Phishing Statistics [2026]: Latest Attack Data & Trends

📊 Key Phishing Numbers (2026)

3.4 billion phishing emails are sent every day, making phishing the single largest volume attack vector. APWG tracked 3.8 million phishing attacks across 2025, with Q2 2025 alone recording 1,130,393 attacks. 80,000+ phishing websites are detected annually, each lasting an average of just 12 hours before takedown (BlackBerry 2025). 57% of organisations face daily or weekly phishing attempts (GreatHorn 2025).

Phishing appears in 36% of all data breaches (Verizon DBIR 2025) and is the initial attack vector in 16% of breaches (IBM 2025). 80% of all reported security incidents are phishing-related (CSO Online). Global phishing losses total $25 billion annually (SentinelOne 2026), with $17,700 lost every minute (CSO Online). The FBI IC3 received 193,407 phishing complaints in 2024.

Phishing at a Glance: The Numbers That Matter

Every 39,000 phishing emails per second, every 92 million clicks per day, every $17,700 lost per minute — these numbers describe an industrial-scale operation. Phishing is no longer the domain of lone operators sending badly spelled emails from Nigerian princes. It is a professional, AI-augmented industry with specialised roles: access brokers who sell compromised credentials, campaign operators who design and distribute phishing emails, cashout teams who convert stolen data into money, and ransomware groups who use phishing as an entry point for multi-million-dollar extortion.

The professionalisation of phishing is reflected in the infrastructure. Phishing-as-a-Service (PhaaS) kits are sold on dark web marketplaces, complete with email templates, credential-harvesting landing pages, evasion techniques, and customer support. These kits lower the technical bar even further — an attacker with no coding ability can launch a sophisticated phishing campaign for under $100.

📨 How Many Phishing Emails Are Sent Daily?

The scale of phishing is staggering. 3.4 billion phishing emails flood inboxes daily — that's approximately 39,000 per second. APWG tracked 3.8 million phishing attacks in 2025, with Q2 alone recording over 1.1 million. Phishing websites detected rose 22% year-over-year to 80,000+ (Group-IB 2025), though the average site lasts only 12 hours before takedown (BlackBerry 2025).

Phishing emails peak on Sundays (22% of weekly volume) and Fridays (19%), suggesting attackers time campaigns for when recipients are less vigilant (StationX analysis). 86% of malicious spam uses embedded links rather than attachments (VIPRE 2024), reflecting a shift toward credential-harvesting landing pages.

Phishing Volume Trend

The trajectory is clear: phishing volume has grown every year for the past decade. APWG's data shows phishing attacks rising from approximately 1 million in 2020 to 3.8 million in 2025. The proliferation of AI tools has accelerated this growth — generating convincing phishing emails at scale requires minimal human effort when large language models handle the writing, personalisation, and translation.

The 12-hour average phishing site lifespan (BlackBerry 2025) reflects both improving takedown capabilities and attacker adaptation. Modern phishing campaigns use disposable infrastructure — spinning up hundreds of sites simultaneously, knowing most will be taken down quickly. The sites that survive even a few hours capture enough credentials to justify the cost, especially when the average click time is just 21 seconds from email delivery.

Why Sundays and Fridays?

Phishing emails peak on Sundays (22%) and Fridays (19%) for strategic reasons. Sunday campaigns exploit reduced IT staffing and weekend inboxes — recipients checking email casually on personal devices are less likely to scrutinise sender addresses or hover over links. Friday campaigns target end-of-week fatigue, when employees rush through overflowing inboxes before the weekend. Thursday (7%) sees the lowest phishing volume, possibly because mid-week alertness is highest.

🤖 AI-Powered Phishing

82.6% of phishing emails detected between September 2024 and February 2025 utilised AI (Keepnet/VIPRE). AI-automated spear phishing achieves a 54% click-through rate — matching skilled human attackers — while reducing campaign costs by 95%+ (HBR 2024). 37% of breaches now involve AI-generated phishing as the attack method (IBM 2025). 40% of BEC emails in Q2 2024 were identified as AI-crafted (VIPRE 2024).

