Social Engineering Attack Statistics 2026: Human Risk & MFA Fatigue

Social engineering attack statistics for 2026 show a persistent and expanding human-targeted risk surface. The data points are not limited to phishing emails. They include voice phishing campaigns against help desks and employees, SMS and QR-code lures, stolen credentials, device-code and OAuth abuse, MFA fatigue, executive impersonation, business email compromise, and account-recovery or support-process manipulation. Recent reporting from Verizon, APWG, Microsoft, Google Cloud, the FBI, and the FTC shows the same pattern from different angles: attackers still win by exploiting trust, urgency, weak verification, and identity-control gaps even when organizations have invested in email filtering and basic MFA.

That is why social engineering is not only a user-awareness problem. It is a control-design problem across identity, email security, helpdesk workflows, SaaS administration, payment approvals, reporting culture, incident response, and recovery processes. This article uses publicly available 2024–2026 data and labels each statistic by data type so social-engineering-specific evidence is not casually mixed with broader phishing, fraud, breach, identity, or security-awareness benchmarks.

Methodology Note

This 2026 guide combines social-engineering-specific research, phishing and vishing data, identity-security research, breach benchmarks, fraud reports, government guidance, and security-awareness research. Each statistic is labeled by data type so general phishing, identity, breach, or fraud benchmarks are not treated as social-engineering-only evidence. Where a statistic is not social-engineering-specific, it is used only as context for human-risk and control-validation decisions. Source links point to official report pages or source hubs where available.

Top Social Engineering Attack Statistics for 2026

Social engineering risk is not measured by phishing volume alone. The more useful model is exposure times impact: who can be reached, what workflows they can influence, which identities they control, how strong the MFA and recovery paths are, whether suspicious events are reported quickly, and whether one approval, one reset, or one inbox compromise can create material fallout. FBI, Microsoft, Verizon, and Mandiant all point to the same conclusion: the highest-value work is control validation around identity, payments, helpdesk processes, and reporting speed.

Broad phishing, breach, or fraud numbers should be used carefully. A phishing-volume trend from APWG is not the same thing as a social-engineering-only breach metric from Verizon, and an FTC imposter-loss number is not the same thing as enterprise compromise telemetry. That distinction matters, because executives need to know whether they are looking at message volume, realized fraud loss, breach causation, identity attack activity, or awareness-training outcomes.

The most actionable social engineering statistics map to fixable gaps: phishing-resistant authentication, mailbox and OAuth governance, helpdesk verification, payment approval controls, suspicious-login monitoring, user reporting processes, incident-response playbooks, recurring social engineering assessments, and remediation retesting. Those are measurable controls, not generic awareness slogans.

What Counts as a Social Engineering Attack?

A social engineering attack is an attempt to manipulate a person, team, or business process into taking an action that benefits the attacker, such as revealing credentials, approving access, transferring money, resetting an account, installing software, sharing data, or bypassing a control. CISA describes social engineering as tricking someone into revealing information or taking an action they normally would not take, and CISA also defines phishing as a form of social engineering. APWG similarly defines phishing as a crime that combines social engineering with technical subterfuge.

In practice, that umbrella includes classic phishing and spear phishing; executive-targeted whaling; vishing and helpdesk impersonation; smishing and other mobile lures; quishing or QR phishing; pretexting and fake IT support; MFA fatigue or push bombing; executive and vendor impersonation; payroll or payment approval manipulation; account recovery abuse; OAuth consent abuse; session theft after a successful lure; and, when explicitly authorized for testing, physical paths such as baiting or tailgating. Mandiant, Microsoft, and CISA case reporting shows that modern operations increasingly mix channels rather than staying inside one medium.

The distinctions matter. Phishing is a channel and lure pattern, usually email or web-based. Vishing is the same trust abuse over voice. Smishing uses SMS or messaging platforms. Business email compromise is often an outcome of social engineering or identity compromise rather than a separate root cause. Account takeover is a downstream effect after credentials, sessions, or recovery flows are abused. Credential theft is one common objective. MFA fatigue is social engineering aimed at the authentication step itself. Insider threat is different because it can involve malicious insiders without deception. Malware delivery and ransomware initial access are often enabled by social engineering, but they are not synonymous with it. Fraud is the business impact domain; social engineering is often the mechanism used to get there.

