Vishing and Smishing Statistics

Phone calls and text messages are a large share of fraud contact, yet most published phishing statistics count email and URLs, so the voice and SMS channel is easy to under-plan. This page gathers the vishing (voice phishing) and smishing (SMS phishing) figures we could trace to their publishers: the US Federal Trade Commission (FTC), Australia's National Anti-Scam Centre (Scamwatch), UK Finance, Ofcom, the UK Cyber Security Breaches Survey, the Anti-Phishing Working Group (APWG) and FBI advisories. Each figure carries its publisher and as-of date, because channel definitions and reporting bases differ between countries. It is written for security awareness leads, fraud teams, contact centre and help desk managers, and risk owners. How the attacks work and how to stop them is covered in the Vishing and Smishing Guide; this page is the numbers. Last reviewed: November 2026.

Key takeaways

Phone fraud costs more per case than text fraud. Scamwatch recorded A$72.5 million lost to phone call scams in 2025 from 2,012 loss reports, against A$18.0 million from 1,603 text message loss reports.
Calls and texts make up a steady slice of US fraud losses. The FTC reports that in 2025 phone calls were the contact method for 11% of fraud reports with a loss and texts for 7%.
Telephone-originated scams are fewer but larger in the UK. UK Finance attributes 17% of authorised push payment (APP) cases but 28% of APP losses in 2025 to telecommunications.
Volumes are rising again in threat data. APWG's Q2 2026 report recorded a 40% rise in smishing and a 20% rise in vishing compared with Q1 2026.
Most people do not report. Ofcom's January 2024 research implies only about 19% of people who received a suspicious mobile call and about 24% who received a suspicious text reported it.

Headline statistics

Statistic	Figure	Source and as-of date
Share of US fraud reports with a loss where contact began by phone call	11%	FTC Data Spotlight, April 2026 (2025 data)
Share of US fraud reports with a loss where contact began by text	7%	FTC Data Spotlight, April 2026 (2025 data)
Australian losses to phone call scams	A$72,477,723 (down about 32% on 2024)	National Anti-Scam Centre, Targeting Scams Report 2025
Australian losses to text message scams	A$17,977,491 (A$14.0 million in 2024)	Targeting Scams Report 2025
UK APP fraud originating in telecommunications	17% of cases, 28% of losses	UK Finance Annual Fraud Report 2026 (2025 data)
UK police and bank staff impersonation scams	6,016 cases, £55.5 million lost	UK Finance Annual Fraud Report 2026
Quarterly change in smishing / vishing	+40% / +20%, Q1 to Q2 2026	APWG Phishing Activity Trends Report, Q2 2026 (Crane Authentication data)
UK businesses reporting impersonation attacks in the last 12 months	12%	DSIT Cyber Security Breaches Survey 2025/26

Statistics by theme

Losses by contact channel

Regulators that record how a scam first reached the victim give the clearest view of the phone and text channels. The figures below are not directly comparable across countries, because each counts reports made to it, not all fraud.

Country and dataset	Phone call	Text message	Notes
Australia, Scamwatch 2025: losses	A$72,477,723	A$17,977,491	Total Scamwatch losses, all channels: A$334.8 million
Australia, Scamwatch 2025: reports with a loss	2,012	1,603	Average loss per phone loss report is roughly three times the text figure (our calculation)
Australia, Scamwatch 2025: change in report volume	Down 9.0%	Down 62.4% (29,058 reports, from 77,365)	Text reports fell sharply while text losses rose
United States, FTC 2025: share of fraud reports with a loss	11%	7%	Social media was the costliest channel, at $2.1 billion
United Kingdom, UK Finance 2025: share of APP fraud	Telecommunications: 17% of cases, 28% of losses		Online: 66% of cases, 32% of losses; based on a subset of APP data

Two patterns repeat across these sources. First, phone-originated fraud tends to have a higher loss per case than text, because a live caller can build urgency and talk the victim through a payment or an authentication step. UK Finance's channel split shows this clearly: telecoms produce under a fifth of APP cases but more than a quarter of losses. Second, falling report counts do not mean falling harm. Scamwatch text reports dropped by 62.4% in 2025, yet text losses rose from about A$14.0 million to A$18.0 million.

Impersonation by phone

Many vishing losses fall in impersonation categories rather than under a "phone" label.

Bank and police impersonation (UK): UK Finance recorded 6,016 cases in 2025, down 23%, with £55.5 million lost, down 18%. £44.1 million (80%) was returned to victims, largely under the APP reimbursement rules.
Officials impersonated (US): the FBI warned on 15 May 2025 (alert I-051525-PSA) of an ongoing campaign since April 2025 using smishing and vishing messages, including AI-generated voice, that impersonate senior US officials to steal account credentials from officials and their contacts.
Organisations as targets (UK): the Cyber Security Breaches Survey 2025/26 found 12% of businesses had experienced impersonation attacks in the previous 12 months (17% in 2023/24) and 7% of charities. The survey defines impersonation as people impersonating the organisation or its staff in emails or online, so it does not measure vishing.

AI voice cloning is the main change to watch. Figures on deepfake voice fraud are collected in the Deepfake Fraud Statistics page.

Volume trends from threat data

Threat intelligence feeds measure attacks rather than losses. The APWG Phishing Activity Trends Report for Q2 2026, drawing on Crane Authentication data, said vishing "hit highs and increased by 20 percent" from Q1 to Q2 2026, and smishing increased by 40 percent over the same period. APWG did not publish absolute counts for either channel, so these are direction and size of change only. Email and URL phishing volumes in the same report are summarised in the Phishing Statistics Guide.

Exposure and reporting behaviour

Ofcom's research with YouGov (2,096 UK adults, fieldwork 8 to 11 January 2024) asked people about the most recent suspicious content they had received.

Channel of most recent suspicious contact	Share of respondents	Share who reported it (our calculation from Ofcom bases)
Email	29%	About 32%
Mobile call	20%	About 19%
Mobile text	17%	About 24%
Landline call	8%	About 16%
Social media post	7%	About 37%

Source: Ofcom, online, calls and texts fraud research, published 1 February 2024. Calls and texts together (mobile and landline) were the most recent suspicious contact for 45% of respondents, more than email. The most common reasons for not reporting were not knowing who to report to (28%), not expecting action (27%) and not knowing how (23%). For organisations, this means internal reporting routes for suspicious calls need to be as simple as the "report phishing" button for email.

Help desk and employee targeting

Public datasets rarely separate attacks on employees from attacks on consumers. The best evidence on help desk vishing comes from incident disclosures and government advisories describing calls to IT help desks to reset passwords and MFA. Those figures, including the cost of the resulting breaches, are compiled in the Help Desk Social Engineering Statistics page, and the group is profiled in the Scattered Spider Threat Actor Profile.

What the numbers mean for defenders

Weight controls by loss, not volume: text scams are more numerous, but calls cause larger losses per case in Scamwatch and UK Finance data. Payment verification and callback controls deserve priority over SMS filtering alone.
Verify on a channel you choose: the FBI's advice for official impersonation (call back on an independently found number, never share a one-time code) applies equally to employees receiving calls claiming to be IT or a senior executive. See Caller Authentication in Contact Centres.
Harden the help desk: MFA resets and password resets by phone are a known target. See the Account Recovery and Help Desk Security Guide.
Make reporting easy: with roughly one in five suspicious calls reported in Ofcom's data, publish a single internal number or form for suspicious calls and texts, and feed reports to the security team.
Protect the phone number as an identity factor: SMS one-time codes and number-based recovery depend on the carrier account. See the SIM Swap Fraud Guide.

Using these figures in a business case

Statistics on phone and text fraud are most often used to justify three investments: stronger help desk verification, payment callback controls and replacing SMS codes for workforce sign-in. Each needs a different kind of number.

Investment	Best supporting figure	How to frame it
Help desk identity verification	Help desk incident disclosures and advisories (see the Help Desk Social Engineering Statistics page)	Low frequency, very high impact: one successful call can lead to a full domain compromise
Payment callback and dual approval	UK Finance: telecoms-originated APP fraud is 17% of cases and 28% of losses	Phone-led fraud carries a higher loss per case, so verification on a known number targets the costliest scams
Phishing-resistant MFA instead of SMS codes	APWG: smishing up 40% quarter on quarter in Q2 2026	The text channel is growing, and SMS codes can be phished or intercepted
Staff reporting route for calls and texts	Ofcom: about 19% of suspicious mobile calls reported	Most incidents go unseen unless reporting is easy

Pair each external figure with an internal one. A board will act faster on "we received 140 suspicious call reports last quarter and three reached the help desk" than on a national loss total. Where you have no internal data yet, the first quarter of measurement is itself the deliverable: start counting suspicious call and text reports, help desk verification failures and payment change callbacks, then compare the trend with the national sources on this page each year.

Be careful with currency and scope. Scamwatch reports Australian dollars, UK Finance pounds and the FTC US dollars, and none of them separates employees from consumers. For an organisation, the consumer figures show how capable and well-practised the callers are; the employee risk comes from the same people using the same scripts against your staff.

Where identity fits

Vishing and smishing are usually a route to an identity, not an end in themselves. The caller wants a password reset, an MFA enrolment, a one-time code or an approval in an authenticator app. That makes the phone channel part of the identity attack surface: help desk reset procedures, number-based account recovery and SMS one-time codes are all identity controls that these attacks test. Treat any process where a phone call can change an authenticator as a privileged operation, log it, and require verification that does not rely on information a caller can find or phish.

Measuring your own exposure

Metric	How to measure	Why it matters
Suspicious call and text reports per 100 staff per month	Count of internal reports through the reporting route	Rising reports usually mean better awareness, not more attacks
Help desk resets that failed verification	Reset requests rejected or escalated divided by all requests	Shows whether verification is applied under pressure
Vishing simulation report rate	Staff who reported a simulated call divided by staff called	Measures the behaviour that Ofcom data shows is rare
Payment changes verified by callback	Supplier bank detail changes verified on a known number divided by all changes	Targets the high loss per case channel
Accounts still using SMS as the only second factor	From the identity provider's authentication method report	Smishing and SIM swap target SMS codes
Time from report to block	Minutes from first report to blocking the number or URL	Limits campaign reach inside the organisation

Common failure patterns when using these statistics

Comparing countries directly: the FTC, Scamwatch and UK Finance count different things (reports to a regulator, bank-reported fraud). Compare trends within one source.
Reading falling reports as falling risk: Scamwatch text reports fell 62.4% while losses rose.
Treating APWG percentages as counts: the 40% and 20% figures are quarter-on-quarter changes from one contributor, with no absolute numbers.
Calling all impersonation vishing: UK Finance and the Cyber Security Breaches Survey group several channels. Say so when you quote them.
Quoting our calculated rates as publisher figures: the Ofcom reporting rates and per-report averages on this page are derived from published bases. Label them as derived.
Ignoring the employee channel: consumer statistics dominate, but help desk vishing has led to some of the largest corporate incidents.

Methodology notes and caveats

FTC data comes from consumer reports to the Consumer Sentinel Network and only counts reports that name a contact method. Scamwatch figures are reports to the National Anti-Scam Centre in Australian dollars and are a subset of all Australian scam losses. UK Finance channel splits are based on a subset of APP data that the publisher says cannot be considered definitive. Ofcom figures are from an online survey of 2,096 adults in January 2024. The Cyber Security Breaches Survey 2025/26 sampled 2,112 businesses and 1,085 charities between August and December 2025. APWG trends come from contributor data and change each quarter.

Framework mapping

Area	Reference	What it covers
Vishing technique	MITRE ATT&CK T1566.004 Spearphishing Voice; T1598.004 (reconnaissance)	Voice calls to gain access or gather information
Mobile phishing, including SMS	MITRE ATT&CK Mobile T1660 Phishing	Malicious messages to mobile devices
Awareness	NIST CSF 2.0 PR.AT-01; NIST SP 800-53 AT-2	Training staff to recognise and report social engineering
Monitoring	NIST CSF 2.0 DE.CM-01	Monitoring services, including telephony and messaging, for adverse events

Practitioner checklist

Quote each figure with publisher, dataset and year, and do not mix countries in one number.
Separate loss figures from volume figures in board reporting.
Publish one simple route for staff to report suspicious calls and texts.
Require callback on a known number for payment changes and urgent executive requests.
Apply strong identity verification to help desk password and MFA resets.
Reduce reliance on SMS one-time codes for workforce accounts.
Run vishing simulations alongside email phishing simulations and track report rates.
Review this page's sources each year, as FTC, Scamwatch and UK Finance publish annually.

Vishing and Smishing Statistics: Phone and Text Scam Volumes, Losses and Reporting Data