80%+ of social engineering activity is now powered by AI (Abnormal Security 2025). The convergence of generative AI with phishing has fundamentally changed the economics of attacks: campaigns that previously required days of research per target can now be automated across thousands of targets simultaneously, with personalised content that exploits publicly available information from LinkedIn, social media, and corporate websites.

How AI Changed the Economics of Phishing

Before generative AI, a targeted spear phishing campaign required a human attacker to research each target individually — reading their LinkedIn profile, identifying colleagues, mimicking writing styles, and crafting a personalised email. This took hours per target, limiting attacks to high-value individuals. AI has collapsed this cost to near zero: a single operator can now generate thousands of personalised spear phishing emails per hour, each tailored to the recipient's role, company, and recent activity.

The 95%+ cost reduction (HBR 2024) means phishing campaigns that previously required dedicated criminal teams costing $50,000+ per operation can now be run for under $5. The barrier to entry has dropped so far that even unsophisticated actors can launch highly effective attacks. The result: 82.6% of detected phishing emails now show signs of AI generation (Keepnet/VIPRE 2025), and the trend is accelerating.

AI Phishing Detection Challenges

Traditional phishing detection relied on identifying tell-tale signs: grammatical errors, suspicious sender addresses, mismatched URLs, and generic greetings. AI-generated phishing emails eliminate most of these signals. The prose is grammatically perfect, culturally appropriate, and personalised to the recipient. AI tools can generate phishing emails in any language with native-level fluency, enabling attackers to target regions that were previously protected by language barriers.

Security vendors are responding with AI-based detection — using machine learning to identify subtle patterns in email headers, sending behaviour, and content that distinguish AI-generated phishing from legitimate communications. But this is an arms race: as detection improves, attackers adapt their generation techniques. The 82.6% AI-generated figure (Keepnet/VIPRE 2025) suggests attackers currently have the upper hand in this race.

🖱️ How Many People Fall for Phishing Scams?

The average phishing email click rate is 2.7% (Verizon DBIR 2025). That sounds low — until you multiply it by 3.4 billion daily emails. The result: approximately 92 million successful clicks per day, each a potential breach entry point. The median time to click is just 21 seconds from delivery (Verizon DBIR 2025).

The median time to report a phishing email is 28 minutes (Verizon DBIR 2025) — giving attackers a 27.6-minute head start between the first click and the first alert. 60% of phishing incidents involve identity-based attacks (Cisco 2025), where stolen credentials provide immediate access to systems. After comprehensive security awareness training, phishing susceptibility drops to under 5% (KnowBe4 2025).

The 21-Second Problem

21 seconds. That's the median time from phishing email delivery to the first click (Verizon DBIR 2025). To put this in perspective: most security teams cannot even generate an alert in 21 seconds, let alone respond to one. By the time an email security gateway flags a suspicious message for review, the first victim has already clicked, entered credentials, and potentially handed over access to the entire organisation.

The 28-minute reporting gap makes this worse. If the first click happens at 21 seconds and the first report happens at 28 minutes, attackers have a 27.6-minute window of undetected access. In that window, automated attack frameworks can harvest credentials, move laterally through the network, exfiltrate sensitive data, or deploy ransomware. The solution is not just faster detection — it's pre-click prevention through email filtering, URL sandboxing, and phishing-resistant MFA that limits the damage even when users click.

💼 Business Email Compromise & Social Engineering

Business email compromise (BEC) caused $2.77 billion in FBI-reported losses from 21,442 complaints in 2024 (FBI IC3). The average BEC attack costs $4.67 million (IBM 2025), making it one of the most expensive phishing variants. BEC accounts for 58% of financially motivated phishing breaches (Verizon DBIR 2025) and 27% of all investigated incidents (Arctic Wolf 2025). BEC volume surged 54% in H1 2025 compared to 2023 (Abnormal Security).

