Phishing Statistics 2026: Latest Enterprise Trends and Impact

Key Phishing Statistics

• APWG observed 3.8 million phishing “attacks” in 2025, slightly above 3.76 million in 2024.
• Q4 2025 phishing attacks totaled 853,244, down 4% from Q3 (peak Q2).
• In late 2025, APWG data showed social media and SaaS/webmail among the most targeted categories.
• FBI IC3’s latest (2024) report shows 193,407 phishing/spoofing complaints and 21,442 BEC complaints, with $2.77B in BEC losses. Phishing/spoofing was the most frequent complaint category in 2024.
• Microsoft reports screening ~5 billion emails per day for threats. In mid‑2025, the Tycoon 2FA phishing‑as‑a‑service operation generated ~62% of Microsoft-blocked phishing (over 30 million emails in one month).
• Microsoft’s data emphasize AI as a force-multiplier: e.g., AI-crafted phishing lures have shown markedly higher user engagement in tests.
• Fortra/APWG observed wire-transfer BEC attempts surge in Q4 2025 (up 136% QoQ), with an average requested amount of ~$50,297; gift cards remained the dominant cash-out (59%).
• Training-platform data (Sep’24–Feb’25) show phishing simulation emails up ~17% vs prior period, and 57.9% of BEC simulations came from compromised accounts.
• IBM/Ponemon finds phishing‑related breaches take ~261 days to identify and contain, highlighting long internal cost cycles even when fraud is averted.

For 2026 enterprise planning, phishing remains a core risk driver. Latest data reinforce that email-based social engineering is at industrial scale and closely tied to identity and financial crime. In 2025, the Anti-Phishing Working Group (APWG) recorded 3.8 million unique phishing attack sites worldwide, exceeding 2024’s 3.76 million. At the same time, the FBI’s 2024 Internet Crime Report (used for 2026 threat modeling) shows $2.77 billion in U.S. business email compromise (BEC) losses. This juxtaposition of very high ‘volume’ metrics and multi-billion dollar ‘loss’ metrics highlights two key roles of phishing: as an identity compromise mechanism (credential/MFA theft leading to account takeover) and as a fraud mechanism (payment redirection, invoice scams). Phishing remains a common initial access mechanism in ransomware, account-compromise, and data-theft incident chains.

Phishing is multifaceted in 2026 terms: it includes credential and token phishing (for cloud logins and MFA bypass), executive/vendor impersonation (invoice or payroll fraud), malicious URLs and attachments (for malware delivery or browser-based payloads), and even multi‑channel lures (SMS, voice, collaboration platforms, QR codes). The operational impact crosses technical and business domains: each click could seed malware, hijack identities, or facilitate wire fraud. Our analysis uses the latest available 2025 data (APWG, Microsoft telemetry, IC3 complaints) to illuminate these dynamics for security and risk decision-making.

Definition Block

Phishing Statistics refer to quantified data about phishing activity, including campaign volume, delivery methods, victim interaction, credential theft, business email compromise, financial losses, industry targeting, regional variation, and broader changes in social-engineering attack patterns.

What Do Phishing Statistics Measure?

Phishing statistics should never be collapsed into one undifferentiated number. Each metric reflects a distinct measurement model:

• Campaign volume counts how many unique phishing operations or URLs are detected (often from IR or report feeds). This signals “pressure” (attacker activity level), not a count of messages delivered.
• Email/message volume measures total emails delivered or blocked (usually from security platforms). This depends on provider footprint and is not the same as count of victims targeted.
• Victim interaction rate (clicks, form submissions, etc.) is usually measured in training simulations or product telemetry. These tell us about user susceptibility under specific conditions, not global success rates.
• Credential harvesting measures successful capture of login credentials or tokens (observed via malware analysis or phishing kit takedowns). It shows which breaches yielded access.
• Financial loss measures actual fraud outcome (wire transfer losses, gift card spend) from complaint data or investigations. This is the confirmed harm, not attack volume.
• Reported complaints reflect how many victims came forward (IC3, police reports, CERTs). Underreporting is common, so complaints are “confirmed harm signals.”
• Training simulations offer KPIs for security programs (failure vs reporting rates), not actual attack prevalence.

