Phishing Statistics Updated November 2026

Human Written & Fact Checked · Updated

100 Email Phishing and Fraud Statistics for 2026

A phishing email is not the same measurement unit as a phishing website, a campaign or a fraud complaint. This page separates those units so you can compare evidence without accidentally converting a security vendor's detections into a count of victims.

The first sections examine reported campaigns and Microsoft's email telemetry. Later sections describe Fortra's business-email fraud observations and the FBI's reported business email compromise losses. Those fraud categories provide related email-attack context; they are not interchangeable with credential phishing or counts of malicious messages. Each observation retains its producer and publication date.

Headline figures

  • APWG recorded 45,156 unique phishing email campaigns, distinguished by subject line in June 2026. (APWG, Aug 2026)
  • APWG identified 941 unique targeted brands across Q2 2026. (APWG, Aug 2026)
  • Nearly 85% of phishing emails reported to Microsoft carried an impersonation signal in April–June 2026. (Microsoft, Oct 2026)
  • One in four impersonation emails pushed the recipient toward a phone call. (Microsoft, Oct 2026)
  • Microsoft detected more than 145 million QR-code phishing attacks during its reporting year. (Microsoft, Oct 2026)
  • By June 2026, Tycoon2FA activity was down 95% from its November 2025 peak. (Microsoft, Oct 2026)
  • Fortra's observed BEC attack volume increased 88% from the preceding quarter in Q2 2026. (Fortra, in APWG, Aug 2026)
  • Wire transfers represented 17% of Fortra's observed BEC cashout methods in Q2 2026. (Fortra, in APWG, Aug 2026)
  • IC3 recorded 24,768 BEC complaints in 2025. (FBI IC3, Apr 2026)
  • IC3 recorded $3,046,598,558 in reported BEC losses in 2025. (FBI IC3, Apr 2026)
  • IC3 recorded 4,566 BEC complaints with reported age 60 and older in 2025. (FBI IC3, Apr 2026)
  • BEC complaints with reported age 40–49 recorded $624,292,591 in losses in 2025. (FBI IC3, Apr 2026)

How much email-derived phishing activity was reported?

APWG's reporting stream measures observed activity instead of all messages sent. Its definitions separate normalized phishing destinations, distinct email subject lines and targeted brands.

How many phishing destinations appeared in email reports?

  • APWG recorded 320,264 unique phishing websites reported from email-derived URLs in January 2026. (APWG, May 2026)
  • APWG recorded 329,625 unique phishing websites reported from email-derived URLs in February 2026. (APWG, May 2026)
  • APWG recorded 321,292 unique phishing websites reported from email-derived URLs in March 2026. (APWG, May 2026)
  • APWG recorded 325,934 unique phishing websites reported from email-derived URLs in April 2026. (APWG, Aug 2026)
  • APWG recorded 317,940 unique phishing websites reported from email-derived URLs in May 2026. (APWG, Aug 2026)
  • APWG recorded 425,808 unique phishing websites reported from email-derived URLs in June 2026. (APWG, Aug 2026)

APWG counts unique website bases extracted from phishing URLs reported through email. A single site can be promoted through many customized links and messages. The following monthly destination counts therefore describe reported infrastructure, not the number of recipients, delivered emails or successful compromises.

How many distinct email campaigns were reported?

  • APWG recorded 16,165 unique phishing email campaigns, distinguished by subject line in January 2026. (APWG, May 2026)
  • APWG recorded 14,790 unique phishing email campaigns, distinguished by subject line in February 2026. (APWG, May 2026)
  • APWG recorded 18,666 unique phishing email campaigns, distinguished by subject line in April 2026. (APWG, Aug 2026)
  • APWG recorded 20,129 unique phishing email campaigns, distinguished by subject line in May 2026. (APWG, Aug 2026)
  • APWG reported 81,710 phishing email campaigns for Q3 2025. (APWG, Aug 2026)
  • APWG reported 35,583 phishing email campaigns for Q1 2026. (APWG, Aug 2026)
  • APWG reported 83,951 phishing email campaigns for Q2 2026. (APWG, Aug 2026)

The campaign metric distinguishes subject lines instead of individual messages. Monthly and quarterly counts describe different periods and should not be added together. Reporting also depends on whether mail systems allow users to forward suspicious messages to APWG, which can change the visibility of campaigns independently of attacker activity.

