Phishing Email Statistics 2026: How to Protect Your Organization

It started like any other Tuesday morning. A mid-level finance manager at a US-based logistics firm opened what looked like an urgent request from their CEO. The subject line? “Quarterly Financial Review Needed Immediately.” The logo looked legit. The tone felt familiar. Within two minutes, confidential files were shared, and by noon, the company had lost $1.2 million to a meticulously crafted phishing attack.

This isn’t just an isolated mistake; it’s part of a rapidly growing global threat. Phishing emails remain one of the most persistent and successful cyberattack vectors, evolving with smarter lures, AI-generated content, and increasingly deceptive visuals. Whether you’re a small business owner or a global enterprise executive, these stats offer critical insights into the scale, trends, and risks of phishing emails today.

Editor’s Choice

• Over 3.4 billion phishing emails are sent per day, and phishing is involved in around 90% of organizational cyber incidents when you include both initial and follow‑on attack stages.
• Around 1.13 million phishing attacks are recorded in a single quarter, keeping volumes near all‑time highs.
• About 77% of security leaders report rising cyber-enabled fraud and phishing across their organizations.
• Business Email Compromise losses exceed $2.77 billion annually in the US, with underreporting likely pushing real losses far higher.
• Nearly 30.9% of phishing attacks target financial and online payment sectors, keeping them the top impersonated industries.
• The average click‑through rate on phishing emails in recent large enterprise studies is about 2.7%, still enough to drive large‑scale compromise at enterprise volumes.
• AI-generated phishing emails show up to 60% higher engagement than traditional phishing, driven by better personalization.
• Voice- and QR-based variants are surging, with QR code (quishing) attacks up over 400% in recent years.

Recent Developments

• Image-based phishing emails, including QR-code images, have surged by over 50%, as attackers hide malicious URLs inside graphics to bypass text-based scanners.
• HTML attachment-based phishing remains prevalent, with HTML files among the top 3 malicious attachment types detected in email threat telemetry.
• Multi-step conversational phishing and spear phishing now account for roughly one-third of targeted email attacks against enterprises.
• Deepfake and synthetic identity-enabled phishing and fraud attempts have jumped by over 50%, making identity-driven scams significantly harder to detect.
• Time-delayed payload and HTML-smuggling techniques help phishing emails evade traditional filters, contributing to a notable rise in post-delivery compromises.
• Phishing delivered via collaboration tools like Teams and Slack has grown steadily, now representing an estimated 15–20% of enterprise phishing entry points.
• CAPTCHA-style lures and fake verification pages are increasingly common, with QR and CAPTCHA tricks featuring in a growing share of Q1 2026 phishing campaigns.
• AI-written, ChatGPT-style phishing has become mainstream, with generative AI used in most modern spear phishing campaigns to craft fluent, personalized messages.
• URL evasion using redirects, proxies, and polymorphic variants appears in well over a quarter of phishing emails, undermining blocklists and static URL defenses.
• Attackers now use their own phishing simulation and testing tools, allowing them to iteratively improve campaigns and lift success rates by double-digit percentages.

Most-Targeted Industry Sectors

• Financial Institutions were the most-targeted sector, accounting for 18.3% of all reported attacks.
• SAAS/Webmail platforms closely followed with 18.2%, highlighting growing threats against cloud-based services.
• eCommerce and Retail businesses represented 14.8% of targeted incidents, showing continued risks in online shopping ecosystems.
• The “Other” category made up 14.7% of attacks, indicating cyber threats are spread across multiple industries.
• Payment-related services experienced 12.1% of attacks, reflecting the high value of financial transaction data.
• Social Media platforms accounted for 11.3% of targeted activity, driven by credential theft and account hijacking attempts.
• Telecom companies represented 4% of attacks, showing moderate exposure to phishing and fraud campaigns.
• Logistics and Shipping sectors faced 3.9% of attacks, likely linked to supply chain and delivery scams.
• The Crypto industry had the smallest share at 2.7%, though it remains a notable target for financial cybercrime.

Source Countries Behind Cyber Attacks

• Russia remains a top-origin country for cyber activity, appearing in roughly 11–12% of politically motivated cyber incidents, with many attacks unattributed.
• China is responsible for around 12% of documented politically motivated cyber attacks, making it one of the most active origin states.
• Iran accounts for approximately 5.3% of such cyber incidents, frequently targeting critical infrastructure and government entities.
• North Korea is linked to about 4.7% of known politically motivated cyber attacks, often focusing on financial theft and disruption.
• Nearly 45% of politically motivated cyber operations remain unattributed, highlighting major gaps in pinpointing the true country of origin.
• Nation-states and affiliated actors are behind roughly one-third of recorded politically motivated cyber incidents worldwide.
• Non-state politically motivated groups account for a similar share, at around 30% of tracked incidents over recent years.
• Weekly average cyber attacks in India have reached 3,195 per organization, about 62% higher than the global average in early 2026.

Don’t chase tech news. We track it for you.

One weekly briefing with the launches, AI developments, and breaches that matter. No filler.