For example: an organization might get 10,000 phishing emails in a week. The email gateway blocks 99%, 100 reach inboxes, 10 users click (10% click rate), and 1 user submits credentials (1% of clicks). If incident response then immediately resets that account and no funds are lost, the enterprise impact is “near miss” despite actual credential harvest. This illustrates why we don’t conflate email volume (10,000) with loss ($0) and need separate metrics for campaign count, victim actions, and business outcome.

Methodology note: This article uses the latest credible data (primarily 2024–2025 reports and telemetry) for 2026 planning. Platform telemetry (APWG, Microsoft) and complaint/loss data (IC3) are reported with clear scope. We explicitly distinguish “pressure” signals (attack volume) from “harm” signals (losses) and warn that platform scans are not global counts, just the provider’s view.

Global or Regional Overview

Phishing attacks remain at persistently high volume: APWG’s 2025 total (3.8M) is more a durability signal than a surge. Even a 4% Q4 drop (989K→853K) is within normal ebb and flow. No quarter in 2025 fell below Q4 2024 levels, indicating continuous industrialized campaign rotation rather than intermittent quiet.

Sector shares reveal shifting attacker ROI. In late 2024, SaaS/webmail was ~23% of lures; by Q4 2025, social media and SaaS/webmail each ~20% while telecom/IT jumped (18.7%). Attackers appear to be increasingly leveraging phone-based account recovery and messaging apps, consistent with rising SMS/BEC tactics.

Complaint and loss data must be interpreted as partial sightlines. FBI IC3 received 193,407 phishing/spoofing complaints in 2024, and $2.77B in BEC losses. Those are confirmed U.S. figures (mostly business reporting) and do not capture global volume or unreported impact. For enterprises, the key is to see these as confirmed harm floor values. The FBI notes phishing/spoofing was the top complaint category in 2024, highlighting phishing’s prominence in reported fraud.

Methodology context: APWG data are built from member and public reports of phishing URLs. IC3 data come from public complaints (self-selected victims). Microsoft data are telemetry from its cloud and email platforms and should not be treated as global totals; they reflect Microsoft’s visibility and customer footprint rather than universal prevalence. Verizon DBIR data (used below) reflect vetted breach incidents with human involvement. Each dataset is granular to its scope, so we keep them separate when drawing conclusions.

Cost and Business Impact of Phishing

The business cost narrative is that clicks alone have no fixed price tag impact comes from what follows. IC3’s latest data show multi‑billion-dollar BEC losses remain steady, underscoring that even isolated successful social-engineering breaches yield outsized losses. However, a ~6% drop in reported BEC losses year-over-year doesn’t imply a massive security gain; it could reflect any number of factors (improved internal checks, slower reporting, or just statistical variance). Importantly, the “loss” figures should be viewed as confirmed transfers or payments, not total enterprise impact: legal, reputational, and recovery costs can vastly exceed the stolen amount.

Phishing/spoofing losses remain far below BEC in absolute dollar terms, but the 2024 increase (+274%) should be interpreted cautiously because complaint totals can be influenced by a small number of large cases, reporting behavior, and classification changes. A prudent approach is to treat these loss numbers as a lower bound on actual fraud: many victims never report or detect such crimes, especially in unregulated sectors. Thus, phishing telemetry = pressure signal, while complaint/loss data = confirmed harm signal.

Non-fraud costs dominate internal impact. IBM’s data breach report shows that phishing-related incidents still take ~261 days to identify and contain (the longest of any vector), meaning hundreds of person-hours in forensics and business disruption. Those “hidden costs” (IT overtime, downtime, lost productivity, brand damage) often dwarf direct fraud loss.

Finally, remember: a million phishing emails (volume) is not equivalent to $X in loss. Our perspective keeps campaign volume, email clicks, credential theft, and actual loss clearly separated. Each must be weighed on its own: campaign counts and email volume for risk exposure, training stats for user susceptibility, and complaint/loss figures for quantified damage. These metrics drive different budget and control decisions.

Major Phishing Categories

Credential Phishing

Credential phishing is the mass delivery of fake login interfaces or SSO/OAuth lures to harvest passwords, tokens, or session cookies. It remains a leading path to corporate access because many account-takeover incidents still begin with stolen credentials, captured session material, or consent abuse. Attackers have shifted focus to cloud identity flows (Azure AD, Okta, Google Workspace) since those are gateway to email, files, and privileged accounts. Modern tactics include adversary-in-the-middle phishing-as-a-service (where users enter credentials and then real-time OTPs, yielding live sessions) and OAuth consent phishing (tricking users into granting malicious apps broad permissions).