Social Engineering Attacks in 2026

Social engineering attacks in 2026 are broader than phishing. The observable trend is toward cross-channel, identity-first, and process-aware attacks: a lure in email, a follow-up over Teams or phone, an MFA prompt made to look routine, a helpdesk pretext, or a payment request designed to hit during normal operational pressure. APWG, Microsoft, and Mandiant all show that attackers are increasingly favoring live interaction, mobile devices, and identity workflows when those paths outperform traditional email-only approaches.

AI changes scale and polish, but it does not change the basic control failure. The root problem is still trust plus weak verification. Microsoft’s 2025 data suggests AI can dramatically improve lure performance, while Google and Microsoft incident reporting shows that real-world compromise still depends on getting a person or process to approve, disclose, enroll, reset, or authorize something they should not.

For security leaders, the core question is no longer “Did someone click?” It is “Could one click, one call, one prompt approval, or one helpdesk exception produce a materially significant compromise?” That is a control-validation question, not a training-only question.

Social Engineering Attack Type Matrix

The table is not just a taxonomy. It shows why social engineering cybersecurity work has to connect people, identity, and business processes. A realistic social engineering assessment should test whether the control chain bends or breaks under time pressure, authority pressure, and routine fatigue. That means validating not only user response but also mailbox protections, identity proofing, callback procedures, reset scripts, payment approvals, SaaS admin protections, and incident escalation.

Phishing Statistics and Email-Based Social Engineering

Phishing remains the most visible social engineering channel, but it should not be treated as the whole category. APWG still recorded nearly a million phishing attacks in Q1 2026, and FBI IC3 complaint volume remains high. At the same time, Microsoft and Google reporting shows that attackers are branching into email bombing, OAuth abuse, device-code phishing, and cross-channel impersonation that starts in email and then moves to voice, Teams, or mobile.

Email-based social engineering supports several different attacker goals. Sometimes the goal is direct credential theft. Sometimes it is malware delivery. Sometimes it is BEC, OAuth consent abuse, device-code abuse, or simply establishing enough trust to move the interaction into a less-monitored channel. QR phishing matters here because it moves the victim onto a mobile device and can bypass older desktop-centric mental models and tooling assumptions. APWG reported more than 1.7 million unique malicious QR codes over a six-month period and an average of 2.7 million emails with QR codes attached daily.

Phishing and Email-Based Social Engineering Matrix

Phishing statistics are most useful when they are tied to what happens after the message lands. Verizon’s 2024 DBIR found that 20% of users reported phishing in simulations and 11% of clickers still reported, which is good news. But it also found that the median time to click was 21 seconds and the median time from click to data entry added just 28 more seconds, meaning users fell for phishing in less than a minute. That makes response speed, automated containment, and identity hardening more important than click-rate reporting by itself.

Verizon’s 2025 data sharpened that point: recent training had a large effect on report rate, but only modest impact on click behavior, and the median simulated click rate still landed at 1.5%. The takeaway is not that awareness is useless. It is that awareness must be paired with message controls, identity protections, mailbox monitoring, OAuth governance, and tested response playbooks.

Vishing, Smishing, and Voice-Based Manipulation

Vishing uses live calls, voicemail, collaboration-call functions, or fake support interactions to manipulate targets. Smishing uses texts, mobile messaging, and other short-form messaging channels. Both work because the victim is pushed into a real-time decision under pressure, often outside the familiar protections of the corporate inbox. APWG reported further growth in phone-based phishing and text-based fraud into 2026, while Mandiant observed vishing surge to 11% of initial intrusion vectors in 2025.

These attacks are especially relevant for helpdesk teams, finance staff, executive assistants, HR teams, and customer-facing support groups. Microsoft’s 2026 incident report details a case where a threat actor used persistent Microsoft Teams vishing while impersonating support personnel, failed twice, then succeeded on the third target, leading to remote access and compromise. That case underscores a broader lesson: voice social engineering does not need every target to fail. It only needs one reachable workflow and one break in verification discipline.

Deepfake voice should be treated as an emerging amplifier, not the default explanation for every successful vishing event. Microsoft and Google both report growing use of voice cloning and AI-enhanced deception, but the consistent weak point remains process design: weak callback procedures, undocumented exception handling, weak helpdesk proofing, and over-trust in urgency or authority.

Vishing and Smishing Matrix

The practical implication is straightforward: if your social engineering penetration testing program only measures email clicks, you are not really measuring social engineering resilience. Vishing and smishing require separate validation because they rely on live interaction, workarounds, and exception paths that static email controls rarely cover.

