Phishing Statistics Updated November 2026

Human Written & Fact Checked · Updated

100 Phishing Statistics for 2026

A phishing website is not a victim, and a simulated click is not a confirmed breach. Those distinctions matter when you compare the scale of malicious infrastructure with the financial harm reported by people and organisations.

This hub separates observed phishing activity, organisational exposure, complaint losses and breach mechanisms. The sources use different collection methods; their statistics are evidence about those datasets, not components of a single global total.

Headline figures

  • Global APWG reporting network: APWG recorded 425,808 phishing websites in June (April–June 2026). (APWG, Aug 2026)
  • Global APWG reporting network: June contained 45,156 distinct phishing email campaigns (April–June 2026). (APWG, Aug 2026)
  • Global APWG reporting network: June phishing campaigns targeted 552 brands (April–June 2026). (APWG, Aug 2026)
  • UK: 38% of businesses identified phishing attacks (August–December 2025 fieldwork; prior 12 months for attacks). (UK DSIT and Home Office, Apr 2026)
  • UK: 25% of charities identified phishing attacks (August–December 2025 fieldwork; prior 12 months for attacks). (UK DSIT and Home Office, Apr 2026)
  • UK: 63% of large businesses identified phishing attacks (August–December 2025 fieldwork; prior 12 months for attacks). (UK DSIT and Home Office, Apr 2026)
  • FBI IC3 reporting population: IC3 recorded 191,561 phishing/spoofing complaints (2025). (FBI IC3, Apr 2026)
  • FBI IC3 reporting population: Phishing/spoofing complaints reported $215,843,126 in losses (2025). (FBI IC3, Apr 2026)
  • 17-country survey: Phishing was the reported root cause of 24% of ransomware attacks (January–March 2026 survey; prior 12 months). (Sophos, Jul 2026)
  • Global contributed corpus: Median mobile-vector simulation click success was 40% higher than email (November 2024–October 2025). (Verizon, May 2026)

Browse phishing statistics

How much phishing did APWG observe?

Attack infrastructure can grow without an equal rise in the number of victims. APWG's website and campaign measures track different parts of the attack chain, so a campaign count must not be labelled an email volume.

What did APWG record in April, May and January?

  • APWG recorded 325,934 phishing websites in April (April–June 2026). (APWG, Aug 2026)
  • APWG recorded 317,940 phishing websites in May (April–June 2026). (APWG, Aug 2026)
  • April contained 18,666 distinct phishing email campaigns (April–June 2026). (APWG, Aug 2026)
  • May contained 20,129 distinct phishing email campaigns (April–June 2026). (APWG, Aug 2026)
  • April phishing campaigns targeted 467 brands (April–June 2026). (APWG, Aug 2026)
  • May phishing campaigns targeted 512 brands (April–June 2026). (APWG, Aug 2026)
  • January: 320,264 reported phishing websites (January–March 2026). (APWG, May 2026)
  • January: 470 brands targeted (January–March 2026). (APWG, May 2026)

APWG reported phishing websites are not victims or successful compromises. Original APWG reporting repository; sites, email campaigns and brands are distinct metrics.

What did APWG record in February, March and October?

  • January: 16,165 distinct email campaigns (January–March 2026). (APWG, May 2026)
  • February: 329,625 reported phishing websites (January–March 2026). (APWG, May 2026)
  • February: 475 brands targeted (January–March 2026). (APWG, May 2026)
  • February: 14,790 distinct email campaigns (January–March 2026). (APWG, May 2026)
  • March: 321,292 reported phishing websites (January–March 2026). (APWG, May 2026)
  • March: 457 brands targeted (January–March 2026). (APWG, May 2026)
  • October: 269,558 reported phishing websites (October–December 2025). (APWG, Feb 2026)
  • October: 457 brands targeted (October–December 2025). (APWG, Feb 2026)

Original APWG reporting repository; sites, email campaigns and brands are distinct metrics.

What did late-year activity and quarterly brand counts show?