Why it matters: Once an attacker has a valid credential or token, they can move laterally, exfiltrate data, or initiate fraud under the guise of a legitimate user. In 2025, Microsoft observed that identity-based attacks spiked (up 32% in H1 2025) as adversaries weaponized AI and token flows. MFA and phishing-resistant factors can dramatically reduce this risk (MFA blocks over 99% of identity-based compromises), but only if implemented and monitored properly.

Business Email Compromise

Business Email Compromise (BEC) is a targeted subset of phishing focused on financial fraud. Attackers impersonate a trusted executive or supplier and manipulate payment processes (invoice fraud, payroll diversion, vendor account changes). Though BEC email volumes are far lower than mass phishing, the stakes are high: IC3 data show BEC as the top source of phishing-related losses ($2.77B in 2024).

Operationally, BEC attacks usually chain initial access (often via phishing, account takeover, or replay of legitimate reply-chains) to action. For example, APWG/Fortra reported that wire-transfer BEC requests jumped 136% in Q4 2025, even as average requested amounts (~$50.3K) remained modest. Gift cards, wire transfers, and payroll remain the primary cash-out methods (59%, 17%, 8% respectively in Q4 2025).

Why it matters: BEC attacks exploit process trust. A single successful email can bypass automated controls (it looks like a business email) and authorize payments. For decision-makers, the implication is that strong multi-step verification is needed in finance processes (e.g. call-back verification of any payment change). Preventing phishing alone (e.g. email filters) catches only part of BEC risk; the rest lies in catching anomalies in approval workflows.

Attachment and Link-Based Phishing

Traditional phishing lures use malicious links and attachments to infect endpoints or steal credentials. Link-based lures (URLs pointing to fake login pages) dominated global phishing in 2025, and APWG notes that most phishing emails include multiple URLs (to evade simple URL filtering). These links lead victims to credential harvesters or drive-by downloads.

Attachment-based phishing (malicious Office docs, PDFs, or HTML smuggling payloads) is still widely used, especially to install malware or drop ransomware. Phishing attachments have become more elaborate (password-protected archives, embedded executables) and often fool users in urgent contexts. Training simulations indicate attachments produce higher failure rates than plain links, which matches real incident patterns: when users think “document” rather than “link,” they tend to bypass simple hover checks.

Why it matters: If a link or attachment bypasses email defenses, it can directly install malware (credential loggers, ransomware) or redirect to a login page. Defenders must assume any clicked link or opened attachment could be malicious. The enterprise response should include endpoint protection (sandboxing attachments), link analysis (time-of-click scanning), and user habits training. It also means “blocking phishing” requires more than blocking URLs in mail; it involves network and endpoint monitoring.

Collaboration, SMS, and Multi-Channel Phishing

Phishing increasingly spans beyond email. Attackers use SMS (smishing) to deliver malicious links (bypassing email gateways), voice calls (vishing) to trick helpdesk or reset MFA, and chat/collaboration (Teams, Slack) to abuse internal trust. APWG reported rising smishing volumes in late 2025, noting SMS was used to deliver credential phishing and MFA bypass lures.

Collaboration platforms are prized because they innately authenticate the sender and often lack phishing controls. Simulated attacks confirm this trend: a sizable share of training campaigns now target Teams/Slack with malicious links or files, resulting in notable user clicks.

Why it matters: Phishing cannot be labeled an “email only” problem. Any channel where users click unvetted content is at risk. Security teams must extend protection and user training to mobile devices, messaging apps, and telephony. For example, enabling “report phishing” in Teams/Slack and enforcing SMS security policies (block known malicious SMS providers) help close off these auxiliary channels.

Phishing Delivery and Initial Access Methods

Most successful phishing-based breaches are multi-step. A typical chain: the adversary sends an initial email (or SMS/chat) that abuses trust (e.g. a brand logo or a known contact). Once a victim clicks or enters credentials, attackers hijack accounts or mailboxes (setting inbox rules or forwarding). This allows them to circulate further phish within the organization or reach high-value targets internally. Successful phish often conclude in financial theft, data exfiltration, or ransomware deployment.