MFA Fatigue and Identity-Based Social Engineering

MFA fatigue, sometimes called push bombing, is social engineering aimed at the authentication step. The attacker does not need to persuade the victim to trust a fake document or malicious link if the victim can instead be pressured into approving an unexpected prompt, using a weak recovery path, or entering a code into a deceptive but legitimate-looking flow. Microsoft’s reporting shows MFA still blocks access in more than 99% of cases involving compromised credentials, which is exactly why attackers keep looking for adjacent ways around it.

That is the right way to read MFA fatigue in 2026. It is not evidence that MFA is pointless. It is evidence that some MFA designs, fallback channels, and recovery processes are weaker than defenders assume. Microsoft, Google Cloud, and Mandiant all document attackers abusing tokens, session cookies, device-code authentication, and helpdesk paths when standard login protections get stronger.

Number matching, phishing-resistant MFA, device binding, conditional access, suspicious-prompt reporting, mailbox and OAuth review, and stronger account recovery controls all reduce this risk. NIST’s current digital identity guidelines emphasize authentication assurance and lifecycle management, while SP 800-115 remains relevant for planning and conducting authorized security testing. Together, those standards support a practical point: authentication assurance is only as strong as the surrounding enrollment, recovery, and test discipline.

MFA Fatigue and Identity Risk Matrix

Identity-focused social engineering is where many programs still under-measure risk. Microsoft reported a notable uptick in device-code phishing, with 93% of observed events occurring in the second half of the year, and Google Cloud documented attackers harvesting long-lived OAuth tokens and session cookies after helpdesk-targeted or live-interaction campaigns. In other words, strong login UX does not eliminate risk if token lifecycle management, SaaS governance, and support resets remain soft targets.

Human Risk and Business Impact

Human risk in cybersecurity does not mean “users are the problem.” It means business risk emerges from the interaction between people, workflows, controls, incentives, workloads, and attack design. A rushed accountant, a helpful helpdesk analyst, a busy executive assistant, or an under-documented recovery script can all become the hinge point between a blocked phish and a material incident. Verizon, Microsoft, and IBM all reinforce this framing from different angles: human-triggered breaches are common, identity abuse is rising, and breach costs remain significant.

Social engineering typically becomes visible to executives through outcomes: account takeover, BEC, wire-transfer fraud, ransomware access, payroll diversion, data disclosure, privacy reporting obligations, legal review, higher support burden, and delayed incident containment. IC3’s 2025 figures show how serious those outcomes can become, with more than $3 billion in BEC losses alone, while FTC impersonation-loss data shows the broader financial scale of trust-based scams.

Human Risk and Business Impact Matrix

Social Engineering Root Cause Matrix

The “human risk management cybersecurity” lens is useful because it shifts the conversation from blame to system design. If helpdesk agents can be socially engineered into changing authentication state, that is not fundamentally a training failure. It is a control and workflow failure. If finance can authorize a fraudulent urgent payment because callback procedures are ambiguous or optional, that is not just a people issue either. It is a process-validation issue.

Social Engineering Prevention and Validation Roadmap

First 30 days

• Inventory high-risk workflows: login, MFA, password reset, helpdesk reset, payment approval, payroll change, vendor change, customer support, and admin access.
• Enforce MFA for executives, admins, finance, HR, helpdesk, and privileged users.
• Review MFA push settings, number matching, and suspicious prompt reporting.
• Review email reporting processes and escalation paths.
• Review helpdesk identity-verification scripts and exception handling.
• Review payment and vendor-change verification.
• Confirm an incident-response owner for suspected social engineering and identity compromise.

First 90 days

• Run an authorized phishing simulation focused on reporting and response, not just click rate.
• Run authorized vishing or helpdesk simulation where appropriate.
• Review phishing-resistant MFA options for high-risk users.
• Review OAuth grants, device-code exposure, and mailbox forwarding rules.
• Conduct account recovery and helpdesk reset testing.
• Conduct finance and payment workflow validation.
• Run a tabletop for credential theft, executive impersonation, or SaaS account takeover.
• Retest high-risk fixes.

First 12 months

• Move high-risk users toward phishing-resistant MFA or passkeys.
• Run recurring social engineering assessments based on role and workflow risk.
• Include vishing, smishing, and helpdesk workflows in testing, not just email phishing.
• Add human-risk metrics to executive reporting.
• Test new helpdesk, payment, identity, and support workflows before rollout.
• Run a red team assessment for mature organizations.
• Maintain remediation and retest evidence for auditability and buyer confidence.