Social engineering is the foundation of nearly all cyberattacks. 98% of attacks involve social engineering in some form (Sprinto). 42% of organisations cite phishing and social engineering as their top cyber risk (WEF 2025). 68% of cyberattacks originate from email (KnowBe4 2025). Pretexting accounts for 50%+ of social engineering incidents, and 90% of Q1 2024 attacks involved social engineering (Avast).

Why BEC Is So Effective

BEC requires no malware, no exploits, and no technical sophistication — just convincing impersonation. An attacker spoofs or compromises a CEO's email, sends a wire transfer request to the finance team, and the money moves. The average BEC loss per incident is $160,000+ (Arctic Wolf 2025), and the largest single BEC attacks have cost organisations tens of millions. BEC volume surged 54% in H1 2025 compared to 2023 (Abnormal Security), driven by AI-generated content that makes fraudulent emails virtually indistinguishable from legitimate ones.

The FBI's $2.77 billion in reported BEC losses almost certainly understates the true figure — many organisations don't report losses, and smaller BEC attempts may go undetected entirely. BEC now accounts for 58% of financially motivated phishing breaches (Verizon DBIR 2025) and 27% of all investigated incidents (Arctic Wolf 2025). Pretexting — where attackers build a fabricated scenario to manipulate the victim — accounts for over 50% of social engineering incidents (Verizon DBIR 2025).

Social Engineering: The Foundation of All Phishing

98% of cyberattacks involve social engineering (Sprinto). This statistic reframes the entire cybersecurity landscape: the primary vulnerability is not in software, hardware, or network architecture — it's in human decision-making. 90% of Q1 2024 attacks involved social engineering (Avast). 42% of organisations cite phishing and social engineering as their top cyber risk (WEF 2025). 68% of cyberattacks originate from email (KnowBe4 2025).

BEC Attack Variations

BEC attacks come in several distinct variations, each targeting different organisational vulnerabilities:

The common thread across all BEC variants is social engineering — exploiting trust, authority, and urgency to bypass security controls. Effective BEC prevention requires out-of-band verification procedures (confirming wire transfer requests via phone call to a known number, not the number in the email), payment change protocols with mandatory dual-approval, and AI-based email analysis that detects subtle anomalies in communication patterns.

📱 Vishing & Smishing Trends

Vishing (voice phishing) surged 442% from H1 to H2 2024 (CrowdStrike 2025), making it the fastest-growing phishing vector. AI voice cloning enables attackers to replicate a person's voice from just 3 seconds of audio (McAfee 2024). The largest vishing-related scam was a $25 million deepfake CFO video call (CrowdStrike 2024).

Smishing (SMS phishing) accounts for 35% of all phishing attacks (SentinelOne 2026) and surged 40% year-over-year (Keepnet 2025). 19% of breaches now originate from smishing or vishing combined (Verizon DBIR 2025). 83% of phishing websites specifically target mobile devices (Zimperium 2024), reflecting the shift to mobile-first attack strategies.

The AI Voice Cloning Threat

The 442% vishing surge is directly linked to advances in AI voice cloning. McAfee reports that just 3 seconds of audio — from a YouTube video, conference recording, or voicemail greeting — is enough to create a convincing voice clone (McAfee 2024). Attackers use these clones to impersonate executives, requesting urgent wire transfers or sensitive information via phone calls. The $25 million deepfake CFO scam (CrowdStrike 2024) used video deepfake technology on a live call — the finance employee believed they were speaking with their actual CFO.

Smishing exploits a different vulnerability: trust in SMS. Text messages carry more implicit authority than email — a bank alert, delivery notification, or government notice via SMS triggers faster responses with less scrutiny. 83% of phishing websites are now designed for mobile screens (Zimperium 2024), optimised for the smaller display where URL inspection is harder. QR code phishing (+400%, Hoxhunt 2025) bridges physical and digital attack surfaces, appearing in printed materials, emails, and even fake parking meters.

