Phishing Statistics Guide: Volumes, Click Rates and Credential Theft Trends

Phishing is still the most common way attackers reach people and credentials, but most published "phishing statistics" are recycled numbers with no traceable source. This page collects phishing figures only from the organisations that produce the data: the FBI Internet Crime Complaint Center (IC3), the UK Department for Science, Innovation and Technology (DSIT) Cyber Security Breaches Survey, the Anti-Phishing Working Group (APWG), the Verizon Data Breach Investigations Report (DBIR), Microsoft and the UK National Cyber Security Centre (NCSC). Every figure names its report, publisher and as-of year in the same sentence or table row, and each source is a recurring publication so the page can be refreshed when new editions appear. It is written for security leaders building a business case, awareness and email security teams setting targets, and analysts who need a number they can defend. Last reviewed: October 2026.

Key takeaways

• Phishing tops complaint counts, not losses. In the FBI IC3 Internet Crime Report 2025, phishing/spoofing was the most reported crime type with 191,561 complaints, yet its directly reported losses ($215.8 million) were small next to business email compromise ($3.05 billion) and investment fraud ($8.65 billion), which phishing often enables.
• Most UK breaches are phishing. The DSIT Cyber Security Breaches Survey 2025/2026 found 38% of UK businesses and 25% of charities experienced phishing in the previous 12 months, and phishing was the most disruptive breach for 69% of those that identified a breach or attack.
• Volumes are rising again. The APWG Phishing Activity Trends Report for Q2 2026 counted 1,069,681 phishing attacks, up 10.1% on Q1 2026, with June 2026 the busiest month since April 2023.
• Phishing is a steady, not shrinking, breach vector. The Verizon 2026 DBIR attributes 16% of breaches to phishing as the initial access vector, unchanged from the previous year, with a further 6% starting with pretexting.
• Channels are moving off email. APWG reported smishing up 40% and vishing up 20% from Q1 to Q2 2026, the 2026 DBIR found mobile vectors draw a 40% higher median click rate than email in simulations, and Microsoft detected more than 145 million QR code phishing attacks between July 2025 and June 2026.

Headline statistics

The table gives the single most useful figure from each primary source. Use the source and year exactly as written: these reports measure different things (complaints, survey responses, observed sites, confirmed breaches) and the numbers are not interchangeable.

Statistics by theme

Each theme below lists the figure, the report it comes from, and the period it covers. Where a source gives a previous-year figure, it is included so the direction of travel is visible without mixing sources.

Volume of phishing activity

• Observed attacks: The APWG Phishing Activity Trends Report, 2nd Quarter 2026 (published 28 August 2026) recorded 1,069,681 phishing attacks, a 10.1% increase on the 971,181 observed in Q1 2026. Monthly counts were 325,934 in April, 317,940 in May and 425,808 in June 2026, which APWG noted was the highest monthly total since April 2023.
• Email campaigns: The same APWG Q2 2026 report counted 83,951 unique phishing email campaigns, up from 35,583 in Q1 2026, with June 2026 alone accounting for 45,156.
• Brands impersonated: APWG Q2 2026 recorded 941 unique brands targeted across the quarter, rising each month from 467 in April to 552 in June.
• Email screened: The Microsoft Digital Defense Report 2026 states that Microsoft screens an average of 5.2 billion emails a day for malware and phishing, which gives a sense of the filtering scale at a single large provider.
• Complaints to law enforcement: The FBI IC3 Internet Crime Report 2025 recorded 191,561 phishing/spoofing complaints in 2025, against 193,407 in 2024, a fall of about 1%. Phishing/spoofing remained the top crime type by complaint count, ahead of extortion (89,129) and investment fraud (72,984).

Who is targeted

Source for the table: APWG Phishing Activity Trends Report, 2nd Quarter 2026. The jump in SaaS and webmail targeting matters for identity teams: these lures are built to harvest the credentials and session tokens that unlock email, file storage and federated applications. See the AiTM Phishing Guide.