Social Engineering Prevention Roadmap

How Social Engineering Assessments Reduce Risk

Social engineering assessments should always be authorized, scoped, and safe. The purpose is to validate controls and workflows, not to shame employees or create uncontrolled operational risk. NIST SP 800-115 remains the clearest public anchor for planning and conducting authorized security testing, and current NIST identity guidance reinforces that high-assurance identity programs must address lifecycle controls, not just the login ceremony.

That makes a social engineering assessment fundamentally different from a generic phishing campaign. DeepStrike-style validation should ask: Can high-risk users recognize and report? Can helpdesk staff withstand pressure? Can finance verify high-risk payment changes? Can identity controls block durable access through OAuth, device-code abuses, or session theft? Can the organization detect and contain what happened? And after a fix, can it prove the issue is actually closed?

Social Engineering Assessment Table

Social Engineering Metrics Table

The executive value of these metrics is that they show whether your human-risk management program is reducing real exposure, not merely increasing course completion. A lower click rate is nice. A faster report rate, stronger reset pass rate, higher payment-verification pass rate, and better retest outcomes are better. Those metrics connect directly to business resilience.

Executive Takeaways

• Social engineering risk is a control-design problem, not only a user problem. Verizon found the human element in 68% of breaches, which means identity, workflow, and reporting design deserve board-level attention.
• Phishing still matters, but voice and mobile channels are gaining ground. APWG and Mandiant both show rising vishing and smishing pressure, with vishing now a major observed intrusion vector.
• MFA is necessary, but not sufficient by itself. Microsoft reports MFA blocks access in more than 99% of compromised-credential cases, yet attackers are increasingly targeting tokens, sessions, device-code flows, and helpdesk resets.
• BEC remains one of the highest-cost outcomes of social engineering. FBI IC3 logged about $3.05 billion in reported BEC losses in 2025, which makes payment workflow validation a practical priority.
• Security awareness should be measured by reporting and escalation, not only by clicks. Verizon’s data shows reporting improves dramatically with recent training, while click behavior improves less.
• Helpdesk and account recovery are prime control-validation targets. CISA, Microsoft, and Google all describe cases where support flows, resets, or identity-side workarounds became the path to compromise.
• AI increases the plausibility and speed of social engineering. Microsoft’s benchmarked AI-phishing figures and fraud research show why legacy “spot the typo” thinking is no longer enough.
• Retesting is what turns remediation into verified risk reduction. NIST testing guidance and real-world incident patterns both support the same discipline: fix, validate, and retest.

FAQ

What are the most important social engineering attack statistics for 2026?The most useful numbers are not just phishing totals. The most important benchmarks are Verizon’s 68% human-element breach share, APWG’s 971,181 reported phishing attacks in Q1 2026, Mandiant’s 11% voice-phishing initial-access share, Microsoft’s 32% rise in identity attacks in the first half of 2025, FBI IC3’s $3.05 billion in BEC losses in 2025, and Verizon’s evidence that report rate matters more than click rate alone. 

What is a social engineering attack?A social engineering attack manipulates a person or process into helping the attacker. The goal may be credentials, money, access, data, software execution, or a control bypass. CISA describes social engineering as tricking someone into revealing information or taking an action they normally would not take, and it explicitly treats phishing as a form of social engineering. 

How common are social engineering attacks?They are very common, but prevalence depends on which dataset you use. Verizon found a human element in 68% of breaches, APWG recorded nearly one million phishing attacks in Q1 2026 alone, and FBI IC3 logged 191,561 phishing or spoofing complaints in 2025. Those numbers describe different things, but together they show that human-targeted attacks remain routine. 

What are the most common types of social engineering attacks?The most common categories include phishing, vishing, smishing, BEC, executive impersonation, QR phishing, helpdesk impersonation, MFA fatigue, fake IT-support pretexts, and identity-recovery abuse. The current trend is toward multi-channel combinations, such as email followed by a phone call or collaboration-app contact, rather than a single isolated lure. 

How is phishing different from social engineering?Phishing is one type of social engineering. Social engineering is the bigger category: it includes email lures, but also voice calls, text messages, payment pretexts, helpdesk impersonation, and approval manipulation. Treating phishing as the whole category can leave organizations blind to important paths such as vishing, MFA abuse, and account-recovery workflows. 

