber threat. In simple terms, phishing is the practice of sending fraudulent communications, often emails, but also texts, calls, and more that impersonate trustworthy entities to trick individuals into revealing sensitive information or installing malware. It’s an old tactic but now turbocharged by automation and emerging tech. This year’s statistics reveal that phishing is bigger, faster, and stealthier than ever. Attack volumes remain near all time highs, and attackers have innovated beyond the inbox, using AI crafted lures, deepfake voices, and omnichannel scams to ensnare even savvy users.

Why do these phishing statistics matter in 2025? Because they quantify the risk and provide insight into attacker strategies. For instance, knowing that the APWG recorded over 1 million phishing attacks in Q1 2025 the highest volume since late 2023 signals that organizations cannot let their guard down, phishing is not fading away. Similarly, understanding that the average phishing originated breach costs $4.88M versus $4.44M overall highlights phishing as disproportionately costly and deserving of extra attention. The statistics also expose shifting tactics: the surge in things like QR code abuse and voice phishing tells us where defenses might be lagging. In summary, the numbers paint a clear picture: phishing in 2025 is the #1 initial attack vector for cybercrime and a linchpin for attacks ranging from ransomware to business fraud. Organizations that grasp these trends can better prioritize their security efforts from enhancing email filters and continuous penetration testing to doubling down on user training to blunt the impact of phishing campaigns.

What Are Phishing Statistics?

Phishing statistics refer to quantitative measures of phishing attacks and their outcomes. These can include the volume of phishing emails or sites detected, the success rates e.g. how often people fall for them, the financial impact of phishing driven breaches, and the prevalence of phishing relative to other attack methods. In essence, phishing stats tell us how often these scams occur, how effective they are, and what damage they cause.

• Analogy: Think of phishing statistics as the vital signs of the phishing threat. Just as a doctor checks blood pressure and heart rate to gauge a patient’s health, cybersecurity analysts check phishing rates and losses to gauge the health of our defenses. For example, if the phishing heart rate jumps to, say, 800k to 1 million attacks per quarter, it signals the threat is intensifying and requires a response.
• Practical Example: One key phishing statistic is the share of data breaches that begin with phishing. In 2025, about 16% of all confirmed breaches were triggered by a phishing attack. That means if an organization suffered a breach this year, there’s roughly a one in six chance it started with someone being duped by a fake email or message. By contrast, other entry points like stolen credentials or vulnerability exploits comprised a slightly smaller fraction. This simple stat underscores phishing’s outsized role in cybersecurity incidents and why many companies label phishing as their top security concern.
• Why They Matter: Tracking phishing statistics helps organizations identify trends and allocate resources. For instance, if stats show phishing emails delivering most ransomware, a company might invest more in email filtering, user drills, and incident response playbooks for email borne threats. If metrics indicate an uptick in SMS based phishing, the company might extend anti phishing education to text messages and implement mobile security controls. In short, phishing statistics are a feedback mechanism that quantifies where the human firewall is failing and guides us on how to reinforce it.

In summary, phishing statistics encapsulate the who/what/when/how of phishing attacks in numerical terms. They transform anecdotal fear phishing is bad into concrete data phishing causing X% of breaches, costing $Y million, which is crucial for informed decision making in cybersecurity.

Global Overview of Phishing Trends 2024–2025

To understand phishing’s trajectory, we can compare key metrics between 2024 and 2025. Globally, phishing activity continued to rise in frequency and impact:

The total number of phishing attacks in 2025 is on pace to exceed 4 million globally, based on APWG’s quarterly reports Q1–Q3 combined. Phishing’s role as an initial access vector ticked up to 16%, reclaiming the top spot it held some years ago. Interestingly, IBM’s data shows the overall average cost of a breach actually declined slightly to $4.44M attributed to faster response times with AI, but phishing related breaches bucked that trend with costs pushing almost $4.9M on average. This indicates phishing incidents tend to be harder to contain, leading to more expensive fallout. Meanwhile, the U.S. saw breach costs cross the eight figure mark $10M+, reflecting strict regulations and legal costs. Finally, the integration of phishing with other crimes is evident in business email compromise and ransomware losses are climbing, fed by phishing access in many cases.

Overall, the global trend from 2024 to 2025 is clear: phishing volume and its consequences are escalating. Attackers sent more phishing lures than ever, and those lures more frequently led to major incidents. While some defensive gains like wider AI usage helped trim average breach costs slightly, the costs associated with phishing in particular rose, highlighting that phishing remains an acute risk that outpaces many other threats.

Cost and Impact Breakdown

Phishing attacks carry a steep price tag for organizations not just in money stolen directly, but in the broader costs of breaches, business disruption, and recovery efforts. Here we break down some key financial and operational impact metrics for phishing related incidents:

Phishing has an outsized financial impact. A single successful phish can lead to a multi million dollar breach. Notably, phishing often compromises valid user credentials, which attackers then use to quietly navigate systems for months thus the ~254 day incident lifecycle. The longer a breach goes undetected, the more costly it becomes breaches contained in <200 days cost ~$3.87M, whereas those >200 days cost ~$5.01M. Unfortunately, phishing breaches skew toward the latter category.

Business Email Compromise deserves special mention: unlike malware centric phishing, BEC is all about social engineering and fraudulent payments. The stats show that fewer BEC attempts are being reported and the number of FBI complaints is relatively flat, but the amount per scam has skyrocketed. This implies that BEC actors are focusing on bigger scores, for example, tricking a company into wiring six or seven figures in one go. A single BEC incident can easily cost an SMB or even mid size enterprise hundreds of thousands direct loss, which can be existential.

Ransomware, often enabled by phishing, imposes both direct costs of ransom or data leak payments and indirect costs of forensic investigation, system rebuilds, and downtime. Even though more victims are wisely choosing not to pay ransoms nearly two thirds now refuse, the overall cost of ransomware incidents remains extremely high. Whether or not a ransom is paid, companies face major expenses in recovery often exceeding the ransom demand itself.

In summary, the cost breakdown reinforces that phishing isn’t just an IT annoyance it’s a multi million dollar risk. From the boardroom perspective, investing in prevention email security, training, backups, penetration testing engagements, etc. is justified by the potential to avoid those $4–5 million cleanup bills and fraud losses.

Attack Vector & Delivery Method Distribution

While email remains the primary avenue for phishing, 2025’s threat landscape saw phishing attacks diversifying across multiple vectors. Here’s a breakdown of how phishing lures are delivered:

The lines between these vectors are blurring. Modern phishing campaigns are often multi stage and multi channel. For instance, an attacker might send an email with no link to avoid filters but instruct the target to call a number vishing or open an attached image of a QR code quishing. This trend of omnichannel phishing is one of the standout developments in 2025. The goal is to surround the target with the scam on whatever medium they use, increasing the chances someone will slip up.

Email is still king in sheer volume, it's trivial for attackers to blast out millions of emails, and despite improvements, a small percentage will always get through filters or be clicked by users. However, as companies harden email gateways, attackers responded by shifting to softer targets: personal phones, SMS, voice, and trusted cloud services. Notably, 43% of phishing campaigns in 2025 hid their malicious content on legitimate cloud platforms Google Drive, Dropbox, SharePoint, etc. to piggyback on those domains’ good reputation and evade URL blacklists. This means an email might contain a Google Drive link seemingly benign which then leads to a phishing page, a tricky evasion that requires advanced detection.