Mapping to MITRE ATT&CK: Initial phishing aligns to T1566 (Phishing) with sub-techniques (URLs, attachments). Post-compromise access often uses T1078 (Valid Accounts) and T1098 (Account Manipulation) as attackers use stolen credentials. Financial exfiltration might involve T1110 (Brute Force), T1114 (Email Collection), and T1485 (Data Destruction) in ransomware cases.

Industry Breakdown

Verizon DBIR 2025 highlights that social engineering is a top breach pattern in finance, retail, and tech sectors (around 16-22% of breaches as initial access). Technology firms see larger blast radii from single compromised identities, while finance and retail suffer direct theft. Healthcare and government endure extended disruptions: even thwarted phish can trigger hours of investigation that delay care or public services. In practice, industries with stringent identity and payment controls tend to contain phishing better, whereas sectors reliant on third-party communications (manufacturing, retail, supply chain) see higher impact per successful phish.

Regional Breakdown

In the absence of a global phishing registry, regional patterns come from mixed sources: complaint volume (strongest in US), macro breach studies (Verizon’s DBIR), and provider telemetry (Microsoft, Google). Verizon’s regional analysis shows social engineering consistently among top breach causes in Europe, APAC, and globally. The US stands out by having robust reporting via IC3 (hence the $2.77B BEC loss in 2024). Europe’s regulatory environment yields detailed incident disclosures, often highlighting phishing-based intrusions in finance and healthcare. APAC’s outsourcing economies see frequent supplier BEC attacks, although aggregate statistics are sparse. In all regions, third-party phish (via partners or vendors) and cloud identity breaches are major cross-border risks.

Major Phishing Incidents or Case Examples in 2025 and Early 2026

• Hospitality (Booking.com): In late 2024–early 2025, attackers (tracked as “Storm-1865”) impersonated Booking.com to target hotels and travel firms. They used a novel “ClickFix” social-engineering trick that prompted users to paste malicious commands, delivering credential-stealing malware. Impact: Several global hotel chains and booking agents were phished, with credentials and payment info at risk. Strategic lesson: Attackers exploited the urgency of guest bookings; organizations must validate any out-of-band login requests or unusual workflow errors.
• Global BEC Gang (Scripted Sparrow): Fortra reported in Q4 2025 that a BEC syndicate (Scripted Sparrow) was behind a 136% spike in wire-transfer phish attempts. This group, operating since mid-2024, sent ~6 million targeted BEC emails per month (spoofed reply-chain for fake invoices). Impact: AP accounting teams worldwide faced floods of invoice scams. Strategic lesson: Even a high-volume BEC campaign can look mundane (“invoice” theme) yet can still net millions if process controls fail, which underscores the need for robust vendor authentication.
• OAuth/MFA Phishing Service (Tycoon 2FA): In early 2026, Microsoft, Europol, and partners dismantled the Tycoon 2FA phishing-as-service network. By mid-2025, Microsoft reported that Tycoon 2FA accounted for roughly 62% of the phishing volume it blocked, including more than 30 million fraudulent emails in a month. It specialized in bypassing MFA by capturing session tokens. Impact: Tens of thousands of organizations (notably healthcare and education) faced account takeovers and operational disruption. Strategic lesson: Cutting-edge phishing (AI-driven, MFA-bypass) can propagate at internet scale. Collaboration between providers and law enforcement was essential to disrupt it illustrating that defensive architectures (e.g. phishing-resistant MFA) must be paired with cross-sector threat intelligence.

Each of these cases was documented by security research (Microsoft, Fortra, APWG) rather than media leaks. They underline the shift: credential theft and account compromise (Tycoon 2FA) or process abuse (BEC gang) are core concerns, not just high-volume email spam.