Email address

Subscribe Now

Email Spoofing and Brand Impersonation Rates

• Microsoft, Apple, and Google are currently the top spoofed brands, appearing in 22%, 11%, and 9% of brand impersonation phishing attempts, respectively, with Amazon at 7% and LinkedIn at 6%.
• Brand impersonation is used in roughly 45% of phishing attacks, making spoofed logos and identities one of the most common lures.
• Only about 18.1% of global domains have DMARC enforcement in place, leaving over 80% still vulnerable to direct spoofing.
• Domain shadowing and related techniques account for about 3% of sophisticated phishing URLs used in high-end attacks.
• Microsoft-related phishing alone represents over half (51.7%) of all phishing scams in some telemetry datasets, far outpacing other brands.
• AI-generated phishing, often cloning real brands and interfaces, drives a credential theft success rate of 33.6% when victims click through.
• Around 36.9% of polymorphic phishing attacks use invisible or obfuscated brand elements to bypass filters and deceive users.
• At least one in 99 emails sent globally is a phishing attempt, with many leveraging spoofed brands and lookalike domains.
• Tech, finance, and logistics brands dominate spoofing lists, with several major companies each appearing in 3–7% of brand phishing attempts.

Types of Data Most Commonly Compromised

• Customer personally identifiable information is exposed in 53% of breaches, making PII the most frequently compromised data type.
• Company intellectual property and trade secrets are involved in about 33% of compromised records and are the costliest at $178 per record on average.
• Email addresses are compromised in roughly 61% of data breaches in recent reports.
• Phone numbers are exposed in about 39% of breaches, often alongside other contact details.
• Passwords are compromised in approximately 28% of breaches, feeding credential-stuffing and account takeover attacks.
• IP addresses appear among leaked data in around 13% of recorded breaches.
• Credential abuse remains the initial vector in about 22% of breaches, underscoring the high value of login data.

Success Rates of Phishing Campaigns

• Across all industries, about 9–10% of phishing attacks successfully compromise users or systems, despite existing security training and controls.
• Credential theft succeeds in about 33.6% of AI-generated phishing attempts once a user engages with the malicious message or page.
• QR-based phishing (quishing) is used in roughly 12–12.4% of phishing incidents, exploiting the fact that 73% of users scan codes without checking destinations.
• AI-assisted spear phishing used in simulations shows click rates around 54%, on par with skilled human-crafted spear phishing but at far lower attacker cost.
• Nearly 96% of phishing attacks are still delivered via email, keeping inboxes the primary vector despite growth in SMS and voice channels.
• Phishing remains involved in around 90% of successful cyberattacks in some studies, underscoring how often social engineering underpins modern breaches.
• Small businesses are heavily impacted, with about 30% naming phishing as their top cyber threat and reporting repeated successful incidents.
• Image-based and QR-based payloads, including quishing, have surged by 400%, significantly lifting success rates against legacy filters.

Phishing Email Detection and Filtering Effectiveness

• Modern enterprise spam and security gateways now block over 99% of malicious and junk messages before they reach users’ inboxes.
• Traditional secure email gateways still miss around 12–14% of targeted phishing emails, which must be caught by downstream controls or users.
• AI-enhanced email security can reduce successful phishing incidents by roughly 30–40% compared with legacy rule-based filtering alone.
• Only about 18.1% of domains enforce DMARC at a blocking policy, leaving the majority susceptible to spoofed emails that can bypass basic checks.
• Phishing campaigns still make up 87% of social engineering attacks, despite filter improvements across cloud email platforms.
• User reports and feedback loops can cut dwell time for undetected phishing emails by hours, accelerating global filter updates and takedowns.
• Dark web sharing of phishing signatures has improved coordinated filter response times by an average of 12 hours, shrinking active campaign lifespans.
• Many organizations continue to see AI-crafted phishing regularly bypass standard spam filters, prompting 2026 guidance to “go beyond the spam filter” with layered defenses.

Phishing Demographics by Age Group

• 18–24 years: about 12% fall for phishing attempts, while roughly 88% avoid or suspect them, making this the lowest-click age band.
• 25–44 years: around 20% of people are successfully phished, the highest success rate among the main working-age population.
• 45–64 years: approximately 18% of users in this group fall for phishing, slightly less vulnerable than 25–44-year-olds.

Role of AI and Automation in Phishing Campaigns

• AI-generated or AI-assisted content now appears in around 80%+ of phishing emails, after a 1,265% surge in generative-AI-driven attacks.
• Experiments show AI-written phishing emails can reach click-through rates up to 54%, compared with about 12% for traditional campaigns.
• Successful phishing scams explicitly attributed to AI tools rose by roughly 400% in a single year, as generative models scaled attacker output.
• AI-enhanced spear phishing messages achieve click rates more than 4x higher than human-crafted lures in controlled tests.
• Automation and phishing-as-a-service platforms now allow near real-time campaign iteration, with some providers pushing a new AI-driven phishing variant every 42 seconds.
• AI accelerates content production dramatically, cutting the time to craft a convincing phishing email from 16 hours manually to about 5 minutes with LLMs.
• AI-generated phishing emails achieve credential theft in roughly 33.6% of cases once a victim interacts, making them highly profitable for attackers.
• AI scam volumes overall surged by about 1,210%, with projected losses from AI-powered fraud expected to hit $40 billion within a few years.
• Polymorphic, AI-driven phishing that constantly mutates subjects and content significantly increases filter evasion, helping many lures slip past legacy defenses by double-digit percentages.