In summary, organizations need to defend a broad attack surface when it comes to phishing: not just the corporate inbox, but SMS, voice calls, cloud apps, and even physical world vectors malicious QR codes on a posted flyer. A layered security approach is needed, combining technical controls with user awareness across all these communication methods.

Industry Impact Analysis

Phishing is a universal threat, but some industries are targeted more aggressively often because of the data or money they hold, or their propensity to pay ransoms. Below we analyze how different sectors fared in 2025:

• Manufacturing: In 2025, manufacturing became a prime target of phishing and its follow on attacks especially ransomware. By Q2 2025, the manufacturing sector was receiving about 26% of all malicious emails, more than any other industry. Why the focus? Manufacturing firms have a low tolerance for downtime even a few hours of halted production can cost millions which makes them likely to pay ransoms or quickly meet attacker demands. Phishing emails to manufacturing employees often masquerade as supplier invoices, procurement documents, or even maintenance notifications, seeking to either steal credentials or deploy ransomware. We also see nation state actors phishing manufacturers to steal intellectual property IP designs, blueprints in sectors like semiconductors and aerospace. The convergence of IT and OT operational technology networks means a phish that leads to an IT foothold can bridge into plant controls. Example impact: A single phishing induced ransomware attack in a factory can halt multiple production lines, causing multi million dollar losses per day in addition to the breach costs.
• Financial Services Banking, Insurance, Payments: Banks and financial institutions remain perennial phishing targets due to the direct access to money. In Q2 2025, traditional financial institutions were targeted by ~18.3% of phishing attacks, and if you include fintech and payment processors, the broader finance/payments sector accounted for about 30.9% of phishing in early 2025. Attackers impersonate banks e.g., Your account is locked with emails with fake login pages and payment brands like PayPal or Mastercard. In fact, Mastercard was the top brand abused via QR code phishing in one quarter 14,233 malicious QR phishing detections according to one report. Beyond credential theft, Business Email Compromise BEC falls heavily on this sector cybercriminals trick finance department staff into wiring funds. Nearly 64% of businesses faced a BEC attempt in H1 2025 across sectors and financial staff are on the front lines of these. Financial firms also are targeted by credential stealing phishing that aims to get into brokerage accounts, crypto exchanges, etc., for quick theft. The implication is a dual need: protect customer facing systems from phishing to stop account takeovers and protect internal finance teams from BEC/social engineering. Financial regulators in many countries now demand stringent anti phishing controls due to the systemic risk if banking systems are compromised.
• SaaS and Webmail Providers: Cloud service providers especially those offering email and office suites like Microsoft 365 and Google Workspace are hugely targeted, because one stolen SaaS account can be a master key to an organization. APWG data showed the SaaS/Webmail category was the single most attacked sector in early 2025 17.6% of all phishing attacks. This includes phishing login pages spoofing Microsoft, Google, Zoom, DocuSign, etc. Attackers know that businesses live in these cloud apps: if they can steal an Office 365 password via phishing, they can potentially access emails, SharePoint files, Teams chats, and even single sign-on into other connected apps. A noteworthy trend is OAuth consent phishing tricking users into granting a rogue app access to their cloud data with no password needed. SaaS providers themselves Microsoft in particular also bear the brunt of brand impersonation: Microsoft consistently ranks as the most impersonated brand in phishing globally some reports say 40% of brand phishing was Microsoft related. This sector sees a volume of attacks because it’s the gateway to all others. Once you phish a webmail admin, you could phish everyone in their organization with an internal email blast trust is higher for an email that truly comes from the CEO’s account!.
• Healthcare: Healthcare organizations face fewer phishing emails in absolute terms than sectors like finance or manufacturing, but when phishing succeeds, the impact is dire. Healthcare data breaches often initiated via phishing are the most expensive of any industry, averaging $7.42M in 2025. Hospitals and clinics are hit with phishing lures masquerading as patient information requests, prescription orders, or lab result links exploiting the urgency and trust inherent in healthcare communications. Ransomware actors target healthcare via phishing because lives are literally on the line, a hospital under ransomware pressure might pay quickly to restore systems. We saw multiple instances of hospital IT systems taken down due to an employee falling for a phish, forcing ambulance diversions and delaying patient care. Another aspect is that healthcare staff often have high access privileges and a culture of helping making them potentially more susceptible to social engineering Dr. Smith, please review this patient file immediately. Although healthcare hasn’t been the top target by volume, it has seen major incidents e.g., the 2024 Change Healthcare breach via phishing that disrupted medical claims processing nationwide. The sector is investing in stronger training as a result, but it remains vulnerable due to constrained IT budgets and a vast attack surface of devices and personnel.
• Retail & Wholesale: Retailers and e-commerce firms see extensive phishing, often tied to consumer data theft and fraud. One data point: in a focused study of QR code phishing, the Retail/Wholesale sector had ~148,596 phishing QR code detections in one quarter late 2024, the highest among sectors. Why retail? Attackers go where the money and data are: retail companies process credit cards and personal info at scale. Phishes might impersonate a point of sale provider, a shipping carrier common scam: fake DHL/UPS delivery problems, or internal HR/payroll targeting large workforces with W 2 fraud. Also, retail customers themselves are phished. Your Amazon order is on hold, please log in. Retail companies suffer reputation damage from phishing more than some others, because a successful phishing can lead directly to fraudulent transactions or abuse of loyalty accounts, hitting consumer trust. While retailers have improved at detecting card skimmers and malware, phishing remains a challenge especially with the rise of social media commerce scams and fake customer service pages that phish consumers and employees alike.
• Technology & Social Media: Tech companies and social media platforms are double targets: attackers phish them to compromise their users, and also phish their users to hijack accounts. In 2025, social media credentials Facebook, LinkedIn, Twitter were sought after, one study noted Facebook was targeted by ~44,000 phishing domains over the year. For social media companies, a phishing of an employee could lead to a supply chain breach e.g., an attacker tweeting from a hacked celebrity account, or inserting malware in a software update. More broadly, any tech firm that holds user data email providers, ISPs, etc. is constantly hit with phishing. We also see whaling phishing of high profile execs often via LinkedIn messaging or personalized emails, which intersects with social media. Social media is also exploited as a platform for delivering phishing posting malicious links which tech companies have to police. This industry has to worry about account takeover on a large scale, for example, a successful phishing of a social network admin could result in millions of accounts being compromised in one go via resetting passwords, etc.. Thus, tech firms invest heavily in anti phishing, but remain attractive targets due to the multiplicative effect of a breach.

In summary, every industry is a target, but the tactics and stakes differ. Financial orgs worry about direct theft, wire fraud, manufacturing about ransomware downtime, healthcare about life and death service impact, and tech about platform abuse. Phishers often customize lures per industry e.g., a phishing email to a finance firm might impersonate the SEC or a big client, whereas one to a manufacturer might impersonate a parts supplier or even a CEO with an urgent request. Understanding these nuances helps companies tailor their defenses. All sectors, however, share one reality: the human element is common across them, meaning a well crafted phishing email can slip past technology and fool an employee anywhere, from a bank teller to an IT administrator. Hence, cross industry, the focus is increasingly on reinforcing that human layer of defense.

