Phishing Statistics 2026: Verified Figures and Sources

Phishing statistics 2026 from APWG, the FBI's IC3, Verizon's DBIR, Microsoft and the UK government, with each figure's source, period and what it measures.

Quick answer: APWG observed 1,069,681 phishing attacks in the second quarter of 2026, up 10.1% on the first quarter, and 3.8 million across 2025. The FBI's IC3 received 191,561 phishing and spoofing complaints in 2025, more than for any other crime type. Verizon's 2026 Data Breach Investigations Report found that phishing was the way in for 16% of breaches, and the UK government's latest survey found that 38% of businesses had experienced phishing in the past year.

Every number on this page comes from a named report that we checked, with the period it covers and a link to the source. Lists of phishing statistics often recycle old or unsourced figures, so where a number is easy to misread, we explain what it actually counts. For the basics of the attack itself, see what is phishing.

Phishing statistics 2026 at a glance

How many phishing attacks are there? APWG data

The Anti-Phishing Working Group (APWG) counts unique phishing sites reported by its member companies and the public. In its Phishing Activity Trends Report for Q2 2026, published on 28 August 2026, it recorded 1,069,681 attacks between April and June 2026, up 10.1% from 971,181 in the first quarter. June 2026 alone saw 425,808 attacks, the highest monthly total since April 2023.

APWG's Q4 2025 report puts the 2025 total at 3.8 million attacks, up slightly from 3.76 million in 2024. Quarterly volumes fell from 1,130,393 in Q2 2025 to 892,494 in Q3 and 853,244 in Q4, before rising again in 2026.

Which sectors and channels are targeted

According to APWG member Crane Authentication, SaaS and webmail services were the most attacked category in Q2 2026, with 29.1% of attacks, followed by payment services at 13.2%, financial institutions at 11.4%, logistics and shipping at 9.6%, social media at 8.5% and cryptocurrency at 7.2%. Telecom had been the top target in Q1 2026, at 33%, but fell to 4.2% in Q2. Crane also reported that smishing (phishing by SMS) rose 40% and vishing (voice phishing) 20% from Q1 to Q2 2026.

The same report's hosting breakdown put Cloudflare in front of 34% of phishing sites in Q2 2026, ahead of every other provider. That matters for takedowns, because the CDN hides the real host; our guide to taking down a phishing site behind Cloudflare explains the route. Business email compromise is rising as well: APWG member Fortra counted 88% more wire transfer BEC attacks in Q2 2026 than in the previous quarter, with the average amount requested up 45% to $61,732.

Complaints and losses: FBI IC3 2025

The FBI's 2025 Internet Crime Report, which covers complaints filed with its Internet Crime Complaint Center during 2025, gives the clearest view of what phishing costs victims in the United States.

• Phishing and spoofing was again the most reported crime type, with 191,561 complaints, compared with 193,407 in 2024.
• Reported losses in that category were $215.8 million.
• Across all crime types, IC3 received 1,008,597 complaints and $20.877 billion in reported losses, a 26% rise in losses from 2024.
• Business email compromise caused $3.05 billion in reported losses from 24,768 complaints.
• Complaints involving cryptocurrency reached 181,565, with $11.366 billion in losses.

The phishing loss figure looks small next to the total partly because phishing is often only the first step. A phishing email that leads to a fraudulent wire transfer may be reported as business email compromise, and a fake investment site found through a text message as investment fraud.

Breaches: Verizon DBIR 2026

Verizon's 2026 Data Breach Investigations Report analysed more than 31,000 security incidents, including more than 22,000 confirmed data breaches, in 145 countries. Its main findings on phishing and social engineering:

• Phishing was the initial access vector in 16% of breaches with a known vector, the same share as the previous year.
• Pretexting, where an attacker builds a false scenario, often over the phone, reached 6%.
• Exploitation of vulnerabilities became the most common way in, at 31%, while credential abuse, the previous leader, fell to 13%.
• The human element was present in 62% of breaches, up from 60%.
• In phishing simulations, the median click rate for mobile-centric lures such as voice and text messages was 40% higher than for email.

Microsoft, Google and the UK government

• Microsoft: the Microsoft Digital Defense Report 2026, covering July 2025 to June 2026, found that adversary-in-the-middle phishing, which captures session cookies in real time to get past multi-factor authentication, made up 44.6% of identified phishing techniques, against 33.6% for standard phishing links and 12.9% for attachments. Microsoft Defender for Office 365 detected more than 145 million QR code phishing attacks in the same period. Our glossary entry on AiTM phishing explains how these attacks work.
• Google: Google says its Safe Browsing service helps protect more than five billion devices every day, which is why getting a phishing site onto that blocklist is one of the fastest ways to cut off its traffic.
• UK government: the Cyber Security Breaches Survey 2025/2026, published by the Department for Science, Innovation and Technology with fieldwork from August to December 2025, found that 43% of UK businesses and 28% of charities identified a breach or attack in the previous 12 months. Phishing was by far the most common type, experienced by 38% of businesses and 25% of charities.

How to read and use phishing statistics

• Check what is counted. APWG counts unique phishing sites, IC3 counts complaints, Verizon counts breaches, and Microsoft reports its own telemetry. The numbers can't be added together or compared directly.
• Check the period. A report published in 2026 usually describes 2025 data. Quote the period, not only the publication year.
• Assume undercounting. Each source sees only what is reported to it or what its own products detect. APWG notes that some email systems now stop users forwarding phishing emails to it, which reduces its reports.
• Go to the original. If a statistic has no named report and period, don't repeat it.

For security and brand teams, the practical message of 2026's numbers is that phishing has spread beyond email to SMS, voice, QR codes and fake sites that impersonate trusted brands, including crypto platforms (see wallet drainer scams and how to tell if a crypto exchange is legit). Speed is what limits the damage from a live phishing site, and our article on how long it takes to take down a phishing site covers realistic timelines. Phishvoid finds and takes down sites that impersonate your brand, with a human team verifying each one before it is reported.

FAQ

How many phishing attacks happen each year?

APWG recorded 3.8 million phishing attacks, meaning unique phishing sites reported to it, in 2025, up slightly from 3.76 million in 2024. The real number is higher, because APWG only counts what its members and the public report.

What percentage of breaches start with phishing?

Verizon's 2026 DBIR found that phishing was the initial access vector in 16% of breaches with a known vector, unchanged from the year before. Pretexting accounted for a further 6%.

How much money is lost to phishing?

The FBI's IC3 recorded $215.8 million in reported losses under phishing and spoofing in 2025. Phishing also leads into other crimes, such as business email compromise, which caused $3.05 billion in reported losses, so its full cost is likely higher than the category figure suggests.

Which industries are most targeted by phishing in 2026?

In APWG's Q2 2026 report, SaaS and webmail services were the most targeted category at 29.1% of attacks, followed by payment services at 13.2% and financial institutions at 11.4%. Telecom led in Q1 2026 with 33% before falling sharply.