  • October: 16,284 distinct email campaigns (October–December 2025). (APWG, Feb 2026)
  • November: 287,995 reported phishing websites (October–December 2025). (APWG, Feb 2026)
  • November: 461 brands targeted (October–December 2025). (APWG, Feb 2026)
  • November: 14,980 distinct email campaigns (October–December 2025). (APWG, Feb 2026)
  • December: 295,691 reported phishing websites (October–December 2025). (APWG, Feb 2026)
  • December: 496 brands targeted (October–December 2025). (APWG, Feb 2026)
  • December: 14,091 distinct email campaigns (October–December 2025). (APWG, Feb 2026)
  • 766 distinct brands were targeted across the first quarter (January–March 2026). (APWG, May 2026)
  • 941 distinct brands were targeted across the second quarter (April–June 2026). (APWG, Aug 2026)

Original APWG reporting repository; sites, email campaigns and brands are distinct metrics. APWG reported phishing websites are not victims or successful compromises.

How common was phishing in UK organisations?

An organisation can recognise an attack without losing data or money. Exposure, disruption and successful cybercrime need separate denominators, particularly when comparing charities with businesses.

How did phishing exposure vary across UK organisations?

  • 51% of attacked businesses experienced phishing and no other attack type (August–December 2025 fieldwork; prior 12 months for attacks). (UK DSIT and Home Office, Apr 2026)
  • 57% of attacked charities experienced phishing and no other attack type (August–December 2025 fieldwork; prior 12 months for attacks). (UK DSIT and Home Office, Apr 2026)
  • 60% of medium businesses identified phishing attacks (August–December 2025 fieldwork; prior 12 months for attacks). (UK DSIT and Home Office, Apr 2026)
  • 50% of high-income charities identified phishing attacks (August–December 2025 fieldwork; prior 12 months for attacks). (UK DSIT and Home Office, Apr 2026)
  • 22% of businesses tested staff, for example through mock phishing (August–December 2025 fieldwork; prior 12 months for attacks). (UK DSIT and Home Office, Apr 2026)

Weighted organisational survey; attacks include unsuccessful attempts.

How did UK organisations describe phishing crime and disruption?

  • 18% of businesses experienced phishing cybercrime under the survey definition (August–December 2025 fieldwork; prior 12 months for attacks). (UK DSIT and Home Office, Apr 2026)
  • 13% of charities experienced phishing cybercrime under the survey definition (August–December 2025 fieldwork; prior 12 months for attacks). (UK DSIT and Home Office, Apr 2026)
  • 93% of businesses experiencing cybercrime experienced phishing cybercrime (August–December 2025 fieldwork; prior 12 months for attacks). (UK DSIT and Home Office, Apr 2026)
  • 69% of attacked businesses considered phishing their most disruptive attack (August–December 2025 fieldwork; prior 12 months for attacks). (UK DSIT and Home Office, Apr 2026)
  • 69% of attacked charities considered phishing their most disruptive attack (August–December 2025 fieldwork; prior 12 months for attacks). (UK DSIT and Home Office, Apr 2026)
  • 13% of charities tested staff, for example through mock phishing (August–December 2025 fieldwork; prior 12 months for attacks). (UK DSIT and Home Office, Apr 2026)

Weighted organisational survey; attacks include unsuccessful attempts.

How prepared were organisations to respond to fraudulent email?

  • 58% of businesses had a fraudulent-email-or-website response process (August–December 2025 fieldwork; prior 12 months for attacks). (UK DSIT and Home Office, Apr 2026)
  • 36% of charities had a fraudulent-email-or-website response process (August–December 2025 fieldwork; prior 12 months for attacks). (UK DSIT and Home Office, Apr 2026)
  • 94% of large businesses had an agreed fraudulent-email response process (August–December 2025 fieldwork; prior 12 months for attacks). (UK DSIT and Home Office, Apr 2026)
  • 40% of small businesses identified phishing attacks (August–December 2025 fieldwork; prior 12 months for attacks). (UK DSIT and Home Office, Apr 2026)
  • In the prior survey, 45% of attacked businesses experienced phishing alone (2024/2025 survey comparison). (UK DSIT and Home Office, Apr 2026)
  • In the prior survey, 46% of attacked charities experienced phishing alone (2024/2025 survey comparison). (UK DSIT and Home Office, Apr 2026)

Weighted organisational survey; attacks include unsuccessful attempts.

What losses appeared in phishing complaints?

Complaint losses show harm that was reported, not all harm caused by phishing. The agency's phishing/spoofing label also needs to travel with the number when it is quoted.