Financial Impact of Phishing Attacks

• The average phishing-related data breach now costs about $4.8 million globally, making phishing the costliest initial attack vector.
• In the US, the average cost of a data breach has risen to $10.22 million per incident, the highest of any country.
• Global phishing-related losses are projected to exceed $25 billion per year, driven by Business Email Compromise and credential theft.
• Phishing is the initial attack vector in 16% of all data breaches, with an average cost of $4.8 million per breach.
• Reported cybercrime complaints reached 859,532 in a recent year, with losses of $16.6 billion, heavily influenced by phishing and spoofing schemes.
• For small businesses, 37% of those attacked lost more than $500,000 per incident, forcing 38% to raise prices to cover losses.
• Ransomware, often initiated via phishing, is forecast to cost the world $74 billion in a single year when all damages are counted.

Different Types of Spam Emails

• Marketing and advertising emails remain the largest spam category at 36% of all spam volume.
• Adult content emails account for about 31.7% of spam, making them the second most common type.
• Financial-related emails, including loans and investment offers, represent roughly 26.5% of total spam.
• Scams and fraudulent emails make up around 2.5% of spam traffic overall.
• Miscellaneous and other spam types collectively account for the remaining 3.3% of spam emails.

Phishing Trends in Business Email Compromise (BEC)

• BEC scams have driven at least $2.77 billion in reported US losses, with global phishing-driven losses projected to surpass $25 billion annually.
• The average reported loss per BEC incident is about $137,000, up 83% from 2019 complaint averages.
• BEC accounted for roughly $2.9 billion of the $16.6 billion in US cyber fraud losses in one recent year.
• IC3 data shows BEC losses globally have exceeded $55.5 billion over the past decade.
• One recent insurance report found BEC involved in 36% of all cyber claims, more than any other single category.
• BEC attacks increased by about 171% year over year in one large mid-market cyber claims dataset.
• Around 57–63% of organizations reported experiencing at least one BEC attack in a recent year.
• Roughly 95% of BEC attacks still begin with phishing emails as the initial vector.
• In recent investigations, 81% of all analyzed incidents at one provider were BEC, and 63% originated from phishing links.

Employee Click-Through and Engagement Rates

• The average phishing email click-through rate in recent large studies is about 2.7% across organizations.
• Well-trained organizations in Verizon-style simulations report median click rates as low as 1.5% on fake phishing emails.
• Before structured training, about 11% of employees typically fail by clicking on malicious links or attachments in simulations.
• Continuous behavior-change programs have cut malicious click rates by up to 87% over 6–12 months of training.
• Security awareness programs can reduce phishing susceptibility by over 40% within 90 days and up to 86% within a year.
• Users who complete high-quality interactive training show about a 19% lower phishing failure rate than untrained peers.
• Embedded, just‑in‑time training has been shown to drop phishing susceptibility by around 40% on average.
• In one Zurich study, built‑in email training cut phishing failure rates from 47.5% down to 24.5%.
• Organizations that run sustained simulations report click rates dropping from 20–30% baselines to low single digits within 12–18 months.

Common Subject Lines and Triggers Used in Phishing Emails

• The most-clicked phishing subjects include “Change of Password Required Immediately” with a 26% click rate and multiple password-reset variants between 6–14%.
• HR-themed subjects such as policy updates and benefit changes now make up about 50% of the most-clicked simulated phishing emails.
• System and service notifications like password checks, security alerts, and delivery failures commonly drive click rates in the 10–15% range.
• Subject lines referencing invoices, receipts, or refunds are frequently used and can reach click rates around 10% in many environments.
• Social media-related subjects, especially LinkedIn connection or password reset emails, help drive social phishing attacks, which are up by more than 70%.
• Holiday or event-related HR subjects are highly effective, with 4 out of 5 top holiday phishing subjects posing as HR communications.
• Across email more broadly, 47% of recipients open emails based on the subject line alone, while 69% report spam solely due to subject content.

Frequently Asked Questions (FAQs)

Conclusion

Phishing today is no longer a crude, typo-laden attempt to fool the gullible. It’s a multi-layered, AI-powered assault on human behavior, business processes, and digital trust. With the rise of deepfakes, automation, and real-time adaptive content, today’s phishing emails are smarter, faster, and harder to detect than ever.

Every statistic tells a story of evolving tactics and shifting targets. But they also tell us where to focus: better training, adaptive technology, and proactive response. Whether you’re a solo entrepreneur or part of a multinational, staying ahead of phishing trends is no longer optional; it’s essential.