🏥 Phishing Targets by Industry

Phishing is the initial breach vector in 16% of all data breaches (IBM 2025) and appears in 36% of breaches overall (Verizon DBIR 2025). 33% of cloud-related security incidents originate from phishing (IBM X-Force 2025). The phishing insider incident cost averages $804,997 (Ponemon 2025), and 55% of insider incidents are triggered by phishing.

Industry targeting patterns show that phishing is not evenly distributed. Financial services face the highest attack frequency — 300x more attacks than other industries (KnowBe4 2025) — because the direct path from credential theft to monetary gain is shortest. Healthcare is heavily targeted due to the value of medical records and the urgency culture that makes staff susceptible to "urgent action required" messages. Education faces the highest click rates due to a transient population (students, adjunct faculty) with varying security awareness levels.

Cloud-related phishing (33% of cloud incidents, IBM X-Force 2025) targets organisations migrating to cloud platforms, exploiting confusion about new login portals and credential management. Phishing-triggered insider incidents cost $804,997 on average (Ponemon 2025), and 55% of all insider incidents begin with a phishing email — making phishing the primary gateway to insider threats as well.

Industry Click Rate Comparison

Phishing click rates vary significantly by industry, driven by workforce composition, security culture, and attack sophistication. Education consistently shows the highest baseline click rates (~5.1%) due to transient student populations, adjunct faculty with limited security training, and open academic environments that prioritise accessibility over restriction. Financial services faces the highest attack frequency but has lower click rates (~4.2%) thanks to regulatory-driven security awareness programs.

Technology companies show the lowest baseline click rates (~2.1%), reflecting a workforce more attuned to cybersecurity risks and more likely to recognise phishing indicators. Healthcare (~3.5%) and government (~3.8%) fall in the middle — both face sophisticated targeting but have varying levels of security awareness maturity. Retail (~3.9%) is increasingly targeted as e-commerce grows, with attackers impersonating delivery services and payment platforms.

Phishing in Supply Chain Attacks

Phishing is increasingly used as the initial vector for supply chain compromises. Attackers target employees at third-party vendors, MSPs, or software suppliers — organisations that often have privileged access to their clients' systems. A single compromised vendor account can cascade to dozens or hundreds of downstream organisations. IBM reports that third-party breaches doubled year-over-year to 30% of all incidents, with supply chain compromises costing $4.91 million on average.

The supply chain phishing attack surface is expanding as organisations adopt more SaaS tools, each with its own authentication system. Every vendor login page is a potential phishing target. Organisations should require phishing-resistant MFA for all vendor access, conduct security assessments of critical suppliers' email security posture, and implement conditional access policies that restrict vendor access by IP, device, and geography.

🌍 Phishing Targets by Country

The United States is the primary target for phishing attacks, with the FBI IC3 receiving 193,407 phishing complaints in 2024. US BEC losses alone totalled $2.77 billion. Cryptocurrency-related phishing accounted for an additional $28.5 million in FBI-reported losses. The Netherlands (17.7%), Russia (13.7%), and other countries show distinct targeting patterns based on financial sector presence and digital infrastructure maturity.

Regional Phishing Patterns

Phishing targeting varies significantly by region. The Netherlands receives 17.7% of global phishing emails — disproportionate to its population — due to its role as a major European financial and logistics hub. Russia (13.7%) and other Eastern European countries see high volumes both as targets and as source countries. The APAC region faces distinct phishing campaigns tailored to local languages and banking systems, with mobile-first attacks dominating in markets where smartphone penetration exceeds desktop usage.

Cryptocurrency-related phishing is a growing subset, with the FBI reporting $28.5 million in crypto phishing losses in 2024 (FBI IC3). These attacks mimic legitimate cryptocurrency exchanges, wallets, and DeFi platforms, exploiting the irreversible nature of cryptocurrency transactions. Once funds are transferred to an attacker's wallet, recovery is virtually impossible.