Emerging Phishing Trends

• AI-enhanced Phishing: Both attackers and defenders now use AI. Microsoft reports AI-generated phishing emails are appearing at scale, with some experiments showing AI-lures yielding far higher engagement (e.g., 54% vs 12% click-through in a side-by-side test). Attackers use AI to write realistic phishing content and even to orchestrate multi-step campaigns. The implication: static filters (blocklists, simple pattern matching) are less effective; defenders need behavior-based detections (login anomalies, unusual requests).
• Polymorphic, Multi-vector Campaigns: Attackers employ programmatic variation and multiple channels. A 2025 phishing trends report (KnowBe4) found that a large share of phish emails were polymorphic (randomized subject lines, sender addresses, payloads) to evade signature detection. AI can accelerate this polymorphism. Additionally, many campaigns now combine email, SMS, QR codes, and voice. Countermeasure: detection engineering must emphasize time-of-click scanning, DMARC alignment, and anomaly detection on accounts.
• OAuth & Device-Code Phishing: As traditional password theft becomes harder, attackers increasingly exploit OAuth and device-code flows. Microsoft notes novel attacks combining device-code OAuth phishing with session hijacking, effectively granting system access without a password. These allow an attacker to get valid refresh tokens. Organization implication: tighten app consent processes, monitor for unusual tokens, and educate users on OAuth consent dialogs.
• QR Code and Mobile Phishing: APWG observed that QR code phishing is a growing sidestep of email defenses. While one report noted a slight decline in QR scans in late 2025, attack experiments (via KnowBe4) show many phishers now include QR images or SMS links. Mobile phishing often leads directly to credential pages or banking scams. Defense: include mobile in phishing simulations, use MTD (mobile threat detection) and require user training on QR caution. (Note: KnowBe4 data on QR usage is simulation-based.)
• Continuous Smishing and Vishing: Financial scams via SMS/voice are spiking. Recent threat analyses highlight hundreds of millions of malicious SMS (often with login links or one-time codes) and upswing in automated voice calls impersonating executives. These are typically out of email’s reach. Enterprises should require verification of any financial or IT request received via SMS/phone by alternate known channels.
• Business-Fraud Workflow Refinement: Attacker persistence on BEC is evident. Reports from late 2025 show continued reliance on free webmail, spoofed domains, and refined scare tactics (fake urgent requests, lookalike domains). Despite these old methods, the sheer volume of attempts has grown (via botnets and services like Tycoon 2FA). The CFO takeaway: human approval processes and multi-channel verification must be as strong as technical email filters.

Phishing vs Business Email Compromise vs Broader Social Engineering

What These Phishing Statistics Mean

These data points guide practical decisions:

• Identity and Authentication Controls: The identity-based attack surge and success of Tycoon 2FA show that traditional passwords are too weak. Deploy phishing-resistant MFA (hardware tokens, certificates) and enforce conditional access. Monitor for anomalous token issuances (OAuth consents, device-code grants). Microsoft's research confirms passwordless/MFA can stop ~99% of account takeovers. In short, invest in strong authentication as top priority.
• Email Security and Detection: High phishing volume and polymorphic campaigns mean gateway filters and sandboxing must be up-to-date with behavior analysis. Use time-of-click URL re-checking and attachment detonation. Enable DMARC with reject to limit domain spoofing. Leverage Microsoft’s recommended email routing controls and anti-spoofing policies that were highlighted in the Tycoon 2FA disruption case. Post-delivery, monitor for suspicious forwarding rules or automation that often follow mailbox compromise.
• Financial and Payment Verification: BEC stats reinforce that business processes are attack targets. Enforce out-of-band verification (e.g. phone verification of payment requests), dual-approval for large transfers, and strict vendor/account change procedures. The repeat finding that 59% of BEC cash-outs are gift cards and 17% wires suggests training accounts payable to distrust gift card requests, and IT to flag new “wire transfer” patterns. Integrating anomaly detection in ERP/finance (e.g. geofencing wire transfers) is crucial.
• Third-Party and Supply Chain Risk: Phishing statistics and broader breach reporting both show that trusted third-party relationships can expand attack paths, especially in supplier impersonation and mailbox-compromise scenarios. Vet supplier email security (SPF/DKIM/DMARC), restrict partners’ mailbox privileges, and confirm any external requests for changes through independent channels. Encourage vendors to also harden their defenses, as their compromise can cascade to you.
• User Reporting and Behavior Metrics: Acknowledge that training simulations show reporting rates well below failure rates. Focus on making “Report Phish” easy (one-click in email client, for example) and tracking reporting metrics as security KPIs. Higher reporting correlates with earlier detection; encourage a culture where users treat potential phish as actionable intelligence.
• Detection Engineering and IR: Use these statistics to calibrate alerts. For example, knowing that internal phishing is common, set alerts on mass emails sent from unusual accounts or sudden Out-of-Office rule creation. Knowing BEC volume can jump, ensure IR has procedures for financial incident response (quickly freezing accounts, coordinating with banks). Document these stats in board reports: phishing pressure (APWG volumes) + proven harm (IC3 losses) justify ongoing investment.
• Budgeting and Risk Modeling: The multi-year trends feed cyber risk quantification. Expected Loss = Probability × Impact. Based on APWG volumes (pressure) and IC3/IBM cost signals (impact), derive scenario-driven models. For instance, if a CFO mailbox compromise is assessed at 2% per year probability with $300K impact (fraud+cleanup), annual expected loss is $6K. Decision-makers use such models to compare controls (e.g. MFA rollout reduces that probability to 0.1%, saving ~$5.4K in expectation). Use the latest phishing stats as external benchmarks: if your incident rate or losses exceed sector medians, that is a red flag warranting more investment.