• UK organisations by size: The DSIT Cyber Security Breaches Survey 2025/2026 found that 43% of UK businesses (about 612,000) and 28% of charities identified a breach or attack in the previous 12 months. Prevalence rose with size: 42% of micro businesses, 46% of small, 65% of medium and 69% of large businesses. Phishing was experienced by 38% of all businesses and 25% of charities.
• Phishing only: In the same 2025/2026 survey, among organisations that identified a breach or attack, the share that experienced phishing and nothing else rose to 51% of businesses (from 45% the year before) and 57% of charities (from 46%).
• Impersonation: DSIT's 2025/2026 survey found 12% of businesses and 7% of charities were targeted by impersonation of the organisation in emails or online, down from earlier editions.

Phishing as a breach vector

• Dataset size: The Verizon 2026 Data Breach Investigations Report analysed more than 31,000 incidents, of which more than 22,000 were confirmed breaches, across 145 countries, covering 1 November 2024 to 31 October 2025.
• Human element and social engineering: The 2026 DBIR found the human element in 62% of breaches (60% in the previous edition, a change Verizon says is within its error margins) and placed social engineering as the third most common breach pattern at 16% of breaches.
• Credentials across the attack chain: Verizon's 2026 DBIR reports that credential abuse appears in 39% of breaches when every stage of the attack is counted, not only initial access. Phishing is a major supplier of those credentials.
• Credential theft after access: The Microsoft Digital Defense Report 2026 found that 52.2% of intrusions using valid accounts involved follow-on credential theft, which is why a single phished account rarely stays a single compromised account.

Channels beyond email: SMS, voice, QR codes and social media

• Smishing and vishing growth: APWG's Q2 2026 report recorded a 40% rise in smishing and a 20% rise in vishing compared with Q1 2026. APWG did not publish absolute counts for these channels. See the Vishing and Smishing Guide.
• Mobile click rates: The Verizon 2026 DBIR, using phishing simulation data, found the median successful click rate for mobile vectors such as voice and text messages was 40% higher than for email. Verizon gave the relative difference, not an absolute click rate.
• QR code phishing: The Microsoft Digital Defense Report 2026 states that Microsoft Defender for Office 365 detected more than 145 million QR code phishing attacks between July 2025 and June 2026. See the QR Code Phishing (Quishing) Guide.
• Business contact impersonation: Microsoft's 2026 report detected more than 46 million attacks impersonating business contacts in the previous 12 months, the pattern that underpins invoice fraud and business email compromise.
• Social media: APWG's Q2 2026 report found impersonation was the largest category of social media threat at 32.7% of cases, ahead of scams, piracy and unauthorised logo use.

The Twilio breach of 2022 shows why the SMS trend matters: texts posing as IT sent staff to fake sign-in pages that relayed passwords and one-time codes to the attackers in real time, and the wider campaign targeted more than 130 organisations.

Losses and harm

• Direct phishing losses: The FBI IC3 Internet Crime Report 2025 recorded $215,843,126 in phishing/spoofing losses in 2025, about three times the $70,013,036 reported in 2024, even though complaint numbers fell slightly.
• Losses phishing enables: The same IC3 2025 report recorded $3,046,598,558 in business email compromise losses and $1,314,923,988 linked to personal data breach complaints. IC3 classifies each complaint under its crime type, so phishing that leads to BEC is counted as BEC, not phishing. See the Business Email Compromise and Fraud Statistics Guide.
• UK cost of the most disruptive breach: DSIT's Cyber Security Breaches Survey 2025/2026 found a median perceived cost of £0 for the most disruptive breach across all businesses (£30 for medium and large businesses), with the 95th percentile at £4,000 (£10,000 for medium and large). Most phishing is stopped or causes little direct cost; the long tail is where the damage sits.

AI and phishing

• AI-assisted initial access: The Verizon 2026 DBIR reports that phishing accounted for 44% of AI-assisted initial access techniques in threat actor data contributed by Anthropic (n=837). Verizon notes that phishing's share of initial access in its own incident data has barely changed, so AI is making existing lures cheaper rather than creating a new vector, at least in this dataset.
• Generative AI in attack techniques: Verizon's 2026 DBIR summary states that 15% of attack techniques are now supported by generative AI.
• AI-related complaints: The FBI IC3 Internet Crime Report 2025 identified more than 22,000 complaints (22,364) with an AI nexus and $893,346,472 in associated adjusted losses. See the Deepfake and AI Impersonation Guide.