Top Phishing Brands and Impersonation Targets

Attackers impersonate the brands people trust most. Microsoft, Google, Apple, Amazon, and major banks are consistently the most impersonated brands in phishing campaigns. Microsoft 365 phishing is particularly prevalent because compromising a Microsoft account gives attackers access to email, OneDrive, SharePoint, and Teams — the entire digital workplace. Google Workspace phishing follows the same logic.

Delivery service impersonation (DHL, FedEx, Royal Mail) has surged alongside the growth of e-commerce. "Your package is being held" and "delivery attempted" messages generate urgency without requiring any prior relationship with the target. Government impersonation (HMRC, IRS, tax agencies) spikes during tax seasons. Banking phishing ("unusual activity detected on your account") remains one of the highest-conversion phishing categories because it triggers immediate fear of financial loss.

🔗 Phishing Delivery Methods

86% of malicious spam now uses embedded links rather than attachments (VIPRE 2024), reflecting a strategic shift toward credential-harvesting landing pages that evade attachment-scanning defenses. QR code phishing (quishing) increased 400% between 2023 and 2025 (Hoxhunt), exploiting the trust users place in QR codes and the difficulty of previewing URLs on mobile devices.

60% of phishing incidents are identity-based (Cisco 2025), targeting credentials rather than deploying malware. The average phishing site lasts just 12 hours before takedown (BlackBerry 2025), but that's enough time — with a 21-second click time and 92 million daily clicks, most damage occurs within the first hour. 83% of phishing websites specifically target mobile users (Zimperium 2024).

The QR Code Phishing Explosion

QR code phishing (quishing) deserves special attention. The 400% increase (Hoxhunt 2025) reflects a fundamental gap in email security: most email gateways scan URLs and attachments but cannot interpret QR codes embedded as images. Attackers exploit this by embedding malicious QR codes in otherwise clean emails, bypassing traditional link-scanning defenses entirely. When users scan the QR code with their phone, they're redirected to a credential-harvesting site outside the corporate network's security controls.

Identity-based phishing (60% of incidents, Cisco 2025) represents the convergence of phishing with credential theft. Rather than deploying malware, modern phishing focuses on harvesting usernames and passwords through convincing login page replicas. With stolen credentials, attackers gain legitimate access that bypasses most perimeter defenses — no exploit needed, no malware to detect, just a valid login from a "trusted" user.

Adversary-in-the-Middle (AitM) Phishing

A sophisticated evolution of credential phishing is the Adversary-in-the-Middle (AitM) attack, where the phishing site acts as a real-time proxy between the victim and the legitimate login page. The victim enters their credentials and even their MFA token — both are captured and immediately relayed to the real site. The attacker gains a fully authenticated session, bypassing standard MFA. AitM phishing kits are now available as commodity tools on dark web marketplaces, making this advanced technique accessible to low-skill attackers.

Only phishing-resistant MFA (FIDO2/passkeys, hardware security keys) defeats AitM attacks, because these methods verify the actual domain of the login page cryptographically. If the domain doesn't match, the authentication fails — even if the user is fooled. This is why the industry is rapidly moving toward passwordless authentication using passkeys, which eliminate the credential-harvesting attack surface entirely.

💰 Cost of Phishing Attacks

Global phishing losses total $25 billion annually (SentinelOne 2026). $17,700 is lost to phishing every minute (CSO Online). The average BEC attack costs $4.67 million (IBM 2025), while the average BEC loss per incident is $160,000+ (Arctic Wolf 2025). Phishing-related insider incidents average $804,997 each (Ponemon 2025).

71% of organisations expect a business-disrupting cyber incident in the next 12-24 months (Cisco 2025), with phishing as the most likely entry point. The cost compounds across the attack chain: a successful phishing click leads to credential theft, lateral movement, data exfiltration, or ransomware deployment — each adding to the total breach cost.

The Compounding Cost Chain

Phishing rarely ends at the initial click. The cost compounds through a chain of consequences: credential theft leads to account compromise, which enables lateral movement, data exfiltration, and often ransomware deployment. IBM reports that breaches originating from phishing take an average of 241 days to identify and contain — one of the longest lifecycles of any attack vector. Each additional day of undetected access increases the total breach cost.