How widely did campaigns spread across targeted brands?

  • APWG recorded 470 brands targeted in submitted phishing reports in January 2026. (APWG, May 2026)
  • APWG recorded 475 brands targeted in submitted phishing reports in February 2026. (APWG, May 2026)
  • APWG recorded 457 brands targeted in submitted phishing reports in March 2026. (APWG, May 2026)
  • APWG recorded 467 brands targeted in submitted phishing reports in April 2026. (APWG, Aug 2026)
  • APWG recorded 512 brands targeted in submitted phishing reports in May 2026. (APWG, Aug 2026)
  • APWG recorded 552 brands targeted in submitted phishing reports in June 2026. (APWG, Aug 2026)
  • APWG identified 766 unique targeted brands across Q1 2026. (APWG, May 2026)
  • Half of APWG's targeted brands were attacked five times or fewer during Q2 2026. (APWG, Aug 2026)

Brand counts describe normalized names in submitted phishing reports. They are not counts of breached companies, and a brand can recur across months. The quarterly figure and the low-frequency observation describe another view of the same reporting stream, so neither should be treated as an additional victim population.

How do phishing emails borrow trusted identities?

Familiar-looking communication can conceal very different attack goals. Microsoft separates credential phishing from business contact impersonation, where a conversation is opened to persuade the target to act under false pretenses.

Which visual and thematic signals did Microsoft observe?

  • Microsoft reported image or logo mimicry in 32% of the phishing attacks it described. (Microsoft, Oct 2026)
  • More than one-third of attacks used template-based lures mimicking familiar brand communications. (Microsoft, Oct 2026)
  • 44% of targeted brands in Microsoft's analysis were lesser-known or location-specific. (Microsoft, Oct 2026)
  • Automated-notification themes appeared in 80% of Microsoft's impersonation attacks. (Microsoft, Oct 2026)
  • Financial-fraud themes appeared in 61% of Microsoft's impersonation attacks. (Microsoft, Oct 2026)

Microsoft describes impersonation through both recognizable branding and familiar communication templates. These categories can overlap: a message can use a logo, resemble an automated notice and carry a financial theme. Brand-level percentages also use a different denominator from message-level observations, so the figures should not be summed into a combined impersonation rate.

How do organizational context and delivery formats appear?

  • Around 25% of attacks mimicked an organization's operating environment or someone inside it. (Microsoft, Oct 2026)
  • HR, payroll and benefits scams represented 77% of those organization-mimicry cases. (Microsoft, Oct 2026)
  • Trusted-collaborator impersonation represented about 3% of spear-phishing activity in Microsoft's analysis. (Microsoft, Oct 2026)
  • Attachments appeared in 30% of Microsoft's described impersonation-delivery cases. (Microsoft, Oct 2026)
  • QR codes appeared in 13% of those impersonation-delivery cases. (Microsoft, Oct 2026)
  • HTML-based payloads appeared in 5% of those impersonation-delivery cases. (Microsoft, Oct 2026)

The analysis distinguishes messages mimicking an internal organization from those borrowing a collaborator's identity. The conditional organizational-case percentage below applies only to that subset. Delivery observations concern the described impersonation cases, instead of every phishing email Microsoft processed, and they do not establish which format was most successful at deceiving recipients.

What is distinctive about business contact impersonation?