Reporting and takedown

• UK public reporting: The NCSC Suspicious Email Reporting Service page states that 454.8k scam URLs had been removed as of July 2026 following public reports. The NCSC page does not state the total number of reports received.
• UK fraud reporting change: The ONS bulletin Crime in England and Wales: year ending June 2026 records that Report Fraud replaced Action Fraud and the National Fraud Intelligence Bureau as the national cyber crime and fraud reporting service on 4 December 2025. Older references to Action Fraud data now point to a discontinued series.

What the numbers mean for defenders

The sources agree on direction even though they measure different things: phishing is the most frequent attack people meet, it is a stable source of initial access, and its cost lands in other loss categories. The table maps each finding to a defensive response and the framework controls that support it.

• Small organisations: DSIT's figures show micro and small businesses identify fewer breaches, partly because they detect less. Prioritise the basics the survey tracks: email filtering, MFA on email accounts and a simple way to report suspicious messages. See the Email Security Guide.
• Large organisations: With 69% of large UK businesses identifying a breach, the question is speed of containment. Measure time from first report to mailbox purge and session revocation. See the Phishing Incident Response Playbook.
• Credential phishing: Password plus one-time code MFA does not stop real-time relay kits. See the Phishing-Resistant MFA Guide.
• Sender authentication: Domain impersonation is cheaper to stop at the receiving gateway with DMARC enforcement than in a user's head. See the DMARC, SPF and DKIM Guide.

Metrics to track against these benchmarks

• Report rate: share of simulated and real phishing reported by users, tracked separately for email, SMS and voice.
• Time to report and time to purge: median minutes from delivery to first user report, and from first report to removal from all mailboxes.
• Phishing-resistant MFA coverage: percentage of users, and of privileged and finance users, enrolled in FIDO2 or certificate-based authentication.
• Credential exposure after a click: number of confirmed credential submissions per quarter and median time to session revocation.
• DMARC enforcement: share of owned sending domains at p=reject, including parked domains.

Methodology notes and caveats

• Do not add sources together: IC3 complaints, APWG sites and DBIR breaches are different units. A sentence such as "X phishing attacks cost Y" built from two reports is not supportable.
• Quote the edition and period: the DBIR 2026 edition covers incidents from late 2024 to late 2025, and the DSIT 2025/2026 survey asks about the previous 12 months from fieldwork in late 2025. State the period, not just the publication year.
• Watch for definition changes: credential abuse fell from 22% to 13% in the DBIR partly because pretexting is now tracked separately. Year-on-year comparisons must use the same definitions.
• Avoid roundup figures: widely repeated numbers such as a fixed percentage of "all attacks starting with phishing" often have no current primary source. If you cannot find the publisher's own page, do not use the number.

Practitioner checklist

• Cite phishing figures only with report name, publisher and period in the same sentence, using the sources on this page.
• Set a calendar reminder for the main refresh points: IC3 (spring), DSIT survey (spring), Verizon DBIR (spring to early summer), APWG (quarterly) and Microsoft (autumn).
• Compare your own report rate and time to purge against your previous quarter, not against other organisations' simulation results.
• Extend phishing simulation and reporting to SMS, voice and QR codes, in line with the channel shift APWG, Verizon and Microsoft all report.
• Prioritise phishing-resistant MFA for administrators, finance, help desk and executive assistants first.
• Enforce DMARC at p=reject on every owned domain and monitor aggregate reports for impersonation.
• Give the help desk a caller verification procedure that does not rely on knowledge questions or caller ID.
• Track phishing that leads to BEC, payment fraud or account takeover as phishing in your own incident data, so the true cost is visible.

Standards and references

• FBI Internet Crime Complaint Center: Internet Crime Report 2025
• UK Department for Science, Innovation and Technology: Cyber Security Breaches Survey 2025/2026
• Anti-Phishing Working Group: Phishing Activity Trends Report, 2nd Quarter 2026
• Verizon: 2026 Data Breach Investigations Report
• Microsoft: Microsoft Digital Defense Report
• National Cyber Security Centre: Report a scam email (Suspicious Email Reporting Service)
• Office for National Statistics: Crime in England and Wales, year ending June 2026

Related NHI Mgmt Group resources: Phishing Guide · Cybersecurity Statistics Guide · Identity Attack Statistics Guide · Data Breach Statistics Guide · Phishing Simulation Programme Guide