Phishing Statistics 2026: Global Attacks, Losses, AI & Trends

APWG Recorded 1.07 Million Phishing Attacks in Q2 2026

The Anti-Phishing Working Group recorded 1,069,681 phishing attacks in Q2 2026, a 10.1% increase from Q1.

June was the sharpest month of the latest quarter. APWG recorded 425,808 attacks in June 2026, compared with 317,940 in May and 325,934 in April. June was APWG’s highest monthly total since April 2023.

APWG also observed 83,951 unique phishing email campaigns in Q2 2026, compared with 35,583 in Q1. The number of brands observed increased from 467 in April to 512 in May and 552 in June, with 941 unique brands seen across the quarter.

APWG defines its main attack count around unique phishing sites derived from reported phishing URLs. A single phishing site can be promoted through many emails and URLs, so these values should not be described as email counts.

Microsoft Detected About 8.3 Billion Email-Based Phishing Threats in Q1 2026

Microsoft Threat Intelligence detected approximately 8.3 billion email-based phishing threats between January and March 2026.

Monthly volume declined slightly during the quarter, from approximately 2.9 billion in January to 2.6 billion in March. Microsoft also found that 78% of email threats were link-based, while QR-code phishing became the fastest-growing attack vector during the quarter and more than doubled.

This number is much larger than APWG’s because Microsoft is measuring email detections, not unique phishing websites.

Cofense Saw One Malicious Email Every 19 Seconds in 2025

Cofense’s Phishing Defense Center reported an average of one malicious email every 19 seconds throughout 2025. In 2024, its reported rate had been one every 42 seconds.

This is a useful operational trend inside the Cofense ecosystem, but it should not be converted into an estimate of all malicious email worldwide.

Not Every Dataset Shows Phishing Volume Increasing

Zscaler ThreatLabz reported that phishing activity in its telemetry declined by roughly 20% year over year, even as campaigns became more targeted and sophisticated.

The apparent disagreement with APWG and Cofense is useful rather than problematic. It indicates why “phishing increased X% globally” is usually too broad a claim. Different sensors see different parts of the ecosystem.

191,561 Phishing and Spoofing Complaints Were Reported in 2025

The FBI recorded 191,561 phishing/spoofing complaints in 2025, compared with 193,407 in 2024, a decrease of approximately 0.95%.

IC3’s phishing/spoofing category is broader than email. It includes unsolicited email, text messages, and telephone communications that impersonate legitimate organizations in an attempt to obtain personal, financial, or login information.

BEC Losses Exceeded $3 Billion in 2025

The approximately $123,005 figure is calculated by dividing total FBI-reported BEC losses by the number of complaints. It should not be described as an average fraudulent wire request because complaints can involve different BEC methods and outcomes.

APWG’s newer Q2 2026 telemetry indicates that BEC pressure continued to grow. Wire-transfer BEC attacks increased 88% quarter over quarter, while the average amount attackers attempted to steal rose 45% to $61,732.

For ransomware incidents where malicious email and phishing appear as root causes, see ScanTitan’s Ransomware Statistics 2026 research.

KnowBe4 Observed AI in 85.76% of Phishing Attacks in Its Latest Dataset

KnowBe4’s 2026 Phishing Threat Trends Report Volume Seven says 85.76% of attacks in its recent dataset were using artificial intelligence in some form. The report gives comparable figures of 84% in 2025 and 79.9% in 2024.

KnowBe4 also reported that 60.13% of phishing attempts contained a malicious hyperlink.

These are KnowBe4 telemetry statistics. They should be written as “KnowBe4 observed” rather than “85.76% of all phishing worldwide uses AI.”

An earlier March 2025 KnowBe4 dataset found AI characteristics in 82.6% of analyzed phishing emails, illustrating that percentages can vary even within the same vendor as methodology and reporting periods change.

FBI Recorded $893 Million in AI-Related Cybercrime Losses

The FBI’s 2025 data provides a different type of AI evidence: victim complaints rather than email telemetry.

The broader IBM 2026 Cost of a Data Breach study found AI-driven attacks increased 56% year over year. IBM’s result is not phishing-specific, however, and should be treated as evidence of wider AI-enabled attack growth rather than converted into a phishing growth rate.

Healthcare Had the Highest Baseline Susceptibility

The same three industries were the highest-risk categories in KnowBe4’s benchmarking for a second consecutive year.

Larger Organizations Showed Higher Baseline Simulation Risk

Organizations with fewer than 250 employees recorded a baseline Phish-prone Percentage of 24.7%, while organizations with more than 10,000 employees began at 39.5%.

Large healthcare organizations reached a baseline of 54% in KnowBe4’s dataset.

Again, these are simulation benchmarks—not the percentage of real cyberattacks that successfully compromise companies of each size, Phishing susceptibility is only one part of healthcare cyber risk. Our healthcare breach statistics research compares phishing with vulnerability exploitation, credential abuse, ransomware, unauthorized disclosure, and HHS OCR breach-reporting data without treating those measurements as interchangeable.

For wider SMB breach and threat data, see ScanTitan’s Small Business Cybersecurity Statistics.