What phishing complaints and losses did younger age groups report?

  • People aged 17 or younger filed 878 phishing/spoofing complaints (2025). (FBI IC3, Apr 2026)
  • People aged 60+ filed 48,064 phishing/spoofing complaints (2025). (FBI IC3, Apr 2026)
  • Age under 20: 2,380 phishing/spoofing complaints (2025). (FBI IC3, Apr 2026)
  • Age under 20: $360,429 phishing/spoofing complaint losses (2025). (FBI IC3, Apr 2026)
  • Age 20–29: 19,765 phishing/spoofing complaints (2025). (FBI IC3, Apr 2026)
  • Age 20–29: $7,954,797 phishing/spoofing complaint losses (2025). (FBI IC3, Apr 2026)
  • Age 30–39: 27,433 phishing/spoofing complaints (2025). (FBI IC3, Apr 2026)
  • Age 30–39: $32,669,619 phishing/spoofing complaint losses (2025). (FBI IC3, Apr 2026)

Reports received by FBI IC3; not a prevalence estimate.

What did middle-aged, AI-linked and crypto-linked complaints show?

  • Age 40–49: 27,800 phishing/spoofing complaints (2025). (FBI IC3, Apr 2026)
  • Age 40–49: $33,063,856 phishing/spoofing complaint losses (2025). (FBI IC3, Apr 2026)
  • Age 50–59: 26,782 phishing/spoofing complaints (2025). (FBI IC3, Apr 2026)
  • Age 50–59: $30,918,367 phishing/spoofing complaint losses (2025). (FBI IC3, Apr 2026)
  • 803 phishing/spoofing complaints referenced AI (2025). (FBI IC3, Apr 2026)
  • AI-linked phishing/spoofing complaints reported $10,283,732 lost (2025). (FBI IC3, Apr 2026)
  • 7,164 phishing/spoofing complaints involved cryptocurrency (2025). (FBI IC3, Apr 2026)
  • Crypto-linked phishing/spoofing complaints reported $111,025,191 lost (2025). (FBI IC3, Apr 2026)

Reports received by FBI IC3; not a prevalence estimate.

How did older complainants and historical IC3 totals compare?

  • Under-18 phishing/spoofing complaints reported $77,852 lost (2025). (FBI IC3, Apr 2026)
  • Age 60+ phishing/spoofing complaints reported $77,020,936 lost (2025). (FBI IC3, Apr 2026)
  • In 2024, IC3 recorded 193,407 phishing/spoofing complaints. (FBI IC3, Apr 2026)
  • In 2024, phishing/spoofing complaint losses were $70,013,036. (FBI IC3, Apr 2026)
  • In 2024, people aged 60+ filed 23,252 phishing/spoofing complaints. (FBI IC3, Apr 2026)
  • In 2023, IC3 recorded 298,878 phishing/spoofing complaints. (FBI IC3, Apr 2026)
  • In 2023, phishing/spoofing complaint losses were $18,728,550. (FBI IC3, Apr 2026)
  • In 2023, people aged 60+ filed 2,856 phishing/spoofing complaints. (FBI IC3, Apr 2026)

Reports received by FBI IC3; not a prevalence estimate.

How does social engineering connect to ransomware and breaches?

Ransomware can start with deception, but the survey separates phishing from malicious email. Preserve those source categories instead of silently combining them into a universal phishing share.

How often was malicious email identified as the ransomware entry route?

  • Malicious email was the separate reported root cause of 26% of ransomware attacks (January–March 2026 survey; prior 12 months). (Sophos, Jul 2026)

This is a survey of organisations already hit by ransomware, not a survey estimating the risk faced by every organisation. The researchers distinguish malicious email from phishing in their root-cause question. Combining those categories without explaining the questionnaire would change the meaning of the estimate. Respondents described incidents experienced before the interview, so the publication year is not the incident year for every case. The result identifies a reported route into ransomware incidents; it does not measure the chance that an ordinary email will lead to encryption. This distinction is particularly important when comparing vendor surveys with incident-response datasets.

How common was the social-engineering breach pattern?