Regional Breakdown

Phishing is a global problem, but its prevalence and characteristics vary by region. Here’s a snapshot of regional phishing trends and notable points in 2025:

• North America US & Canada: The United States remains ground zero for many phishing operations both as target and source. American organizations are heavily targeted because of their wealth and propensity to pay, the U.S. sees the highest average breach costs $10M+ and high BEC losses. Notably, phishing is implicated in a large portion of U.S. breaches, a recent UK study even found 60% of successful ransomware attacks originate with a phishing email, a stat likely similar in the U.S. Law enforcement crackdowns like FBI takedowns of botnets temporarily disrupted some phishing in 2024, but by 2025 attackers are tooled and come back strong. The U.S. is also the largest host of phishing sites, over half of phishing sites globally are on U.S. based servers or cloud services, partly due to the abundance of cheap hosting and compromised infrastructure. Meanwhile, the volume of spam and phishing emanating from the U.S. is disproportionate, one analysis suggested up to 60% of global spam traffic originates from the U.S., often via hijacked email servers. Canada sees similar phishing patterns on a smaller scale, with additional lures related to healthcare as Canada has centralized health systems and government services CRA tax refund scams are common phishing themes in Canada. North America also has strict breach disclosure laws, so phishing related breaches tend to come to light more often, keeping the pressure on businesses to bolster defenses like adopting continuous penetration testing services for proactive security.
• Europe: European countries face a mature but highly targeted threat landscape. Phishing is the top attack vector reported by businesses in Europe, for instance, 79% of UK businesses that had a cyber incident in 2023 identified phishing as the cause. The regulatory environment GDPR means any breach phishing induced or otherwise can lead to heavy fines, so European firms are very focused on prevention. A few regional trends: In the UK, there’s been a surge in phishing that ties into fraud calls e.g., phishing emails that prompt victims to call a fraud department number leading to vishing. In Germany and France, we’ve seen waves of phishing tied to banking Trojans like Emotet/Trickbot in previous years, and in 2025 some of these will be revived with new AI crafted lures in the local language. Eastern Europe e.g., Poland, Ukraine faces unique phishing attacks often related to the war in Ukraine phishers and allied hacktivists send phishing emails posing as charitable organizations or government agencies to siphon funds or gather intelligence, sometimes as part of the broader conflict’s cyber front. ENISA’s threat landscape reports noted a convergence of phishing and DDoS by activist groups targeting European public institutions. Europe also saw high targeting of payment processors and online services, in some quarters, payment/banking made up ~30% of phish as per APWG data since the region has many fintech users. Language diversity in Europe means attackers are increasingly using AI translation to craft phishing emails in flawless French, German, Spanish, etc., removing a barrier that previously tipped off some recipients.
• Asia Pacific APAC: APAC is notable for the sheer volume of phishing and the focus on consumer/mobile targets. According to Kaspersky, over 117 million phishing links were clicked and blocked in APAC in 2025, a staggering number. Countries like India, China, and Southeast Asia see daily onslaughts of SMS and WhatsApp phishing given the popularity of mobile payments and super apps. For example, there have been widespread SMS phishing campaigns in India claiming to be from banking portals or the income tax department. In East Asia, attackers often impersonate delivery companies or e-commerce platforms since online shopping is huge. APAC also has a high adoption of cryptocurrencies and fintech apps. We see phishing targeting crypto exchange logins and one time passwords in countries like Singapore and Japan. One interesting stat: a study found APAC consumers are especially targeted by banking related phishing not only via email, but through fake banking apps and SMS, because many APAC economies leapfrogged to mobile banking making mobile the prime phishing vector. APAC organizations saw a 13% increase in cyber attacks on average in 2025, with phishing as a common entry, which is a bit above the global average increase. Additionally, state sponsored phishing APT is significant in APAC e.g., Chinese speaking APT groups conducting spear phishing against targets in Taiwan, Hong Kong, Australia etc., often tied to espionage. So, in APAC the range spans from mass consumer phish to very targeted nation state phishing, making it a region with broad threat diversity.
• Latin America LATAM: Latin America emerged as a hotspot of growth in cyber attacks in 2025. While historically LATAM lagged in digitization, recent rapid adoption of digital services has unfortunately outpaced security investments, creating ripe opportunities for phishers. Check Point noted a jaw dropping 108% YoY increase in cyber attacks in LATAM in Q1 2025 the highest surge globally. By mid year, LATAM companies were enduring 2,700+ attacks per week, which was ~39% higher than the global average. Phishing and credential theft are rampant, often leading to bank fraud. Brazil, Mexico, and Colombia report heavy phishing targeting their banking customers, for example, Portuguese language phishing emails impersonating Brazilian banks are extremely common. A lot of malware like Latin American banking trojans is delivered via phishing attachments in this region. There’s also a social factor: many LATAM businesses use WhatsApp for official communications, so attackers use WhatsApp phishing e.g. Hi, this is HR, fill this form. Political turmoil in some countries has even led to phishing campaigns that exploit headlines e.g., phony government notices, COVID vaccine sign ups, etc.. The good news is awareness is rising. More LATAM organizations are engaging in training and using cloud email security as they realize the spike in threats. But the data shows LATAM as the fastest growing target, meaning adversaries see high ROI there perhaps due to generally weaker security postures and more willingness to click unfamiliar links.
• Middle East & Africa MEA: In the Middle East, phishing often ties into regional banking and government themed lures. Gulf countries have seen phishing campaigns posing as oil & gas companies as that industry is big there or government ministries. There’s also an overlap with nation state activity for instance, Iranian and Israeli hacking groups exchanging phishing attacks as part of ongoing cyber conflict, often targeting officials or critical infrastructure via spear phishing. Africa has a mix of digital newcomers and advanced threat activity: on one hand, West African scammers so called Yahoo boys pioneered email fraud schemes and continue to conduct BEC and 419 scams, on the other hand, African businesses are now seeing the same ransomware phishing attacks hitting elsewhere. In 2025, South Africa reported an especially high rate of BEC and financial phishing, aligning with its role as a financial hub of Africa. Many African nations have less mature email security deployments, so phishing attacks face fewer technical hurdles. We’ve seen things like phishing campaigns exploiting local contexts e.g., phishing emails in Nigeria around the time of government cash subsidy announcements, people were expecting relief funds, and scammers pounced with fake registration links. Overall, MEA is a region of contrast: some very sophisticated targeted phishing often in relation to political conflicts, and a lot of generic phishing exploiting new internet users. Statistically, Africa actually had the highest average weekly attacks in Q1 2025 in Check Point’s data 3,286 per org though its YoY increase was not as high as LATAM’s, suggesting the baseline was already high. Middle Eastern financial institutions also routinely appear in top targets for phishing.