For organisations, the true cost of phishing includes direct financial losses, incident response costs, regulatory fines, legal expenses, reputational damage, customer churn, and business disruption. The $25 billion annual figure captures only the measurable direct losses. Including indirect costs — productivity loss from security lockdowns, executive time spent on breach response, increased insurance premiums — the total impact is substantially higher.

🛡️ Phishing Defense & Training

Security awareness training reduces phishing susceptibility to under 5%, down from an industry baseline of approximately 33% (KnowBe4 2025). That's an 85%+ reduction in click-through rates. The median time to report phishing is 28 minutes (Verizon DBIR 2025), but trained users report faster. The gap between click time (21 seconds) and report time (28 minutes) represents the critical window for attacker exploitation.

Phishing sites last an average of 12 hours before takedown (BlackBerry 2025), underscoring the importance of pre-click defenses (email filtering, URL sandboxing) over post-click remediation. Multi-factor authentication — particularly phishing-resistant MFA (FIDO2/passkeys) — provides the strongest defense against credential-harvesting phishing, even when users click.

Layered Phishing Defense Strategy

Effective phishing defense requires a layered approach. No single control stops all phishing — the 2.7% click rate persists even with email filtering because attackers constantly evolve their techniques. The most effective defence stack combines: (1) email gateway filtering with AI-based detection, (2) URL sandboxing and real-time link analysis, (3) regular security awareness training to reduce susceptibility below 5%, (4) phishing-resistant MFA (FIDO2/passkeys) to prevent credential exploitation even after a click, and (5) endpoint detection to catch post-compromise lateral movement.

The economics favour defense: security awareness training costs a fraction of a single phishing breach. Reducing click rates from the industry baseline (~33%) to under 5% with comprehensive training eliminates 85%+ of the risk surface. Adding phishing-resistant MFA closes most of the remaining gap — even if a user clicks and enters credentials on a fake site, the attacker cannot use those credentials without the physical security key or passkey.

Incident Response for Phishing

When phishing succeeds — and it will, despite the best defenses — the speed of response determines the damage. Organisations with a documented incident response plan specifically for phishing events contain breaches faster and at lower cost. The response playbook should include: immediate credential reset for compromised accounts, session token revocation, email quarantine of additional messages from the same campaign, forensic analysis of what data was accessed, and notification to affected parties.

Automated response orchestration (SOAR platforms) can execute the first four steps within minutes of a confirmed phishing compromise, dramatically reducing the attacker's operational window. When the median time from click to report is 28 minutes, automated response can close the gap that manual processes cannot. Organisations that combine user training, phishing-resistant MFA, email filtering, and automated incident response achieve the strongest defensive posture against phishing attacks.

Phishing Simulation Programs

The most effective security awareness programs include regular phishing simulations — controlled phishing campaigns that test employee awareness without real risk. These simulations measure click rates, report rates, and susceptibility trends over time. KnowBe4's data showing susceptibility dropping to under 5% after training comes from organisations running monthly simulation campaigns combined with just-in-time training for employees who click.

Simulation programs work best when they evolve: initial tests use obvious phishing indicators, progressively introducing more sophisticated techniques including AI-generated content, impersonation of internal employees, and multi-channel attacks (email followed by a "verification" phone call). Organisations that run quarterly simulations see 50-60% improvement in the first year. Those running monthly simulations with immediate feedback see 70-80%+ improvement within 6 months.

⚠️ Biggest Phishing Attacks & Notable Campaigns

The biggest phishing attacks in recent years demonstrate how the threat has evolved from mass-blast emails to sophisticated, multi-channel campaigns leveraging AI, deepfakes, and social engineering at scale. Here are the most significant:

Phishing vs Other Attack Vectors

Phishing is not just one attack vector among many — it's the gateway to most others. Ransomware, credential theft, business email compromise, insider threats, and supply chain attacks frequently begin with a phishing email. IBM reports phishing as the initial vector in 16% of breaches, but its downstream impact is far broader: stolen credentials from phishing enable 53% of all breaches (Verizon DBIR 2025), and phishing triggers 55% of insider incidents (Ponemon 2025).

