The Uptime report

Uptime Report Research · Evidence Board

Phishing Statistics 2026: Attacks Up 33% Since 2021, FBI Phishing Complaints Down 44%

Phishing statistics from three primary sources point in different directions. The Anti-Phishing Working Group logged 3,799,693 unique phishing sites in 2025, up 33% on 2021, while phishing and spoofing complaints to the FBI fell 44% to 191,561. Business email compromise losses reached $3.05B, and 24.3% of large healthcare breaches reported in 2025 listed email as a location.

Attacks seen3.80Munique phishing sites, APWG, 2025 (+33% vs 2021)
Complaints filed191,561phishing/spoofing complaints to FBI IC3, 2025 (-44% vs 2021)
Money lost$3.05Bbusiness email compromise losses reported to IC3, 2025
Breaches caused24.3%of 2025 HHS healthcare breaches listed email (195 of 802)

Many of the pages that rank for phishing statistics are built on vendor surveys. We went to four public measurements that are published on a regular schedule: phishing sites reported to the Anti-Phishing Working Group (APWG), complaints filed with the FBI’s Internet Crime Complaint Center (IC3), dollar losses in those complaints, and healthcare breaches reported to the US Department of Health and Human Services (HHS). We pulled every APWG quarterly report from 2019 to 2026, six IC3 annual reports, and the full HHS breach file, and extracted or computed each number below. They measure different things, so each gets its own panel before we put them side by side.

Attacks seen

Source: APWG trends reports

Unique phishing sites per month, July 2020 to June 2026

0k200k400k600k202120222023202420252026Mar 2023: 619,060Jun 2026: 425,808Jul 2020: 171,040 unique phishing sitesAug 2020: 201,591 unique phishing sitesSep 2020: 199,133 unique phishing sitesOct 2020: 225,304 unique phishing sitesNov 2020: 212,878 unique phishing sitesDec 2020: 199,120 unique phishing sitesJan 2021: 245,771 unique phishing sitesFeb 2021: 158,898 unique phishing sitesMar 2021: 207,208 unique phishing sitesApr 2021: 204,050 unique phishing sitesMay 2021: 190,762 unique phishing sitesJun 2021: 222,127 unique phishing sitesJul 2021: 260,642 unique phishing sitesAug 2021: 255,385 unique phishing sitesSep 2021: 214,345 unique phishing sitesOct 2021: 267,530 unique phishing sitesNov 2021: 304,308 unique phishing sitesDec 2021: 316,747 unique phishing sitesJan 2022: 331,698 unique phishing sitesFeb 2022: 309,979 unique phishing sitesMar 2022: 384,291 unique phishing sitesApr 2022: 362,852 unique phishing sitesMay 2022: 353,242 unique phishing sitesJun 2022: 381,717 unique phishing sitesJul 2022: 425,112 unique phishing sitesAug 2022: 430,141 unique phishing sitesSep 2022: 415,630 unique phishing sitesOct 2022: 440,508 unique phishing sitesNov 2022: 450,390 unique phishing sitesDec 2022: 459,139 unique phishing sitesJan 2023: 495,690 unique phishing sitesFeb 2023: 509,394 unique phishing sitesMar 2023: 619,060 unique phishing sitesApr 2023: 597,789 unique phishing sitesMay 2023: 381,572 unique phishing sitesJun 2023: 306,847 unique phishing sitesJul 2023: 327,294 unique phishing sitesAug 2023: 331,962 unique phishing sitesSep 2023: 340,700 unique phishing sitesOct 2023: 356,538 unique phishing sitesNov 2023: 350,776 unique phishing sitesDec 2023: 370,187 unique phishing sitesJan 2024: 358,107 unique phishing sitesFeb 2024: 314,974 unique phishing sitesMar 2024: 290,913 unique phishing sitesApr 2024: 318,651 unique phishing sitesMay 2024: 292,428 unique phishing sitesJun 2024: 266,457 unique phishing sitesJul 2024: 289,324 unique phishing sitesAug 2024: 301,507 unique phishing sitesSep 2024: 342,092 unique phishing sitesOct 2024: 345,881 unique phishing sitesNov 2024: 313,288 unique phishing sitesDec 2024: 329,954 unique phishing sitesJan 2025: 337,998 unique phishing sitesFeb 2025: 318,513 unique phishing sitesMar 2025: 347,413 unique phishing sitesApr 2025: 335,139 unique phishing sitesMay 2025: 349,511 unique phishing sitesJun 2025: 365,381 unique phishing sitesJul 2025: 351,590 unique phishing sitesAug 2025: 289,848 unique phishing sitesSep 2025: 251,056 unique phishing sitesOct 2025: 269,558 unique phishing sitesNov 2025: 287,995 unique phishing sitesDec 2025: 295,691 unique phishing sitesJan 2026: 320,264 unique phishing sitesFeb 2026: 329,625 unique phishing sitesMar 2026: 321,292 unique phishing sitesApr 2026: 325,934 unique phishing sitesMay 2026: 317,940 unique phishing sitesJun 2026: 425,808 unique phishing sites

APWG counts unique base URLs of phishing sites reported by its members and the public. The series starts in July 2020, when APWG changed its counting method; earlier months are not comparable.