  • Microsoft detected more than 46 million business contact impersonation attacks over its reporting year. (Microsoft, Oct 2026)
  • Microsoft reported a 121% BCI-volume surge in April 2026. (Microsoft, Oct 2026)
  • Explicit financial or document requests appeared in 17% of initial BCI messages in October 2025. (Microsoft, Oct 2026)
  • That initial-message request share was 3% in June 2026. (Microsoft, Oct 2026)
  • 51% of observed payroll-diversion attacks arrived on Mondays or Tuesdays. (Microsoft, Oct 2026)

Microsoft's BCI category concerns deceptive business conversations and deliberately excludes credential phishing and account takeover. Its first-message observations show how little explicit fraud content may appear at the beginning. These detections should therefore not be read as confirmed compromises or added to the FBI's complaint counts.

How do attachments and phishing services move recipients toward compromise?

Delivery format is a route into the attack, not a reliable description of its final goal. Microsoft's observations show credential-theft experiences behind ordinary files, QR codes and verification pages.

How did QR-code and CAPTCHA delivery formats change?

  • PDF attachments carried 79% of QR-code phishing attacks by April 2026. (Microsoft, Oct 2026)
  • Microsoft detected more than 100 million CAPTCHA-gated phishing attacks during its reporting year. (Microsoft, Oct 2026)
  • Embedded URLs delivered 58% of CAPTCHA-gated phishing attacks in August 2025. (Microsoft, Oct 2026)
  • SVG files delivered 47% of CAPTCHA-gated phishing attacks in November 2025. (Microsoft, Oct 2026)
  • PDFs delivered nearly two-thirds of CAPTCHA-gated phishing attacks by April 2026. (Microsoft, Oct 2026)
  • Tycoon2FA accounted for 9% of CAPTCHA-gated phishing activity in July 2025. (Microsoft, Oct 2026)
  • Tycoon2FA's CAPTCHA-gated share reached 76% in December 2025. (Microsoft, Oct 2026)
  • Tycoon2FA's CAPTCHA-gated share fell to 12% by June 2026. (Microsoft, Oct 2026)

These percentages have separate QR-code and CAPTCHA-gated denominators. Tycoon2FA shares refer only to the latter category here. They describe detected delivery patterns, not the proportion of all email that was malicious.

What did malicious email attachments lead to?

  • Across months, 89–96% of detected malicious attachments led toward credential-theft experiences. (Microsoft, Oct 2026)
  • HTML was the leading malicious-attachment format in 10 months of Microsoft's reporting year. (Microsoft, Oct 2026)
  • Malicious PDF-attachment volume increased 38% in February 2026. (Microsoft, Oct 2026)
  • Malicious PDF-attachment volume increased another 50% in March 2026. (Microsoft, Oct 2026)
  • SVG files represented 23% of malicious attachments in July 2025. (Microsoft, Oct 2026)
  • SVG's malicious-attachment share was 7% by June 2026. (Microsoft, Oct 2026)
  • DOC/DOCX files peaked at 17% of malicious attachments in December 2025. (Microsoft, Oct 2026)

The attachment analysis concerns files Microsoft identified as malicious, not ordinary workplace attachments. Its monthly range summarizes credential-theft destinations, while format shares and volume changes use their own denominators. A rise in one file type's volume is not the same as a rise in its share of all detected attachments.

What happened to Tycoon2FA-linked email activity?

  • Tycoon2FA-linked fraudulent emails reached over 500,000 organizations per month during 2025. (Microsoft, Oct 2026)
  • Tycoon2FA was linked to more than 15.1 million malicious emails monthly in the second half of 2025. (Microsoft, Oct 2026)
  • Tycoon2FA phishing-email volume fell 15% in March 2026. (Microsoft, Oct 2026)
  • Tycoon2FA phishing-email volume fell a further 22% in April 2026. (Microsoft, Oct 2026)

Microsoft tracked a phishing-service ecosystem instead of an individual campaign. Organizational reach, message volume and month-to-month changes are separate measures. The platform supplied hosting infrastructure and templates, while customers sent the emails; a decline after disruption does not mean that every previously delivered message disappeared or every exposed organization avoided harm. The changes describe this service instead of the whole phishing ecosystem.