The Evolution of Phishing Tactics

Phishing has evolved through distinct generations. First-generation attacks (early 2000s) were mass-blast emails with obvious indicators — foreign princes, lottery winnings, Nigerian bank transfers. Second-generation attacks (2010s) introduced brand impersonation, landing page cloning, and industry-targeted campaigns. Third-generation attacks (2020s) leverage AI content generation, multi-channel delivery, AitM credential proxying, and deepfake technology. Each generation made the previous generation's defenses insufficient.

The current fourth-generation threat combines all previous capabilities with autonomous AI agents that can conduct entire social engineering campaigns end-to-end: researching targets, crafting personalised messages, adapting in real-time to responses, and even conducting follow-up calls using voice clones. While this capability is still emerging, the building blocks are all commercially available. Security planning for 2026-2028 must account for this trajectory.

📲 Mobile Phishing Statistics

83% of phishing websites specifically target mobile devices (Zimperium 2024). Smishing accounts for 35% of all phishing attacks (SentinelOne 2026), and the smishing surge hit 40% year-over-year growth (Keepnet 2025). Mobile phishing is harder to detect: smaller screens hide URL previews, and SMS messages carry more implicit trust than email. QR code phishing (+400%, Hoxhunt 2025) further exploits mobile-first behaviour.

The mobile attack surface extends beyond SMS. Messaging apps (WhatsApp, Telegram, Slack), social media DMs, and even calendar invites are used as phishing delivery channels. Mobile banking trojans have surged (Kaspersky 2024), often delivered through smishing links. Organisations relying solely on desktop email security miss a significant portion of the phishing threat landscape.

Why Mobile Phishing Works

Mobile devices create a perfect environment for phishing success. Smaller screens hide URL bars and make it harder to inspect links before clicking. Push notifications create urgency — a text message reading "Your account has been compromised, verify now" triggers immediate action on a device designed for instant response. Mobile browsers often lack the security extensions available on desktop. And personal devices typically operate outside corporate security controls, meaning no email gateway, no URL sandboxing, and no endpoint detection.

The convergence of work and personal communication on mobile devices compounds the risk. Employees accessing corporate email, Slack, Teams, and other work tools on the same device where they receive personal SMS and social media messages means a smishing attack can reach a corporate user through a completely unmonitored channel. QR code phishing bridges physical spaces — attackers have placed malicious QR codes over legitimate ones on parking meters, restaurant menus, and even corporate visitor badges.

Mobile Phishing Defense Gaps

Most enterprise security stacks were designed for desktop environments. Email security gateways filter corporate email, but they cannot scan personal SMS messages, WhatsApp conversations, or social media DMs on employee phones. This creates a fundamental visibility gap: the device that has the most access to corporate systems (mobile, with SSO apps, email, Slack, VPN) is also the device with the least security monitoring.

Mobile threat defense (MTD) solutions and mobile device management (MDM) platforms can close some of these gaps by scanning URLs before they open in mobile browsers, detecting phishing apps, and enforcing security policies on managed devices. However, adoption remains low — many organisations still treat mobile security as an afterthought. Given that 83% of phishing sites target mobile users (Zimperium 2024) and 35% of phishing uses SMS/messaging (SentinelOne 2026), this gap represents one of the largest unaddressed phishing risk surfaces.

📅 How Often Do Phishing Attacks Happen?

Phishing emails peak on Sundays (22% of weekly volume) and Fridays (19%), with Thursday being the lowest day at 7% (StationX analysis). This pattern suggests attackers target weekends and end-of-week fatigue, when recipients are less likely to scrutinise emails carefully. Monday (15%) and Tuesday (13%) see moderate volumes, while Wednesday (11%) and Saturday (13%) fall in between.

