Phishing Statistics 2026: Attack Volumes, Costs & Trends

3.4 billion phishing emails sent daily worldwide

3.8 million phishing attacks recorded in 2025

Over 90% of organisations experienced phishing in 2025

Phishing is the #1 initial attack vector for data breaches (16%)

300,497 phishing complaints filed with FBI IC3 in 2024

$4.88M average cost of a phishing-initiated data breach

$2.77 billion in BEC losses in the US alone (2024)

$25 billion estimated global annual phishing losses

$164 average cost per compromised record

$17,700 lost per minute of downtime

$137,132 average loss per BEC incident

$9.77M average healthcare breach cost (highest industry)

82.6% of detected phishing emails now use AI (53.5% YoY increase)

AI spear phishing achieves 54% click rate vs 12% human-written

Deepfake vishing surged 1,633% in Q1 2025

Vishing attacks overall surged 442% in 2025

$200M+ in deepfake fraud losses in Q1 2025 alone

$40B projected annual deepfake losses by 2027

Voice cloning possible from 60 seconds of audio

QR phishing (quishing) increased 400% in 2025

254 days average time to identify and contain a phishing breach

Breaches identified in under 200 days cost $3.93M (23% less)

Security AI + automation reduces detection time by 54 days

Organisations with IR plans save $2.66M per breach on average

$1 of training saves $40 in avoided breach costs

Monthly training reduces click rates from ~30% to under 5% in 12 months

$2.5M average cost reduction with security awareness training

Phishing-resistant MFA (FIDO2) blocks 99.9% of credential attacks

DMARC prevents 100% of domain spoofing (when fully enforced)