What infrastructure and payment requests appeared in email fraud?

Fortra's contribution describes observed BEC operations, not all activity at a registrar or payment provider. The distribution shows where sampled abuse appeared without measuring a provider's underlying abuse rate.

Which payment mechanisms were requested?

  • Payroll diversion represented 10% of Fortra's observed BEC cashout methods in Q2 2026. (Fortra, in APWG, Aug 2026)
  • Interac represented 9% of Fortra's observed BEC cashout methods in Q2 2026. (Fortra, in APWG, Aug 2026)
  • Cryptocurrency represented 6% of Fortra's observed BEC cashout methods in Q2 2026. (Fortra, in APWG, Aug 2026)
  • Other methods represented 3% of Fortra's observed BEC cashout methods in Q2 2026. (Fortra, in APWG, Aug 2026)

The source separates payment and diversion mechanisms used in observed BEC scams. These percentages describe method frequency, not the share of financial losses routed through each mechanism. Some categories also reflect regional targeting, so the distribution should not be generalized to every country or every type of phishing email.

Which registrars appeared most often in the sampled domains?

  • NameCheap accounted for 16% of registrars in Fortra's observed BEC-domain sample in Q2 2026. (Fortra, in APWG, Aug 2026)
  • NameSilo accounted for 12% of registrars in Fortra's observed BEC-domain sample in Q2 2026. (Fortra, in APWG, Aug 2026)
  • Dynadot accounted for 11% of registrars in Fortra's observed BEC-domain sample in Q2 2026. (Fortra, in APWG, Aug 2026)
  • Porkbun accounted for 9% of registrars in Fortra's observed BEC-domain sample in Q2 2026. (Fortra, in APWG, Aug 2026)
  • Squarespace accounted for 9% of registrars in Fortra's observed BEC-domain sample in Q2 2026. (Fortra, in APWG, Aug 2026)

Fortra grouped observed BEC domains by registrar. The following shares do not divide malicious domains by all domains registered with each company. A larger provider can appear more often for reasons of scale, and these observations alone cannot compare the quality of registrar security or abuse response.

What does the rest of the registrar distribution show?

  • Hostinger accounted for 7% of registrars in Fortra's observed BEC-domain sample in Q2 2026. (Fortra, in APWG, Aug 2026)
  • Spaceship accounted for 7% of registrars in Fortra's observed BEC-domain sample in Q2 2026. (Fortra, in APWG, Aug 2026)
  • Name.com accounted for 3% of registrars in Fortra's observed BEC-domain sample in Q2 2026. (Fortra, in APWG, Aug 2026)
  • DENIC accounted for 3% of registrars in Fortra's observed BEC-domain sample in Q2 2026. (Fortra, in APWG, Aug 2026)
  • other registrars accounted for 23% of registrars in Fortra's observed BEC-domain sample in Q2 2026. (Fortra, in APWG, Aug 2026)

The remaining categories broaden the infrastructure picture beyond the largest named shares. The residual category groups other registrars together and should not be interpreted as a single provider. These observations describe the sampled domains used in email-fraud operations, not a blacklist of domains or a finding that ordinary customers are malicious.

What financial harm was reported from business email compromise?

An IC3 complaint is a report of suspected crime, not an email detection. BEC losses describe reported financial harm linked to that crime category, and underreporting limits any claim about the full scale of loss.

How do earlier annual BEC totals compare?