3,799,693

unique phishing sites in 2025, according to APWG’s quarterly Phishing Activity Trends Reports. That is 33% more than the 2,847,773 of 2021, the first full year under the current method.

The count peaked in 2023 at 4,987,809, with the single highest month in March 2023 (619,060). It then fell 25% in 2024 and moved +1.0% in 2025. January to June 2026 totals 2,040,863, against 2,053,955 a year earlier (-0.6%), but June 2026 alone reached 425,808, the most in any month since April 2023.

Complaints filed

Source: FBI IC3 annual reports

Phishing/spoofing complaints to IC3 by year, with share of all IC3 complaints

0k100k200k300k400k2020: 269,560 phishing/spoofing complaints, 34% of 791,790 IC3 complaints270k202034% of all2021: 342,494 phishing/spoofing complaints, 40% of 847,376 IC3 complaints342k202140% of all2022: 321,136 phishing/spoofing complaints, 40% of 800,944 IC3 complaints321k202240% of all2023: 298,878 phishing/spoofing complaints, 34% of 880,418 IC3 complaints299k202334% of all2024: 193,407 phishing/spoofing complaints, 23% of 859,532 IC3 complaints193k202423% of all2025: 191,561 phishing/spoofing complaints, 19% of 1,008,597 IC3 complaints192k202519% of all

IC3’s current Phishing/Spoofing category. 2021 and 2022 are IC3’s own restated figures from its 2023 report; 2020 is our sum of the then separate Phishing and Spoofing rows.

191,561

phishing and spoofing complaints filed with the FBI’s IC3 in 2025, down from 342,494 in 2021 (-44%) and from 298,878 in 2023.

The drop is specific to phishing. Total IC3 complaints rose to 1,008,597 in 2025, the first year above one million, so phishing’s share of everything people reported fell from 40% in 2021 to 19%. Phishing/spoofing is still the single most reported crime type in the 2025 report. IC3’s annual reports, which we also used to track ransomware reported to the FBI over five years, do not explain the fall in phishing complaints.

Money lost

Source: FBI IC3 annual reports

Business email compromise Phishing/spoofing (reported losses)

$0B$1B$2B$3B2020: BEC losses $1.87B across 19,369 complaints2020: phishing/spoofing losses $270.8M across 269,560 complaints$1.87B$270.8M20202021: BEC losses $2.40B across 19,954 complaints2021: phishing/spoofing losses $126.4M across 342,494 complaints$2.40B$126.4M20212022: BEC losses $2.74B across 21,832 complaints2022: phishing/spoofing losses $160.0M across 321,136 complaints$2.74B$160M20222023: BEC losses $2.95B across 21,489 complaints2023: phishing/spoofing losses $18.7M across 298,878 complaints$2.95B$18.7M20232024: BEC losses $2.77B across 21,442 complaints2024: phishing/spoofing losses $70.0M across 193,407 complaints$2.77B$70M20242025: BEC losses $3.05B across 24,768 complaints2025: phishing/spoofing losses $215.8M across 191,561 complaints$3.05B$215.8M2025

Losses as published by IC3 for each crime type, on one shared dollar axis.

$3.05B

lost to business email compromise (BEC) in 2025, across 24,768 complaints. Both the count and the loss are the highest in the six IC3 reports from 2020 to 2025.

Complaints filed as phishing or spoofing carry far less money: $215.8M in 2025, though that is up from $70.0M in 2024 and $18.7M in 2023. Per complaint, BEC averaged about $123,005 in 2025 and phishing/spoofing about $1,127. BEC complaints rose 16% in 2025 while phishing complaints held flat.

Breaches caused

Source: HHS OCR breach portal

Hacking/IT incident Other breach types (mostly unauthorized access or disclosure). Label: share of all breaches that year.