These timing patterns have direct implications for security operations. SOC teams should increase email monitoring coverage on Sundays and Fridays, when phishing volume peaks. Automated email security rules can apply stricter filtering during high-risk periods. Security awareness training should specifically address weekend and end-of-week vigilance, since attackers deliberately time campaigns to exploit periods of reduced attention.

Time-of-day patterns also matter. Phishing emails timed to arrive early Monday morning — when employees face hundreds of accumulated weekend emails — achieve higher click rates than those sent mid-afternoon on a Tuesday. Attackers study recipient behaviour, timing delivery for maximum impact. Enterprise email security that queues and rescans early-morning email batches can catch threats that real-time filters miss under volume pressure.

Seasonal Phishing Patterns

Beyond day-of-week patterns, phishing follows seasonal trends tied to cultural and business events. Tax season (January-April in the US, January-January in the UK) drives government impersonation phishing — HMRC, IRS, and tax authority phishing spikes 3-4x during filing periods. Holiday shopping seasons (November-December) see surges in delivery service and retail brand impersonation. Back-to-school periods drive education-sector targeting. Year-end financial reporting triggers BEC attacks targeting finance teams under deadline pressure.

Major news events create phishing opportunities. Natural disasters trigger fake charity phishing. Product launches (new iPhone, major software releases) generate fake pre-order and update phishing. Health crises create fake government alert phishing. Geopolitical events create fake news and sanction-related phishing targeting businesses. Attackers monitor the news cycle and launch themed campaigns within hours of breaking events, exploiting heightened emotion and reduced critical thinking.

Phishing Statistics Year-Over-Year

Comparing phishing statistics across years reveals acceleration, not stability. APWG data shows the trajectory: approximately 1 million attacks in 2020, 1.3 million in 2021, 2.35 million in 2022, 3.2 million in 2023, and 3.8 million in 2025. The compounding growth rate of 30-40% annually shows no sign of slowing, particularly as AI tools further reduce the cost and effort of launching campaigns.

BEC losses have followed a similar trajectory: FBI IC3 reported $1.8 billion in 2020, $2.4 billion in 2021, $2.7 billion in 2022, $2.9 billion in 2023, and $2.77 billion in 2024. While the 2024 figure shows a slight decline from 2023, the overall trend remains upward, and the introduction of AI-generated BEC content in 2024-2025 suggests this may be a brief pause before renewed acceleration. The cost per BEC incident has increased even as total reported losses plateaued, indicating fewer but more sophisticated and higher-value attacks.

📊 Phishing by the Numbers: Visual Summary

The following visual components summarise the key phishing statistics for 2026. Use these for presentations, security awareness sessions, and executive briefings.

Attack Method Breakdown

Email remains the dominant phishing channel, but the multi-channel threat is growing rapidly. The percentages above represent share of overall phishing activity across channels — note that attacks often span multiple channels (e.g., an email that asks the recipient to call a phone number combines email phishing with vishing).

Phishing Defense Effectiveness

Defense effectiveness estimates are approximate, based on vendor data and industry benchmarks. Phishing-resistant MFA (FIDO2/passkeys) provides the strongest single control because it cryptographically verifies the login domain, defeating even AitM attacks. The most effective defence combines multiple layers — no single control catches all phishing.

Building Your Anti-Phishing Stack

Based on the data in this article, here's the recommended anti-phishing defense stack ordered by impact:

No single layer is sufficient. The data shows that even the best email filtering misses some phishing (82.6% AI-generated content challenges detection), that trained users still click occasionally (2.7% baseline with training), and that mobile and voice channels bypass email controls entirely. The strongest phishing defense is a combination of technical controls that prevent credential exploitation (MFA), human controls that reduce click rates (training), and procedural controls that catch what both miss (verification protocols, automated response).

📋 Key Takeaways for 2026

The phishing landscape in 2026 is defined by three converging trends: AI-powered content generation, multi-channel delivery (email + voice + SMS + QR), and identity-based attacks that bypass traditional security controls. Here's what the data tells us: