Phishing Cost by Attack Vector

Attacker spoofs or compromises an executive or vendor mailbox, then redirects a wire payment or invoice. The single largest loss-by-volume category in the IC3 docket: $2.77B aggregate US loss in 2024 across 21,442 complaints. Recovery rate sits below 30 percent.

Targeted, researched message to a specific individual. AI-spear-phish achieves a 54% click-through against a 12% baseline for human-written attempts (Hoxhunt). Hand-crafted volume now matches automation output.

C-suite impersonation, often paired with deepfake voice. The 2024 deepfake-call wire-transfer wave drove $200M+ in Q1 2025 reported losses. Boards are now in scope as both attack target and reputational risk owner.

Mass credential-harvest emails. Per-incident cost is low, but APWG counts tens of thousands of distinct campaigns per quarter. Typically routes into credential-stuffing follow-on attacks. The one phishing category where filtering still meaningfully reduces volume.

Phone-based social engineering. The MGM Resorts incident (2023) is the canonical case. Deepfake voice cloning from 60 seconds of source audio is now a commodity capability. Helpdesk impersonation enables MFA bypass.

Text-message phishing. Frequently paired with MFA prompt-bombing once credentials are harvested. Logistics-themed lures (carrier delivery) and tax-themed lures dominate by season.

Phishing payload delivered via a QR code embedded as an image. Bypasses URL-rewriting and link-filtering at the email gateway. Mobile-first execution off the corporate network removes endpoint controls from the path.