  • IC3 recorded 21,489 BEC complaints in 2023. (FBI IC3, Apr 2026)
  • IC3 recorded $2,946,830,270 in reported BEC losses in 2023. (FBI IC3, Apr 2026)
  • IC3 recorded 21,442 BEC complaints in 2024. (FBI IC3, Apr 2026)
  • IC3 recorded $2,770,151,146 in reported BEC losses in 2024. (FBI IC3, Apr 2026)

The historical totals provide context for the current-year observations in the takeaways. Complaint counts and dollar losses measure different outcomes and should remain separate. A change in one cannot establish the number of messages sent, the number of attempted attacks or a typical victim's loss without additional analysis. Comparisons should retain the same reporting-system boundary across years; independent vendor telemetry cannot fill unreported complaints or be a compatible denominator.

Which BEC complaints also involved AI or cryptocurrency?

  • IC3 recorded 135 AI-related BEC complaints in 2025. (FBI IC3, Apr 2026)
  • AI-related BEC complaints reported $30,256,592 in losses in 2025. (FBI IC3, Apr 2026)
  • IC3 recorded 1,526 cryptocurrency-related BEC complaints in 2025. (FBI IC3, Apr 2026)
  • Cryptocurrency-related BEC complaints reported $83,771,329 in losses in 2025. (FBI IC3, Apr 2026)

IC3's descriptors identify subsets of BEC complaints instead of new, mutually exclusive crime categories. An incident may carry more than one descriptor, so these values should not be added to estimate a larger unique population. They also do not reveal whether an email itself was generated by AI or whether cryptocurrency was the initial contact channel. The descriptor totals therefore remain nested observations within the broader complaint category.

How do BEC reports vary by reported age?

Age-attributed reports can describe who appears in the complaint data, but they do not measure susceptibility. Missing age information and different population sizes prevent interpreting raw counts as age-specific risk rates.

Which age groups appeared in BEC complaint counts?

  • IC3 recorded 73 BEC complaints with reported age under 20 in 2025. (FBI IC3, Apr 2026)
  • IC3 recorded 1,250 BEC complaints with reported age 20–29 in 2025. (FBI IC3, Apr 2026)
  • IC3 recorded 3,619 BEC complaints with reported age 30–39 in 2025. (FBI IC3, Apr 2026)
  • IC3 recorded 5,090 BEC complaints with reported age 40–49 in 2025. (FBI IC3, Apr 2026)
  • IC3 recorded 4,910 BEC complaints with reported age 50–59 in 2025. (FBI IC3, Apr 2026)

The following counts use the age reported in IC3 complaints. They are not the age of the targeted business, and they do not establish how many people in each age group received fraudulent email. Respondents with missing age information cannot be assigned to these rows, so summing the displayed groups does not reproduce every national total.

What do age-attributed losses and the older-adult comparison show?

  • BEC complaints with reported age 20–29 recorded $45,754,756 in losses in 2025. (FBI IC3, Apr 2026)
  • BEC complaints with reported age 30–39 recorded $356,707,180 in losses in 2025. (FBI IC3, Apr 2026)
  • BEC complaints with reported age 50–59 recorded $618,105,890 in losses in 2025. (FBI IC3, Apr 2026)
  • BEC complaints with reported age 60 and older recorded $568,048,472 in losses in 2025. (FBI IC3, Apr 2026)
  • IC3 recorded 3,300 BEC complaints involving people aged 60 and older in 2024. (FBI IC3, Apr 2026)

Reported losses describe financial harm linked to age-attributed BEC complaints, not an average loss for everyone of that age. The historical older-adult count adds a separate time comparison. It should not be combined with current-year complaints, and the dollar figures do not establish how often people encountered or recognized a phishing message.

Glossary

Methodology and sources

Every figure on this page comes from the organisation that produced it: regulators, statistics offices, public bodies, research institutes, and companies reporting their own data or surveys. Each one links to the original report or dataset and carries its release date. Survey results keep their population and fieldwork period, and financial figures keep the measure the producer used. Figures from different producers are not added together or ranked against each other. The page is reviewed monthly and updated when a producer releases newer data.