What is vishing?Vishing is voice phishing. Attackers use phone calls, voicemail, or voice-enabled collaboration platforms to impersonate trusted parties and pressure targets into taking risky actions. In 2025, Mandiant observed vishing rise to 11% of initial intrusion vectors, and Microsoft documented a Teams-based vishing case that resulted in compromise after a third targeted employee accepted the pretext. 

What is MFA fatigue?MFA fatigue is a social engineering tactic that pressures users to approve repeated authentication prompts or otherwise comply with unexpected verification activity. It does not make MFA useless. It shows that some MFA designs and recovery paths are weaker than assumed, especially if prompt limits, number matching, reporting, token controls, and helpdesk proofing are weak. 

Why is human risk important in cybersecurity?Because many high-impact incidents still depend on a human decision inside a workflow: reporting suspicious mail, approving a payment, resetting an account, accepting MFA, or installing a remote support tool. Human risk is best understood as the combined risk created by people, business pressure, process design, and control gaps. That framing is more accurate and more actionable than blaming users. 

Does security awareness training stop social engineering?Not by itself. Verizon’s data shows training materially improves phishing report rates, but has a much smaller effect on click behavior. Training is valuable because it supports earlier detection and better reporting culture. But organizations still need strong identity controls, helpdesk verification, payment approvals, mailbox protections, incident response, and retesting to reduce material risk. 

How can organizations prevent social engineering attacks?The best approach is layered and measurable: harden MFA for high-risk users, strengthen account recovery and helpdesk verification, validate payment controls, review OAuth and mailbox settings, monitor suspicious identity behavior, improve reporting workflows, and run recurring simulations and remediation retests. Prevention improves most when people, process, and technology controls reinforce each other. 

What testing helps reduce social engineering risk?Authorized phishing simulations, vishing simulations, smishing simulations where appropriate, helpdesk reset testing, MFA fatigue resilience reviews, identity and OAuth reviews, payment workflow validation, incident-response table-top exercises, red team assessments, and remediation retesting all help. The best mix depends on the organization’s identity architecture, business workflows, and risk concentration. 

Conclusion

The most important lesson from social engineering attack statistics in 2026 is that human-targeted risk is now a full-chain problem. Email still matters, but so do voice calls, texts, QR codes, MFA prompts, support desks, account recovery paths, mailbox rules, OAuth grants, payment approvals, executive communications, and incident escalation. The goal is not to build a perfect human. The goal is to design and verify a system in which one moment of pressure does not become one material compromise.

DeepStrike helps organizations validate social engineering exposure through authorized phishing simulations, vishing simulations, social engineering assessments, identity and MFA reviews, helpdesk workflow testing, payment workflow validation, red team assessments, continuous penetration testing, and remediation retesting.

Author Bio

Mohammed Khalil is a Cybersecurity Architect at DeepStrike with CISSP, OSCP, and OSWE credentials. His work focuses on adversary-informed validation across identity, application, cloud, and human-risk attack paths, translating technical exposure into executive decision support.

Source Methodology and Source List

This article prioritizes official or primary materials published or maintained by the originating organization: Verizon DBIR, FBI IC3, FTC data releases, Microsoft Digital Defense and incident-response reporting, Google Cloud and Mandiant threat intelligence, NIST guidance, CISA guidance, APWG quarterly reports, and IBM breach-cost research. Statistics were included only where a value was sourceable and attributable. Broader fraud or identity figures were labeled as context rather than treated as social-engineering-only telemetry.

Primary sources used in this article

• Verizon, 2024 Data Breach Investigations Report.
• Verizon, 2025 Data Breach Investigations Report search summary and 2026 DBIR report hub.
• APWG, Phishing Activity Trends Report Q1 2025, Q4 2025, and Q1 2026.
• FBI IC3, 2025 Internet Crime Report.
• FTC, 2025–2026 impersonation and text-scam releases.
• Microsoft, Digital Defense Report 2025, Cyber Signals Issue 9, and March 2026 Teams vishing incident report.
• Google Cloud and Mandiant, M-Trends 2026, Cloud Threat Horizons H2 2025, BlackFile vishing analysis, and related threat reporting.
• NIST, SP 800-115 and SP 800-63-4 / 63B-4.
• IBM, Cost of a Data Breach 2025 and related IBM research pages for context on impact.
• Google Search Central documentation for structured-data recommendations.