Phishing and Smishing Statistics (2026)

How many phishing sites are launched, what phishing and business email compromise cost, and how often organizations and consumers are targeted, from industry trackers and government agencies.

By Siddharth ShankarUpdated October 12, 202643 statistics · 12 sourcesCite this page

Key takeaways

• Phishing volume keeps rising. APWG recorded 971,181 phishing sites in Q1 2026 and 1,069,681 in Q2, and June’s 425,808 was the highest month since April 2023 (APWG).
• FBI-reported losses from phishing and spoofing rose from $70.0 million in 2024 to $215.8 million in 2025, about 3.1 times (our calculation), even though complaints were flat at about 191,000 (IC3).
• Business email compromise is the costlier cousin: $3.05 billion across 24,768 FBI complaints in 2025.
• Text and voice channels are growing. APWG saw smishing up 40% and vishing up 20% quarter on quarter in Q2 2026.
• 38% of UK businesses experienced phishing, and for 69% of organizations that had a breach, phishing was the most disruptive type (UK government survey).

Phishing volume: APWG trends

The Anti-Phishing Working Group (APWG) publishes quarterly counts of the phishing sites it has detected. The figures below are from the first and second quarters of 2026.

The three monthly figures for Q2 add to 1,069,682, one more than the APWG quarterly total of 1,069,681. We show APWG’s numbers as printed; the difference is rounding in the source. The telecom share swung from 33% in Q1 to 4.2% in Q2. The Q2 report quotes Crane Authentication saying scammers are “most likely pivoting to other targets that offer webmail”.

Business email compromise

Business email compromise (BEC) is a targeted form of phishing in which a criminal impersonates an executive, supplier or advisor to redirect a payment. It generates far larger losses per case than mass phishing.

Phishing and spoofing complaints to the FBI

Complaints fell slightly while losses tripled, so the average loss per complaint rose from about $362 to about $1,127 (our calculation). The pages of the IC3 report we read do not explain the change, so we do not offer a cause.

Phishing at organizations and for consumers

The UK survey measures which organizations experienced an attack type, not how many attacks occurred. The ACCC does not say in the release we read why text-scam reports fell between 2024 and 2025; reports fell while losses to scams overall rose, so a fall in reports is not a fall in losses. The Verizon summary we read does not give the comparison group for the 40% mobile click rate.

To judge a suspicious message, use our guides on real breach notices versus phishing and how scammers get your phone number and email. Real cases are covered in an SMS phishing case that emptied 39 bank accounts and the LabHost phishing-as-a-service takedown.

Methodology and limitations

Every figure on this page comes from the organization that published it, such as a regulator, a government agency or the original report. We read the source page or document directly, and we record the period each figure covers. When a number could not be confirmed against a primary source, we left it out. Rows marked “Our calculation” are simple arithmetic on published figures, and the inputs are named in the same row.

• APWG’s count reflects sites detected and reported, so a rise can reflect better detection as well as more attacks.
• The IC3 counts complaints that victims chose to file. It does not count all phishing, and the category “phishing and spoofing” is separate from BEC.
• The UK survey covers organizations that responded, in fieldwork from August to December 2025.

Counts of reports, complaints and notifications measure what was reported or notified, not everything that happened. Currency symbols follow the source. Where an agency does not name its currency, we show the symbol the source uses (for example, C$ for Canada and A$ for Australia are our labels). Figures from different countries use different definitions and should not be added together. Spot an error? Tell us and include the source link; we correct verified errors and note the date at the top of the page.