Best Practices to Reduce Phishing Risk

• Phishing-Resistant MFA and Identity Verification: Adopt hardware tokens or certificate-based MFA. Microsoft's data underscores that traditional SMS/email OTP is phishable; phishing-resistant methods (FIDO2, certificate) dramatically cut successful account compromise. Implement conditional access policies: require risk-based step-up on anomalies (e.g. new location). Since token theft is rising, have processes to immediately revoke tokens/sessions when anomalies appear.
• Secure Email Gateway Enhancements: Deploy comprehensive email security with real-time scanning. Important controls include: strict DMARC with quarantine/reject (to block domain spoofing), safe link rewriting (time-of-click URL analysis), attachment sandboxing, and impersonation protection (detect display-name vs. address mismatches). Microsoft’s guidance notes that attackers exploit SPF/DKIM gaps and routing quirks, so remove legacy forwarding that bypasses filters and require inbound mail to pass anti-spoof checks.
• Payment and Request Verification: For all payment-related communications, enforce dual-control: verify changes via phone or face-to-face using known contacts. IC3 advises never to act on an email payment instruction without out-of-band verification. Maintain callback-verification logs for payment-change requests and automatically flag new payees, bank-detail changes, and urgent exception workflows. On payroll, require multiple sign-offs for direct deposit changes. These controls remove BEC’s easy victimhood.
• User Awareness and Reporting Mechanisms: Train users on the current threats (e.g., the Tycoon 2FA style of MFA bait, QR codes, social media scams). Emphasize reporting: implement one-click phishing report in Outlook/Teams, and ensure IT responds quickly to reported phish (to close loops). Gamified training and simulated phish help, but use them to measure weak spots, not to estimate real-world risk. Ensure phishing simulation metrics are dissected by difficulty and feature (e.g. link vs attachment, source type).
• Browser and Session Protections: Since many phishing outcomes involve web sessions, use browser isolation or secure browsers for email links. Set short session timeouts and geofencing rules on important systems. Anti-phishing browser extensions can add warnings on suspicious sites. For OAuth-based threats, strictly govern app registrations: require admin consent for high-scope apps and monitor logs for unusual OAuth grants.
• Third-Party Risk Controls: Assume partner compromise is a vector. Insist that suppliers follow strict email auth practices. Use vendor management tools to track third-party phishing incidents. Monitor for lookalike domains of key vendors (via external scanning) and require contractual assurances of partner cyber hygiene. Implement measures like "verified vendor list" where payments only go to pre-vetted accounts.
• Regular Security Validation: Perform regular, sophisticated penetration tests and adversary emulation exercises that mimic these phishing workflows: e.g. simulate Tycoon-like MFA bypass, scripted Sparrow BEC emails, or QR phishing. After each exercise, measure not just user falls, but detectability (time to notice malicious activity) and containment speed. Use the latest threat intel (as in this article) to shape the scenarios.

Risk Modeling Phishing and Expected Loss

Expected Loss = Probability × Impact.

Accurate modeling requires mapping phishing stats to these terms. For probability, use measures of exposure and defense gaps: e.g. proportion of spam still getting through, user click rates, and observed successful spearphish incidents (internal logs). For impact, use known loss amounts (IC3 BEC figures or in-house incident cost data) plus downtime figures.

Illustrative example (hypothetical): an organization estimates a 5% annual chance that one of its payroll officers will be targeted successfully by a sophisticated BEC email (based on sector trends). If an average fraud event costs $100,000 in transferred funds and $50,000 in remediation, then Expected Loss = 0.05 * $150,000 = $7,500 per year. They then consider an MFA project costing $100,000 that might cut that probability to 1% (new EL = $1,500). With a $6,000 annual risk reduction, the MFA investment could be justified in about 17 years likely too long. But if they instead focus on adding a strict vendor-verification step (cost $10K) that cuts probability to 0.5% (EL = $750), then the payback is much faster.