In summary, phishing respects no borders, but regional differences in language, culture, and technology adoption create unique challenges. A successful strategy in one region e.g., heavy SMS use in APAC, WhatsApp in LATAM, email in NA/Europe will be replicated by attackers there. It’s crucial for global organizations to tailor anti phishing training and controls to local contexts. What tricks a user in one country may not fool another, and vice versa. Collaboration between international CERTs/law enforcement is also key, as many phishing rings operate across continents for example, Eastern European criminals phishing North American targets, or West African BEC groups targeting Europe. The stats clearly show every region is under phishing assault, just via different flavors.

Major Incidents and Phishing Campaigns of 2025

In 2025, rather than a single mega breach defining the year, it was a series of persistent campaigns and novel tactics that characterized the phishing threat landscape. Here we highlight some notable patterns and incidents:

• AI Deepfake BEC Scam The $25 Million Call: One of the most jaw dropping phishing related heists involved the use of deepfake video conferencing. In early 2024 reported in 2025 as details emerged, criminals targeted a UK based engineering firm, Arup, with a classic BEC setup supercharged by AI. The attackers scheduled a Zoom meeting with a finance employee, impersonating the company’s CFO via a real time deepfake video. The fake was so convincing, matching the executive’s voice and likeness, that the employee authorized a series of transfers totaling $25 million to the fraudsters. This incident highlighted how far phishing tactics have come from simple emails, it was a multi-channel social engineering attack that combined email to arrange the meeting, voice, and video deception. The funds were routed through international banks and largely lost. The case grabbed headlines as perhaps the first publicly known deepfake powered corporate heist, and it served as a warning of what’s coming in phishing, namely, real time social engineering by AI avatars. Following this, many companies started instituting verification protocols for any transaction requests made over calls or video, no matter who’s on the screen.
• Unpaid Toll Phishing Domain Farms: A widespread phishing campaign themed around fake toll road bills became so pervasive that it warranted mention in Interisle’s annual phishing report. Scammers sent emails claiming the recipient had unpaid highway toll fees and must click to pay. What stood out was the industrial scale of the operation: investigators found a cluster of ~37,000 lookalike domains all related to this unpaid toll scam. Astonishingly, 65% of those domains were all registered via a single registrar in China, and a third were hosted on one Chinese hosting provider essentially, a phishing factory. The campaign targeted US drivers impersonating state toll agencies, suggesting a coordination between actors in China and criminal crews elsewhere. It underscored how phishing isn’t just random guys firing emails, in some cases its organized operations are churning out tens of thousands of tailored domains. Law enforcement and registrars did collaborate to take many down, but the scam also showed how criminals abuse the domain ecosystem at scale. For defenders, it highlighted the importance of monitoring for typosquat domains and getting phishing sites removed quickly through takedown efforts.
• TOAD Telephone Oriented Attack Distribution on the Rise: 2025 was the year that the TOAD attack technique went mainstream among phishers. In a TOAD attack, victims receive an email with no malicious link instead, it’s often a faux invoice or subscription notice e.g., Thank you for your $399 purchase, call us if you didn’t authorize this. The email urges the target to call a phone number operated by the scammer if they have questions. When the victim calls, the attacker, posing as customer support, socially engineers them, often walking them through steps to secure their account which actually lead to installing remote desktop malware or revealing banking info. This method bypasses all email URL filters and capitalizes on human trust in voice communication. Multiple security firms Proofpoint, etc. reported that they blocked over 100 million TOAD based threats in 2025. A notable pattern was scammers impersonating companies like Amazon, PayPal, antivirus vendors, etc., knowing people will panic about an unauthorized charge and call immediately. The success of TOAD attacks led to increased training guidance to never call the number provided in an unsolicited email, instead use the official website or known contact. It also blurred the line between phishing and classic phone scams essentially combining them. The major takeaway is that not all phishing has a hyperlink, sometimes you activate the attack by picking up the phone.
• Phishing Enabled Ransomware Waves: Several major ransomware incidents in 2025 traced back to phishing. One pattern: the use of phishing to steal VPN or remote access credentials, which hackers then use to deploy ransomware deep inside networks. For example, the ALPHV/BlackCat ransomware group was linked to a breach of a healthcare claims processor Change Healthcare they got in using stolen credentials likely via phishing a contractor months prior and later launched ransomware that disrupted healthcare services nationwide. Another example: a wave of attacks by the LockBit ransomware gang targeted manufacturing and logistics companies in early 2025, in many cases initial phishing emails with malicious attachments delivered malware loaders like Emotet or IcedID, which eventually led to ransomware detonation. The fact that ransomware featured in 44% of breaches in 2025, with phishing as a common entry, means many major incidents of ransomware on a hospital, a city government, a pipeline operator, etc. were effectively phishing incidents at the start. A positive development was more firms refusing to pay e.g., when a large U.S. school district was hit via a phishing origin ransomware in mid 2025, they stood up backup systems and didn’t pay the multi million ransom, even though data was leaked. The incident caused weeks of disruption, illustrating that the pain from a single clicked phish can propagate widely.
• Credential Phishing Kits & MFA Bypass: On the technical front, 2025 saw the proliferation of advanced phishing kits sold on the dark web, some of which explicitly advertise MFA bypass capabilities. At least 15% of phishing kits now include adversary in the middle AiTM features that allow them to steal session cookies or one time passcodes, letting attackers defeat basic two factor authentication. A kit known as Muraena/NecroBrowser and similar reverse proxy tools became common in phishing campaigns against corporate webmail victims would click a link, get proxied to the real login so they enter their 2FA code, and the kit would steal the session to log in as them. We also saw MFA fatigue attacks prompt bombing about 14% of breaches involving attackers spamming push notifications to users’ authenticator apps hoping they’d eventually tap Approve out of annoyance as noted in incident analyses by Microsoft. One real world campaign in 2025 targeted a prominent IT services company: attackers phished an employee’s VPN credentials which had MFA, then used an MFA fatigue attack overnight the sleepy employee eventually approved the login, leading to a network breach. The major incident here is not one event but the trend: phishers adapting to security measures. This reminds defenders that just mandating MFA isn’t foolproof, user education about these new tricks is vital, and adopting phish resistant MFA FIDO2 keys might be necessary for high risk accounts.
• Supply Chain Phish Targeting Partners: A notable campaign vector in 2025 was phishing one organization specifically to compromise and abuse its trusted relationships. For example, several managed service providers MSPs were phished, not for their data, but as a conduit to attack their clients. Attackers would steal an MSP’s email account, then send realistic phishing emails to all the MSP’s customers since those customers would trust an email from their IT provider. One incident saw an IT support firm unwittingly help phish dozens of its small business clients because the attackers used its actual email domain and style. Similarly, phishing attacks on software companies to spread malware via software updates supply chain attacks were reported, though not as catastrophic as SolarWinds 2020. In 2025, at least one such case occurred with a regional HR software vendor whose update server was compromised after a developer fell for a phish leading to several downstream companies getting backdoored. These incidents underscore that phishing one weak link in a supply chain can magnify into a multi organization breach. It’s why frameworks like Zero Trust and supply chain security assessments have grown in focus.

In essence, 2025’s major phishing incidents were less about singular headline breaches and more about the evolution of techniques and the accumulation of many medium breaches that were incredibly costly. The through line is phishing as the common denominator whether it’s ransomware, financial fraud, or espionage, phishing often sets the stage. The year taught us that phishing is no longer just a Nigerian prince asking for help, it could be an AI crafted CEO’s voice on the phone, a QR code on a parking ticket, or a seemingly benign email from a colleague’s real account. The incidents and campaigns this year hammered home the need for holistic vigilance.