  • Social engineering represented 16% of breach patterns (November 2024–October 2025). (Verizon, May 2026)

The DBIR combines incidents contributed by participating organisations. Its percentages describe that contributed dataset, not a random sample of all businesses. A breach pattern and an action within a breach are different classification levels: they cannot be added as though they were mutually exclusive channels. The same incident can contain several actions. Treat these findings as evidence about mechanisms observed in confirmed cases, while keeping them separate from survey questions about attempted attacks or simulations that measure staff responses. Classification also counts for trends: a change in the contributed case mix can change a percentage without showing an equivalent change across the entire economy.

How often did pretexting and phishing appear in breaches?

  • Pretexting appeared in 6% of breaches (November 2024–October 2025). (Verizon, May 2026)
  • Phishing appeared in 16% of breaches (November 2024–October 2025). (Verizon, May 2026)

The DBIR combines incidents contributed by participating organisations. Its percentages describe that contributed dataset, not a random sample of all businesses. A breach pattern and an action within a breach are different classification levels: they cannot be added as though they were mutually exclusive channels. The same incident can contain several actions. Treat these findings as evidence about mechanisms observed in confirmed cases, while keeping them separate from survey questions about attempted attacks or simulations that measure staff responses. Action percentages can overlap because a single breach may involve both deception and another entry mechanism.

Which targets and channels attracted phishing?

Different monitoring systems observe different parts of phishing. Sector targeting, delivery channels and toolkit attribution can identify operational patterns, but their denominators must remain attached to the figures.

Which sectors appeared most often in observed phishing targets?

Original research by named APWG coauthor Crane Authentication; vendor-observed attacks, not global population.

What did channel growth and toolkit attribution reveal?

  • ecommerce/retail represented 5.2% of observed phishing targets (April–June 2026). (Crane Authentication / APWG, Aug 2026)
  • telecom represented 4.2% of observed phishing targets (April–June 2026). (Crane Authentication / APWG, Aug 2026)
  • Voice-phishing observations increased 20% quarter over quarter (April–June 2026). (Crane Authentication / APWG, Aug 2026)
  • SMS-phishing observations increased 40% quarter over quarter (April–June 2026). (Crane Authentication / APWG, Aug 2026)
  • Toolkits generated 29.2% of observed malicious emails (Q3 2026). (KnowBe4, Oct 2026)
  • Three leading toolkits generated 90.2% of attributed kit phishing (Q3 2026). (KnowBe4, Oct 2026)
  • Single-burst campaigns represented 20.7% of tracked operations (Q3 2026). (KnowBe4, Oct 2026)

Original research by named APWG coauthor Crane Authentication; vendor-observed attacks, not global population. KnowBe4 Defend telemetry, not a population sample. Release date verified in original Oct29 release; kit categories based on attributed attacks.

Which toolkits and operating models generated phishing volume?

  • Single-burst campaigns generated 2.2% of email volume (Q3 2026). (KnowBe4, Oct 2026)
  • Automated rented-toolkit campaigns represented 43.1% of operations (Q3 2026). (KnowBe4, Oct 2026)
  • Automated rented-toolkit campaigns generated 91.3% of toolkit phishing (Q3 2026). (KnowBe4, Oct 2026)
  • Sneaky2FA represented 41.4% of attributed kit phishing (Q3 2026). (KnowBe4, Oct 2026)
  • FlowerStorm represented 32.6% of attributed kit phishing (Q3 2026). (KnowBe4, Oct 2026)
  • ONNX Store represented 16.2% of attributed kit phishing (Q3 2026). (KnowBe4, Oct 2026)
  • Authentication phishing represented 2% of kit-origin link-based phishing (Q3 2026). (KnowBe4, Oct 2026)

KnowBe4 Defend telemetry, not a population sample. Release date verified in original Oct29 release; kit categories based on attributed attacks.

Glossary

IC3
FBI Internet Crime Complaint Center.
APWG
Anti-Phishing Working Group.

Methodology and sources

Every figure on this page comes from the organisation that produced it: regulators, statistics offices, public bodies, research institutes, and companies reporting their own data or surveys. Each one links to the original report or dataset and carries its release date. Survey results keep their population and fieldwork period, and financial figures keep the measure the producer used. Figures from different producers are not added together or ranked against each other. The page is reviewed monthly and updated when a producer releases newer data.