The point: phishing stats (attack volumes, success rates, loss sizes) feed into this model. External statistics calibrate the estimates (are you below or above industry norms?). For example, if your board knows IC3’s multi-billion-dollar BEC loss floor, even a small modeled probability yields a significant risk number. The key is to avoid “just hoping it won’t happen”; use data to quantify your specific expected loss scenario.

FAQs

• What are phishing statistics?

Measured data about phishing activity such as number of phishing campaigns detected, email volumes, user click rates, credential submissions, reported BEC cases, and loss amounts always within a defined scope (telemetry, simulation, complaints). Phishing stats are context-specific indicators (telemetry = pressure; losses = confirmed harm).

• How common are phishing attacks?

Extremely common in telemetry. APWG recorded 3.8 million distinct phishing attack sites in 2025, indicating industry-scale automation. A more accessible lens: IC3 saw phishing/spoofing as the #1 complaint category in 2024. So while many individual phishes go unreported, both threat feeds and complaints signal that phishing is very frequent.

• What industries face the most phishing risk?

Any industry with email and payments is targeted. Recent data highlight finance and e-commerce (transaction targets), technology (cloud identities), and healthcare (high-value data) as high-risk sectors. APWG consistently finds SaaS/webmail and social platforms heavily targeted, which implicates tech and higher-ed as well. Verizon’s breach reports show social engineering as a leading breach pattern in finance and retail. In short, focus on high-identity/high-finance sectors, but don’t overlook smaller sectors: attackers exploit trust everywhere.

• How does phishing relate to business email compromise?

Phishing is the broader category of trust-based attacks. BEC is a specialized subset of phishing aimed specifically at defrauding companies through invoice/payment scams. In practice, most BEC schemes start with phishing or account takeover (to gain a foothold) and then proceed to impersonate a CEO or supplier to get money.

• How much do phishing attacks cost organizations?

Costs vary widely. IC3 reports billions in BEC losses, but that’s the tip of the iceberg. For individual companies, a successful phishing incident can mean hundreds of thousands in direct loss plus far more in investigation, system lockdowns, and brand impact. IBM’s breach report shows phishing-related breaches incur multimillion-dollar impact on average (due to detection and remediation).

• How do phishing attacks lead to ransomware or other fraud?

Phishing often provides initial access (e.g. stolen login or malware drop). Attackers then use that access for follow-on attacks: lateral movement to plant ransomware, internal phishing to broaden access, or direct BEC to drain funds. For instance, a phished admin credential might let attackers deploy crypto-lockers, while a compromised CFO email might be used to approve a fake invoice payment.

• How can organizations reduce phishing risk?

By layering defenses. Key measures: phishing-resistant MFA, strict email authentication (DMARC/SPF/DKIM), secure email gateways with real-time link scanning, anomaly detection in email systems (for spoofing or hidden forwarding), and robust financial process controls. Regular user training and easy phish reporting also cut dwell time.

• Are phishing-related losses underreported?

Yes. Complaint data capture only cases where victims come forward. Many companies secretly absorb losses (especially BEC) or never realize smaller steals. Surveys indicate a significant portion of organizations never report cyber fraud, and some losses (like account-takeover attempts) are mitigated internally without formal complaint. Thus, IC3’s figures represent just the known minimum.

Phishing data for 2026 planning reinforce key truths: phishing is a persistent, evolving identity/finance problem, not just spam. APWG’s multi-million attack count signals unrelenting attacker pressure. IC3’s BEC losses remind us of the confirmed harm at stake. Microsoft and IBM metrics reveal new scales (AI-enhanced lures, multi-month breach timelines). Decision-makers must therefore treat phishing statistics as multi-faceted risk signals. The data underscore that effective defense is both identity-centric (strong authentication, token monitoring) and process-centric (payment verification, vendor checks), augmented by continuous testing. In short, phishing isn’t confined to email alone; it is an enterprise risk loop from compromised identity to fraud. Organizations should use these statistics to guide a layered strategy: tighten identity and email defenses, validate financial workflows, conduct aggressive simulation and pen testing, and detect and report phishing quickly. The raw numbers of emails or clicks matter only insofar as they drive those concrete controls and investment priorities.

About the Author

Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements for Fortune 500 companies, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.