Emerging Trends in Phishing

As we look to the future, several emerging trends from 2025 indicate where phishing is headed in 2026 and beyond:

• Generative AI as a Force Multiplier: The integration of AI into phishing operations is a game changer. By early 2025, it was estimated that over 80% of phishing content is AI generated or AI assisted. This means attackers can mass produce phishing emails that are grammatically perfect, contextually tailored, and even translated into multiple languages instantly. We also saw AI being used to scrape victims’ social media to craft highly personalized lures spear phishing. On the defender side, AI is being used in email filters to catch phishing but it’s an arms race of AI vs AI. A striking stat: Some vendors reported that advanced AI email filters reduced phishing miss rates by ~18%, yet still around 9% of AI crafted phishing emails bypassed defenses showing room for improvement. Deepfakes are another aspect of AI: beyond the high profile deepfake scam mentioned, deepfake audio was used in vishing more frequently, and we anticipate convincing deepfake videos in phishing e.g., a fake video message from your boss to increase. Generative AI has lowered the skill barrier for cybercrime, even low level scammers can now produce polished phishing kits and scripts. Expect phishing to become more frequent and harder to spot as AI continues to advance. Security teams will need to adopt behavioral detection identifying phishing by context, timing, relationships since content alone is no longer a reliable way to tell AI can make phish look legitimate.
• 📱 Omnichannel & Hybrid Attacks: The trend of spreading phishing across multiple communication channels will intensify. Omnichannel phishing where an attacker might simultaneously use email, SMS, voice, and messaging apps creates a believable environment around the target. For example, an attacker might send a text claiming to be a bank verification code right after the target logs into a fake bank site to mimic a real 2FA workflow. We’ve seen prototypes of this, and it will likely become common. Also, the blending of physical and cyber: Quishing is one form, but we might see things like phishing via smart QR codes on digital signage, or attackers mailing tampered USB drives with phishing documents to bridge physical mail and email. The concept of hybrid warfare using both psychological manipulation and technical subterfuge is here to stay. One particular trend to watch is phishing expanding into collaboration platforms attackers sending malicious messages or OAuth app requests directly inside Slack/Microsoft Teams, etc. In 2025 about 40% of phishing campaigns used at least two different vectors like email + phone, or email + SMS, in coming years that number could approach 100% for advanced attacks, as multi-channel approaches clearly yield better success for attackers. Defense will require more unified monitoring of communication channels and user behavior, not just email scanning in isolation.
• Phishing as a Service & Automation: The underground economy has effectively productized phishing. In 2025 we saw a proliferation of Phishing as a Service PhaaS platforms on the dark web. These are turnkey services where an aspiring criminal can rent a phishing kit, complete with pre-made email templates, hosting for phishing pages, and even customer support from the kit maker. Some kits like 16Shop, EvilProxy, and others are constantly updated to evade new security measures. This mass automation means the volume of phishing can further grow without a corresponding increase in effort or skill on the attackers’ part. One notable service was a PhaaS that integrated AI chatbot functionality so if a victim responded to a phishing email with questions, an AI trained on scamming scripts would reply in real time to persuade them. Essentially, we’re seeing the industrialization of phishing: high volume, consistent quality, and even professional touches like tracking dashboards. Some PhaaS let scammers see how many clicks or creds are captured. The trend implies that even small-time crooks can launch big phishing campaigns, so we might face more attacks from more sources. It also means new phishing tactics spread faster one kit developer updates, then all their criminal customers instantly start using that method. Organizations should stay informed via threat intelligence sharing e.g., knowing quickly if a new Office 365 phish kit is circulating so they can adjust user warnings and technical controls promptly.
• Focus on Credentials & Session Theft: While phishing for malware delivery continues, there’s a strong trend toward credential phishing and session hijacking. With many organizations deploying endpoint detection stopping macro malware etc., attackers pivot to just stealing logins and valid sessions. As noted, stolen credentials were the initial vector in ~22% of breaches in 2025 Verizon data, and phishing is the easiest way to get those credentials. We see attackers not just harvesting usernames/passwords, but actively stealing session cookies/tokens which bypass 2FA. This is often done by AiTM proxy phishing sites. In essence, the attacker phishes you, and instead of planting ransomware immediately, they quietly use your VPN or cloud access for a long term intrusion which is harder to detect. This low and slow approach turns phishing into a silent espionage tool. Given the push for passwordless auth, attackers might also target other identity elements like trying to phish recovery codes, device approval requests, or compromising SSO providers. We expect more incidents where the phish itself doesn’t cause immediate damage, but months later a breach is discovered that traces back to one stolen VPN password. The implication is companies should treat compromised credentials as an incident even if nothing bad appears to have happened yet it’s often the prelude to a bigger breach.
• Highly Targeted Phishing Spear Phishing 2.0: At the opposite end of the spectrum from mass PhaaS campaigns, we have state sponsored and organized criminal groups doing extremely targeted phishing. 2025 saw an increase in whaling phishing, high value executives and supply chain phishing. One example is a campaign where attackers researched a specific corporation’s vendors, then sent tailor made phishing emails to the company’s finance team posing as a known vendor with a change in bank details essentially business email compromise without compromising an email just social engineering via a perfect spoof. These targeted attacks might only send out a handful of emails, making them very hard to catch with traditional volume based detection. Many utilize timing and context for instance, sending during a holiday lull, or right when a real vendor contract is up for renewal. Deepfakes will also play a role here as in the Arup case. We call it Spear Phishing 2.0 because the sophisticated language, context, and multi-channel approach is far beyond the old URGENT wire money scams. The trend is especially concerning for sectors like defense, government, and large enterprises where such adversaries invest time. Combating this requires a combination of rigorous procedures e.g., out of band verification for any transaction or credential request and highly aware staff technology alone might not flag a single well written email.
• Intersection with Other Threats Phish: Finally, phishing is increasingly the starting point for whatever new threat emerges. We saw it with ransomware previously, now we’re seeing it with things like cryptocurrency theft and supply chain attacks. In 2025, as crypto markets picked back up, phishing for crypto wallet seeds and exchange logins spiked. NFT platforms and crypto users got hit with very authentic looking phishing sites. Looking ahead, if, say, deepfake sextortion becomes big, it will likely begin with phishing emails delivering the fake evidence or demands. Or if attackers target AI systems, they might phish AI developers or data providers. Essentially, phishing is the connective tissue of many attack campaigns. Even when we talk about AI poisoning or IoT hacks, chances are a phishing email to an engineer or admin is how the bad guys get initial access. So one emerging trend is really the persistent truth: as long as humans interface with systems, phishing will adapt to whatever context is relevant, be it stealing API keys for cloud services, compromising CI/CD pipelines, or hijacking social media accounts. It’s both old and ever new as threats evolve.