United States

FBI IC3 reporting for 2025 recorded:

• 1,008,597 complaints across all IC3 cybercrime categories.
• $20.877 billion in total reported losses.
• 191,561 phishing/spoofing complaints.
• 24,768 BEC complaints.
• $3.0466 billion in BEC losses.
• 22,364 AI-related complaints.
• $893.35 million in AI-related losses.

Phishing Statistics Canada

The Canadian Anti-Fraud Centre received more than 112,000 fraud reports involving more than C$704 million in reported losses across all fraud categories in 2025.

Within that dataset, traditional phishing generated:

• 2,869 phishing reports.
• 467 recorded victims.

The CAFC classifies this phishing category primarily as solicitation for personal information and does not attach direct financial losses to it.

Spear phishing is reported separately and produced a much larger financial impact:

• 813 spear-phishing reports in 2025.
• 571 victims.
• C$67.9 million in reported losses.

By the first three months of 2026, Canadians had already reported nearly C$31 million in spear-phishing-related losses, according to the CAFC.

Phishing Statistics UK

The UK’s National Cyber Security Centre operates the Suspicious Email Reporting Service rather than publishing one national “phishing attack total.”

As of June 2026, the NCSC reported:

• More than 56.9 million scam reports since the reporting service began.
• 252,000 scams removed.
• Removals across approximately 448,000 URLs.

The NCSC’s 2025 Annual Review also reported more than 10.9 million Suspicious Email Reporting Service submissions during the year.

Its Takedown Service disrupted more than 26,000 phishing campaigns targeting UK government departments. Of confirmed phishing attacks targeting those departments, 79% were resolved within 24 hours and 50% within one hour.

Phishing Statistics Australia

Australia’s National Anti-Scam Centre reported A$2.18 billion in combined scam losses during 2025 across Scamwatch, ReportCyber, IDCARE, the Australian Financial Crimes Exchange, and ASIC.

Phishing was the fourth-largest scam type by reported loss, at A$97.6 million in 2025, compared with A$84.5 million in 2024.

The broader scam dataset recorded 481,523 reports in 2025, down 2.3% from 2024.

Email remained the most frequently reported contact method to Scamwatch, generating 84,861 reports. Only 4,329 of those reports involved reported financial loss, showing why message volume and financial harm should be tracked separately.

Text-message scam reports dropped sharply from 77,365 in 2024 to 29,058 in 2025, but reported losses through the channel increased from A$14.0 million to A$17.9 million.

Phishing Statistics Philippines

The Philippine Statistics Authority provides one of the clearest population-level measurements available for the country.

Among the 24.28 million Filipinos aged 10 and over who reported experiencing a cybersecurity incident in the relevant national survey:

• 57.1% experienced SMS fraud.
• 7.8% experienced hacking.
• 6.1% experienced phishing.
• 1.1% experienced cyberbullying or cyber libel.

BARMM recorded the highest phishing share among regions at 17.3%, followed by Region I at 14.5%.

Only 1.9% of people who experienced any cybersecurity incident reported the incident to authorities, which is an important limitation when comparing police or government complaint counts with survey-based exposure.

Are 3.4 Billion Phishing Emails Sent Every Day?

Do not present this as a current 2026 statistic.

The claim that 3.4 billion phishing emails are sent every day appears throughout phishing-statistics roundups, including current competitor pages. However, the number traces through older secondary estimates rather than a transparent 2025 or 2026 global phishing measurement.

For a current page, stronger replacements are:

• Microsoft detected approximately 8.3 billion email-based phishing threats in Q1 2026.
• APWG recorded 1,069,681 reported phishing attacks in Q2 2026.
• Cofense observed an average of one malicious email every 19 seconds during 2025 in its telemetry.

Is It True That 90% of Cyberattacks Start With Phishing?

No current major breach dataset reviewed here supports that as a universal claim.

Mandiant’s latest comparable data found exploitation at 33% of initial infection vectors, stolen credentials at 16%, and email phishing at 14%.

Verizon’s 2026 DBIR reports that software vulnerability exploitation reached 31% of breaches and became its leading breach-entry method.

Phishing remains an important initial-access and credential-acquisition vector, but “90% of cyberattacks start with phishing” should not be used as a current universal statistic.

What Percentage of Phishing Attacks Are Successful?

There is no credible universal phishing success percentage.

The denominator changes dramatically depending on whether researchers measure:

• Email opens.
• Link clicks.
• Credential submissions.
• Malware execution.
• Account takeover.
• Fraudulent payments.
• Confirmed breaches.
• Simulated-phishing failures.

KnowBe4’s 33.2% baseline Phish-prone Percentage is a useful simulation benchmark, but it is not evidence that 33.2% of criminal phishing attacks succeed.

Do Users Really Click Phishing Links in 21 Seconds?

The widely repeated 21-second click statistic is based on older behavioral research. It may still be useful as historical context, but it should not be labeled as a measured 2026 result.

For current mobile behavior, Verizon’s 2026 DBIR provides a better dated signal: phishing-related click rates were 40% higher on mobile devices.