Phishing statistics for 2026, with sources

Phishing numbers get repeated so often that many lose their source along the way. Every figure on this page comes from a primary report we downloaded and checked, with the report year shown. Data is as of October 9, 2026; where a newer report replaces one of these, we'll update the table and the date.

How to read these statistics

The three main sources measure different things, so their numbers aren't directly comparable.

• FBI IC3 counts complaints that victims chose to report in the US, and the losses they reported. It undercounts: many victims never report.
• APWG counts unique phishing websites reported to it by members and the public. One site may sit behind thousands of emails.
• Verizon DBIR analyzes confirmed security incidents and breaches shared by its contributors. It shows how breaches happen, not how much phishing is sent.

Keep the source and year next to any number you reuse.

What do the FBI's 2025 figures show?

The FBI's 2025 IC3 Annual Report covers complaints received in calendar year 2025.

Two points stand out. Phishing complaints were flat, but reported phishing losses roughly tripled. And BEC was the second-largest loss category among cyber-enabled fraud, behind investment fraud at $8,648,617,756. The IC3 defines BEC as a scam that targets businesses or people who regularly make wire transfers, carried out by "compromising email accounts and other forms of communication". Our BEC prevention guide covers the defenses.

How has phishing changed over three years?

The IC3 report includes a three-year comparison, which shows a shift from volume to value.

Fewer people reported phishing in 2025 than in 2023, yet reported phishing losses grew more than tenfold over the same period. BEC complaints and losses both rose in 2025, after flat complaints and lower losses in 2024. Reporting habits change too, so treat these as trends in what victims report, not exact measures of attack volume.

How many phishing attacks does APWG see?

The Anti-Phishing Working Group publishes a quarterly Phishing Activity Trends Report. APWG counts unique phishing sites, which it also calls attacks.

APWG also notes a measurement problem: mail systems sometimes stop users forwarding phishing emails to APWG "because the mail systems perceive those emails as harmful," which reduces the number of reports it receives. Treat quarter-to-quarter swings in reported email campaigns with care.

The SaaS/webmail share matters for every business: a stolen email password opens everything else. Our guide to signs an email account is compromised helps you spot it early.

What does the Verizon 2026 DBIR say about phishing?

Verizon's 2026 Data Breach Investigations Report analyzed more than 22,000 confirmed data breaches.

The DBIR is careful to note limits. On phishing simulations it says the phone-centric sample sizes are small. It also says email "is still the preferred attack vector for the majority of Social Engineering breaches." If you run simulations, our guide to security awareness training explains how to use click rates without misreading them.

How many domains are still easy to spoof?

Phishing often borrows a real brand's domain. DMARC at an enforcing policy lets receivers reject mail that fakes your exact domain. In our own scan of the Tranco top 1,000 domains, run on October 9, 2026, 38.3% did not enforce DMARC: 26.5% had no DMARC record at all, and almost all of the rest used a monitoring-only p=none policy. This is our own research, not a government statistic, and it covers large, popular domains only.

CISA, NSA, FBI and MS-ISAC jointly recommend setting DMARC to "reject" for mail you send, and enabling DMARC checks on mail you receive (CISA phishing guidance). Check your own domain with the DMARC Checker.

What do these numbers mean for a small business?

Read together, the sources point the same way:

1. Phishing is constant, and payment fraud is where the money goes. BEC losses dwarf direct phishing losses in the IC3 data. Verify any change to bank details by phone, using a number you already have. See vendor invoice fraud.
2. Email accounts are the prize. SaaS and webmail logins were the top APWG target in Q2 2026. Turn on multifactor authentication for every mailbox.
3. Phishing isn't only email. Smishing and voice attacks are growing, and the DBIR found higher click rates on phone-centric lures. Train staff for all channels.
4. Filtering and authentication still do heavy lifting. Gateways block large volumes of plain phishing before anyone sees it, and DMARC stops exact-domain spoofing.

Which phishing statistics should you be careful with?

Some figures circulate widely without a clear primary source. A common example is the claim that more than 90% of cyberattacks start with a phishing email. It is often attributed to government agencies, but we could not find it in a current primary report we could check, so it isn't on this page.

Before you reuse any statistic:

• Find the original report, not a blog post quoting a blog post.
• Check the year and the population. "Breaches" in the DBIR, "complaints" at the IC3 and "attacks" at APWG are different things.
• Check who supplied the data. Several APWG figures come from named member companies, which we've labeled in the table.
• Don't add or average across sources. Their methods differ.

Where can you find the original reports?

• FBI IC3 annual reports: ic3.gov. The 2025 report is the latest full-year edition at the time of writing.
• APWG trends reports: Q2 2026, Q1 2026, Q4 2025.
• Verizon DBIR: verizon.com.

When you quote a figure, link the report and give its year. Avoid round numbers that circulate without a source.

Next steps

1. Check whether your own domain can be spoofed with the DMARC Checker, and create a record with the DMARC Generator if needed.
2. Put a payment verification rule in writing, and train staff on it.
3. Review how phishing reaches your inboxes today. Our guide to how spam filters work explains the layers, and iBlockSpam is one option for filtering at the MX level.

More on current threats is in our phishing and threats guides.