In summary, we can expect phishing to become more believable, more pervasive, and more adaptive. The lines between phishing and other forms of cyberattack will blur further. Is it phishing or fraud? Phishing or hacking? It often starts with phishing and turns into all of the above. Organizations will need to invest in smarter defenses like behavioral AI that notices anomalies in user actions and stronger user training to keep up with these trends. The stats and developments from 2025 are a clear forewarning of the shape of phishing in the near future.

What These Statistics Mean

Digesting all these statistics, one might ask: So what? What do these numbers tell us beyond phishing is bad? Here’s the deeper meaning and strategic insight behind the stats:

1. Phishing is the Primary Catalyst of Cyberattacks: The fact that phishing is the leading initial attack vector 16% of breaches and involved in the majority of major incidents means that if you stop phishing, you stop a huge chunk of cyber threats before they start. In practical terms, phishing is the trigger for ransomware, BEC, data breaches, etc. The stats link phishing to 54% of ransomware cases and a large share of BEC scams. This means organizations should prioritize anti phishing measures as a form of preventative medicine against multiple categories of attacks. It’s the highest leverage defense. If you can shrink that 16% of breaches to, say, 5%, you knock out a lot of downstream incidents.
2. The Human Firewall is Under Siege: With 68% of breaches involving human error or social engineering, the human element is clearly still a major vulnerability. The average employee’s likelihood to click a phishing link often ~30% in tests combined with the speed of seconds shows that technical controls alone aren’t enough and humans, unlike software, can’t be patched easily. However, the flip side of the stats is hopeful: organizations that invested in training saw up to an 86% reduction in phishing risk over a year and much higher report rates. In essence, people can be transformed from liabilities into assets with proper awareness and practice. The meaning here is that security strategies must devote serious effort to user education and engagement, not just fancy AI filters. Every employee should be considered part of the security team once properly trained.
3. Attackers are Investing in Scale and Sophistication: The numbers around malicious domains 1.5 million+ domains used for phishing, 38% rise, bulk registrations 37% via bulk services, and the explosion of new vectors QR, voice, etc. all paint a picture of adversaries who are innovating and scaling up like a business would. They have more infrastructure, more automation PhaaS, AI, and more techniques to evade detection. This indicates that phishing is not a bunch of isolated amateurs, it's often organized cybercrime and even nation state backed operations. For defenders, this means we’re up against agile, well resourced opponents. We need to respond with equal agility: sharing threat intel, deploying modern defense tools, and thinking like attackers to anticipate their moves for example, conducting regular web application security testing to see how a phish could pivot within your environment. The statistics basically validate that phishing is a professional enterprise now, so treat it as such in risk assessments.
4. Traditional Defenses Are Being Challenged: If 9% of AI generated phishing emails still bypass filters, or if many users are scanning QR codes that email scanners can’t analyze, it shows the limits of our existing security stack. Organizations that relied on email gateways and antivirus alone are missing whole swathes of the attack surface texts, social media, personal email, etc.. The rise in multi-channel attacks means security can’t operate in silos e.g., the team that handles email security must coordinate with the team handling mobile device management and the one handling voice/VOIP systems. The stats about MFA bypass and such also suggest that even our advanced protections like 2FA are being worked around. This doesn’t mean those defenses are useless, it means layers and context are critical. We should not throw out MFA because phishers bypass some of it, instead, we must augment it with phishing resistant methods and user training about not approving unexpected prompts. The broad implication is a need for a more holistic, integrated security posture, one that monitors and protects identities, devices, and communications comprehensively often referred to as a unified threat management approach or XDR.
5. The Cost of Inaction is Climbing: With breach costs reaching record highs and BEC losses in the billions, the statistics essentially make a business case: security investments now are cheaper than breach losses later. For example, compare $4.88M average breach cost to, say, the cost of implementing a top notch security awareness program and phishing resistant MFA the latter is a fraction of that amount. Similarly, losing $2.8B to BEC in a year vs. investing perhaps a few million across industries in better email validation like DMARC enforcement and transaction verification controls the ROI is clear. The upward trend in ransom demands that were attempted at $83k to $ variant growth suggests attackers will keep trying to increase their payouts. Organizations that don’t improve their defenses will be seen as soft targets and could be hit repeatedly indeed some companies suffer multiple phishing breaches. The meaning behind the money is simple: security is no longer just an IT issue, it’s a business continuity and financial risk issue. Boards and executives should take these stats as evidence to support funding and strategic shifts like moving to a Zero Trust model, segmenting networks to mitigate phishing impact, etc..
6. User Trust is Being Exploited in New Ways: The trends around brand impersonation Microsoft, DHL, etc. and new channels tell us that attackers continuously pinpoint where users’ implicit trust lies. Users trust their company’s voicemail? Attackers clone a voice. Users trust a brand’s logo and look? Attackers copy it to a tee in a phishing site. Trust in QR codes or MFA apps? Attackers abuse that. Essentially, phishing stats highlight trust and human nature at the core. Knowing this, organizations should foster a culture of healthy skepticism. The old advice of checking for spelling errors is outdated now it's to verify requests through a second factor or channel. The human psychology aspect is key: stats on rapid click times seconds to click vs minutes to report show people act on impulse, training needs to instill that pause and think reflex. Also, given how convincingly phishers can impersonate internal communications, companies might need to implement more technical validation like code words for high level requests, or signed emails for critical communications so employees can distinguish real from fake. The meaning here is that building resilience against deception is an organizational priority, not just a technical tweak.

In sum, these statistics underscore that phishing is not a static or solved problem, it's evolving and expanding, touching all areas of an organization. They emphasize the need for a multi faceted defense strategy: technological better filtering, authentication, network segmentation, human training, simulations, hiring skilled responders, and procedural policies for verification, incident response drills. The numbers also validate many best practices: those who did X like to use AI or training fared better than those who didn’t. So we should heed those lessons. Big picture: Phishing stats are a barometer of cyber risk right now, the pressure is high and rising, indicating storms ahead if we don’t reinforce our defenses.

Best Practices Informed by the Data

Given what the 2025 phishing statistics are telling us, organizations should adapt their security controls and practices accordingly. Here are some data driven best practices to mitigate phishing risk:

1. Implement Advanced Email Security & Filtering: Basic spam filters are not enough when facing millions of phishing emails, many crafted by AI. Consider next gen Secure Email Gateways SEGs or cloud email security add ons that use machine learning to analyze not just known bad links, but email content and context. Many solutions now do natural language processing to detect phishing intent e.g., an email asking for a payment or credentials when it usually wouldn’t. The goal is to catch more of those 9% of sneaky emails that currently slip past filters. Additionally, use DMARC, DKIM, and SPF email authentication to reduce spoofed emails using your domain, this helps prevent attackers from impersonating your organization in phishing attempts. Regularly tune and update filter policies based on what’s trending for example, if QR code phish is rising, enable any filter features that can detect images of QR codes or use computer vision to analyze them.
2. Adopt Phishing Resistant Multi Factor Authentication: Given the prevalence of credential phishing and the fact that many kits bypass basic MFA, move toward phishing resistant MFA methods. This includes using FIDO2 security keys or hardware tokens that cannot be phished via a fake site they are bound to the real domain. If hardware keys for all employees isn’t feasible, at least enforce app based authenticators over SMS codes SMS being easier to phish or intercept. Educate users: if they get an unexpected MFA prompt on their phone, do not accept it, it could be an attacker trying your password. Some organizations implement number matching to push MFA users to type a number shown on the login device into their phone which can thwart automated prompt bombing. Stats show 15% of phishing attacks tried some form of MFA bypass, to counter that, Zero Trust principles should be applied: don't assume a logged in session is legit just because MFA was passed, monitor sessions for anomalies and re challenge if needed.
3. Continuous Security Awareness Training & Phishing Simulations: The data on training efficacy is compelling up to 86% risk reduction in a year with proper programs. Therefore, invest in a robust Security Awareness Training SAT program that is ongoing, not just an annual video. Use simulated phishing exercises frequently at least monthly to test and reinforce behavior. Make the simulations varied: include emails, SMS, voice if possible to cover multiple vectors. Track metrics like click rates, report rates, and provide positive reinforcement to those who report phish. Remember the stat: trained users are 4x more likely to report phishing attempts than untrained. Build that reporting culture and it serves as an early warning system. Also, tailor training to new threats, e.g., after news of the deepfake CFO scam, run a workshop on verifying identities over video calls. Gamify the training if possible departments earn points for reporting phish, etc. to encourage engagement. The goal is to change that median click time from 21 seconds to never, and the report time from 28 minutes to a few minutes.
4. Tighten Verification Procedures for High Risk Transactions: Business Email Compromise thrives because companies lack out of band verification for things like wire transfers, vendor bank detail changes, and large payments. Implement strict procedures: if any employee receives an email or Teams message or phone call requesting a financial transaction or sensitive data, they must verify through a second, independent channel. For example, if the CEO emails Finance to wire money, require a phone call to the CEO’s known number for confirmation and vice versa, if someone calls, require an email or some internal portal confirmation. The staggering average BEC loss of $137k could be chopped down if every attempted scam was caught by a verification step. Similarly, train staff to never accept account changes like changing a vendor’s bank account without verification. Many companies now use code phrases or shared secrets with vendors for confirming changes. Essentially, don’t rely on email alone for authorization of important actions. This mitigates both BEC and phishing induced fraud.
5. Incident Response: Prepare for Phishing Breaches: Given the long dwell times and high costs, it’s critical to have an efficient plan for detecting and responding to phishing incidents early. This includes deploying endpoint detection and response EDR tools that can catch malware from a clicked phishing link quickly, as well as network monitoring for unusual logins e.g., an employee logging in from an IP in another country after a potential phish could indicate compromised credentials. Regularly run drills: simulate a phishing breach scenario an employee fell for a phish, now what steps do the IT and security team take? Have playbooks for containing account takeovers e.g., how to rapidly remove OAuth tokens, reset accounts, etc. since many breaches involve stolen credentials. Also, ensure you have backups and recovery plans specifically considering ransomware scenarios, since phishing so often leads there. The stat that breaches past 200 days cost $5M vs $3.8M if caught earlier is a $1.2M incentive to improve your detection speed. Utilize the fact that median report time is 28 minutes: try to encourage immediate reporting and have your security operations center treat every phishing report with urgency, it could be the tip of an iceberg. Over time, measure and aim to reduce your phishing dwell time between a phish click and remediation.
6. Broader Attack Surface Visibility and Testing: With phishing expanding to cloud apps, personal devices, etc., it’s important to have visibility into your attack surface. This means knowing which SaaS apps your users are using shadow IT can be entry points, and monitoring for data leaks or stolen credentials services that scan dark web for your users’ emails in combo lists, for instance. Conduct penetration testing or red team exercises that specifically include phishing scenarios, this will highlight where you might lack controls e.g., testers might find they can get in via a helpdesk phishing call revealing a process gap. Consider engaging in continuous penetration testing services that regularly probe your systems and employees for susceptibility, rather than a one off test. Additionally, ensure that you’ve segmented networks and least privilege access internally so that if a phish does succeed, the damage is contained. For example, an employee in Finance getting phished shouldn’t be an instant domain admin takeover segment and limit access to reduce the blast radius.
7. Implement User Focused Tools: Deploy some tools that empower users in the fight. One example is an email client plugin or one click button for Report Phish that forwards the email to security for analysis making it easier to report than to ignore. Another is using browser plugins that can detect fake URLs or known phishing sites and warn users some companies enforce safe browsing extensions. You could also utilize password managers to enter credentials only for the legitimate site. If a user clicks a phishing link, the password manager won’t autofill because the domain won’t match, which can prompt the user to realize something’s off. Some organizations have had success with external email banners to remind users an email came from outside the company. This doesn’t stop phishing, but it gives a visual cue that, say, an email that claims to be from the CEO but has the external banner is suspicious. Finally, consider anti phishing training for customers if relevant e.g., banks training their customers on scams because your security is also as strong as your user base in many cases.

By aligning security practices with the hard data, an organization builds a defense strategy that’s not based on hypothetical threats, but on the attacks that are actually happening every day. The statistics from 2025 essentially highlight where to focus: improve human vigilance, block the common paths email, SMS, have a plan for when prevention fails, and keep adapting. Phishing may never be fully eradicated, but its success can be drastically limited by layered, informed defenses that address both the human and technical facets of the problem.

FAQs

• What percentage of cyber attacks start with phishing?

Various reports show that phishing is the single most common entry point for cyber attacks. In the 2025 Verizon Data Breach Investigations Report, phishing was the initial attack vector in about 16% of data breaches more than any other vector. Additionally, IBM noted that if you include related human errors and stolen credentials often obtained via phishing, the human element is involved in 68% of breaches. In practice, this means a significant portion some analysts say over half of cyber attacks have phishing as a component, especially for major incidents like ransomware or BEC.

• How many phishing emails are sent per day/year?

It’s difficult to get an exact count of all phishing emails globally, but we have some indicators. The Anti Phishing Working Group APWG tracks unique phishing sites rather than every email. They observed over 1 million phishing attacks in each of Q1 and Q2 2025, which suggests an annualized rate of ~4 million distinct phishing campaigns. As for daily email volume: Google has reported blocking 100 million phishing emails per day on Gmail in the past. One specific stat from late 2024/early 2025: security filters saw an average of 2.7 million phishing emails with QR codes sent per day just those containing QR codes!. These numbers indicate that tens of millions of phishing emails are likely sent globally each day, if not more, when you include all platforms.

• What is the success rate of phishing attacks?

The success rate can be measured in different ways: percentage of people who click, or percentage of campaigns that lead to a breach. In internal phishing simulations, a common metric is the Phish Prone Percentage PPP. Across industries, baseline untrained PPP is often around 30%, meaning roughly 3 in 10 employees might click a well crafted phishing link or open a malicious attachment. With training, this can drop to under 5% in best cases. In real world attacks, Verizon’s data suggests that about 4% of people will click on any given phishing campaign on average, but certain targeted campaigns have much higher success e.g., a spear phishing could trick 50% of recipients if it’s very convincing. In terms of breaches, if phishing causes 16% of breaches, that implies that out of all phishing campaigns launched, only a small fraction succeed in causing a reportable breach because there are millions of attacks. However, phishers play a volume game even if a 1% success on a million emails can yield 10,000 victims. Specific scams like BEC have lower open rates but higher impact per success. For example, in 2024 there were ~21,000 reported BEC incidents out of presumably hundreds of thousands of BEC phishing attempts indicating maybe <10% success in getting someone to engage, but that’s enough to steal $2.8B. In short, general phishing is often a single digit percentage success per email sent, whereas highly targeted phishing can be successful with just one hit out of a hundred attempts if it lands on the right person.

• How has phishing changed with the rise of AI in 2025?

Phishing has become more effective and harder to detect with AI’s help. Generative AI models allow attackers to produce flawless, customized phishing messages in seconds, where it used to take significant time and often non native English gave them away. AI can generate convincing dialogue for impersonating tech support chats, create fake but realistic images like a deepfake invoice or a synthetic ID, and even clone voices for vishing. Statistics show an over 80% adoption of AI in phishing content creation, and a massive increase 1000%+ in some measurements in phishing volume since tools like ChatGPT became available. On the flip side, defenders are also using AI to better detect phishing, for example, machine learning systems that identify phishing websites by their characteristics, or AI that scans email context. One outcome noted is that AI driven phishing emails have fewer of the old telltale signs, typos, odd phrasing, so users must rely more on context e.g., am I expecting this email? and technical checks. AI has also enabled more personalized phishing at scale, attackers can feed personal info into an AI to draft a tailored lure for each target, something only nation states used to do manually. So, the rise of AI has raised the stakes: phishing emails in 2025 look much more legitimate, and even security pros sometimes double take. We expect AI will continue to both help and hurt. Perhaps AI could one day warn users this email seems AI generated/phishy as a built-in email client feature.

• Which brands are most commonly used in phishing scams?

Phishers love to impersonate well known brands that people trust and are likely to interact with. According to multiple threat reports in 2025, Microsoft is consistently the #1 impersonated brand in phishing globally. This includes Microsoft 365 login pages, OneDrive share links, etc., because compromising a Microsoft account is extremely valuable. Other top brands often include: DHL and shipping firms especially during holiday seasons, track your package scams, Amazon order and delivery scams, PayPal and other payment services, bank brands depending on region, e.g., Chase or Bank of America in the US, and social media platforms like Facebook and LinkedIn for credential harvesting. In one quarter of 2025, DHL was actually neck and neck with Microsoft as the most phished brand likely due to a surge in QR code delivery scams. Mastercard and Visa are common for financial phishing, and Google gets impersonated a lot as well Google Docs shares, Google Drive links asking for login. Essentially, any brand that has a login portal that millions use is a target for impersonation. Phishers also tailor brand bait by region e.g., in the UK, Royal Mail and HMRC tax are frequent phishing themes, in Australia, Telstra telco phishing is common, in Latin America, WhatsApp and MercadoLibre e-commerce are used. Always be cautious and go directly to the official site instead of clicking a link in an unsolicited message, no matter the brand logo or name on it.

• How effective is security awareness training against phishing?

When done right, security awareness training is quite effective in reducing phishing risk, though it’s not a silver bullet. The numbers are telling: organizations that run regular training and phishing simulations have seen the average click rate on phishing tests drop from ~30% to under 5% over time. One industry study in 2025 found up to 86% reduction in click rates after 1 year of continuous training meaning if 100 people would have clicked before, now only 14 do a huge improvement. Trained users also become far more likely to report phishing attempts, roughly 21% of trained users report phish vs only 5% of untrained. That said, training isn’t one size fits all. Some programs are just annual PowerPoints and have limited impact, the best programs are ongoing, varied, and engaging, with leadership support. There is also the issue of the repeat clickers, typically a small percentage of employees who, despite training, keep clicking. Those may need additional one on one coaching or other measures some orgs limit their access or put them on stricter email filtering. Also, training effectiveness can decay over time if not reinforced, hence continuous testing is key. Importantly, training will educate users on new scams like QR phishing or deepfakes which technology might not fully handle yet. In summary, good security awareness training significantly lowers an organization’s likelihood of a successful phish, but it works best in tandem with technical controls. Think of it as immunization: it raises resilience but isn’t 100% immunity. You still need herd immunity from multiple layers of defense.

• What’s the average cost of a phishing attack or breach?

The cost can vary widely depending on what the phish leads to. If we’re talking about a full data breach initiated by phishing, the average cost is about $4.88 million in 2025. This includes all the things like investigation, remediation, downtime, lost business, regulatory fines, etc. That is higher than the average cost of breaches not involving phishing. If the phishing attack only results in some fraudulent wire transfers BEC scam and not a broader breach, the costs there are the actual funds lost plus perhaps recovery efforts. The FBI says the average financial loss per BEC incident is around $137,000. There have been extreme cases like a single BEC theft of $25M as in the deepfake case but those are outliers. For ransomware triggered by phishing, costs include ransom if paid plus recovery, the median ransom payment was $115k, but total incident costs average ~$5M when you factor in all consequences. Some research attempts to quantify the cost per phishing email or per employee click for instance, one study by Ponemon years ago said an average phishing email that successfully tricks a user can cost a large company around $15-20 per email in incident handling, adding up to millions yearly for big firms. But that’s a very rough estimate. In essence: a run of the mill phishing infection might cost tens of thousands IT cleanup, minor disruption, a successful BEC might cost hundreds of thousands, and a full breach or ransomware event can cost millions. Hence, the oft quoted figure: the average cost of a phishing data breach is ~$4.9M, which is a useful planning number for the worst case scenario.

The phishing landscape of 2025 reveals a threat that is escalating in both volume and sophistication. What was once a scattershot email scam has morphed into a polymorphic, multi channel assault on organizations’ trust and defenses. The statistics we’ve examined tell a clear story: phishing is the leading cause of breaches, the launchpad for costly attacks like ransomware and BEC, and a constantly evolving menace driven now by AI and criminal collaboration.

On the defensive side, there is progress. Companies are fighting back with better training, cutting phishing success rates dramatically and new technologies, AI driven filters, etc.. Yet the margin for error is shrinking. The average time to identify a phishing breach is 254 days and the soaring costs associated with such incidents $4.88M on average underscore that every phishing email that slips through can be a powder keg.

Moving forward, organizations must treat phishing as the pervasive business risk it is. This means baking anti phishing into the culture and the architecture: from the CEO who practices phishing drills along with employees, to the IT admin who implements phishing resistant authentication and zero trust network segments, to the finance clerk who now double verifies any fund transfer requests. The future likely holds even more convincing scams, think AI avatars and real time social engineering. But the core principles of defense remain: vigilance, verification, and layered security.

2025’s data ultimately reinforces a hopeful point: phishing may be growing, but it is a threat we understand well, and many of the solutions are within reach. With the right mix of human awareness and technical safeguards, organizations can substantially tilt the odds in their favor, turning what could have been a multimillion dollar breach into a mere blip on the radar. The battle against phishing is an ongoing campaign of adaptation and resilience and armed with the insights from these statistics, we are better prepared to meet it.

About the Author

Mohammed Khalil is a Cybersecurity Architect at DeepStrike. Specializing in advanced penetration testing and offensive security operations, he holds certifications including CISSP, OSCP, and OSWE. Mohammed has led numerous red team engagements for Fortune 500 companies, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.