01002003002015: 40 of 270 breaches listed email (14.8%); 14 hacking/IT incidents; 674,043 individuals2015: 40 of 270 breaches listed email (14.8%); 14 hacking/IT incidents; 674,043 individuals15%’152016: 51 of 328 breaches listed email (15.5%); 18 hacking/IT incidents; 1,064,621 individuals2016: 51 of 328 breaches listed email (15.5%); 18 hacking/IT incidents; 1,064,621 individuals16%’162017: 90 of 357 breaches listed email (25.2%); 49 hacking/IT incidents; 874,971 individuals2017: 90 of 357 breaches listed email (25.2%); 49 hacking/IT incidents; 874,971 individuals25%’172018: 123 of 368 breaches listed email (33.4%); 91 hacking/IT incidents; 3,863,485 individuals2018: 123 of 368 breaches listed email (33.4%); 91 hacking/IT incidents; 3,863,485 individuals33%’182019: 215 of 511 breaches listed email (42.1%); 181 hacking/IT incidents; 5,622,952 individuals2019: 215 of 511 breaches listed email (42.1%); 181 hacking/IT incidents; 5,622,952 individuals42%’192020: 245 of 663 breaches listed email (37.0%); 203 hacking/IT incidents; 13,184,483 individuals2020: 245 of 663 breaches listed email (37.0%); 203 hacking/IT incidents; 13,184,483 individuals37%’202021: 205 of 715 breaches listed email (28.7%); 162 hacking/IT incidents; 7,720,126 individuals2021: 205 of 715 breaches listed email (28.7%); 162 hacking/IT incidents; 7,720,126 individuals29%’212022: 173 of 718 breaches listed email (24.1%); 151 hacking/IT incidents; 5,813,541 individuals2022: 173 of 718 breaches listed email (24.1%); 151 hacking/IT incidents; 5,813,541 individuals24%’222023: 137 of 745 breaches listed email (18.4%); 105 hacking/IT incidents; 2,923,961 individuals2023: 137 of 745 breaches listed email (18.4%); 105 hacking/IT incidents; 2,923,961 individuals18%’232024: 173 of 741 breaches listed email (23.3%); 147 hacking/IT incidents; 3,794,586 individuals2024: 173 of 741 breaches listed email (23.3%); 147 hacking/IT incidents; 3,794,586 individuals23%’242025: 195 of 802 breaches listed email (24.3%); 158 hacking/IT incidents; 3,377,324 individuals2025: 195 of 802 breaches listed email (24.3%); 158 hacking/IT incidents; 3,377,324 individuals24%’252026 (Jan to Sep 21): 116 of 566 breaches listed email (20.5%); 99 hacking/IT incidents; 1,002,990 individuals2026 (Jan to Sep 21): 116 of 566 breaches listed email (20.5%); 99 hacking/IT incidents; 1,002,990 individuals20%’26*

Breaches of 500 or more records whose “Location of Breached Information” includes Email, by submission year. *2026 runs to September 21, the latest submission in our October 2026 download.

195 of 802

large healthcare breaches reported to HHS in 2025 listed email as a location of breached data (24.3%). 158 of them were classed as hacking or IT incidents; most of the rest were unauthorized access or disclosure.

Email breaches peaked at 245 in 2020, and the email share peaked at 42.1% in 2019. They are frequent but small: 3,377,324 individuals in 2025, 2.4% of everyone affected, with a median of 2,703 records against 4,836 for all breaches. By September 21, the 2026 file has 116 email breaches out of 566 (20.5%), against 158 of 605 (26.1%) by the same date in 2025. Our healthcare data breach report breaks down the rest of the HHS file.

Is phishing rising while complaints fall?

Partly. Indexed to 2021, APWG’s phishing site count is 133 while IC3 phishing complaints are at 56. Over the full period the two moved in opposite directions. Since 2023 both fell, but complaints fell harder (-36% against -24% for sites). In 2025 both were roughly flat (sites +1.0%, complaints -1.0%).

408012016020020212022202320242025APWG phishing sites, 2021: 100 (2021 = 100)APWG phishing sites, 2022: 167 (2021 = 100)APWG phishing sites, 2023: 175 (2021 = 100)APWG phishing sites, 2024: 132 (2021 = 100)APWG phishing sites, 2025: 133 (2021 = 100)IC3 phishing/spoofing complaints, 2021: 100 (2021 = 100)IC3 phishing/spoofing complaints, 2022: 94 (2021 = 100)IC3 phishing/spoofing complaints, 2023: 87 (2021 = 100)IC3 phishing/spoofing complaints, 2024: 56 (2021 = 100)IC3 phishing/spoofing complaints, 2025: 56 (2021 = 100)IC3 BEC complaints, 2021: 100 (2021 = 100)IC3 BEC complaints, 2022: 109 (2021 = 100)IC3 BEC complaints, 2023: 108 (2021 = 100)IC3 BEC complaints, 2024: 107 (2021 = 100)IC3 BEC complaints, 2025: 124 (2021 = 100)HHS breaches involving email, 2021: 100 (2021 = 100)HHS breaches involving email, 2022: 84 (2021 = 100)HHS breaches involving email, 2023: 67 (2021 = 100)HHS breaches involving email, 2024: 84 (2021 = 100)HHS breaches involving email, 2025: 95 (2021 = 100)● APWG phishing sites 133● IC3 BEC complaints 124● HHS breaches involving email 95● IC3 phishing/spoofing complaints 56

Each series divided by its own 2021 value and multiplied by 100. 2026 is excluded because IC3 has not published it and the other two are partial.

What the data supports. Reported phishing infrastructure stayed near 3.8 million sites a year in 2024 and 2025, 33% above 2021. BEC complaints and losses reached six-year highs in 2025. Email remains a location in about one in four large healthcare breaches.
What it does not support. That phishing is fading. Phishing complaints fell 44% from 2021 while total IC3 complaints rose 19%, and none of the three sources gives a reason for the fall. APWG itself notes that its counts are reports and that some mail systems now stop users from forwarding phishing emails to it.

All four measures, year by year

Year APWG FBI IC3 HHS OCR (healthcare)
Unique phishing sites Phishing/spoofing complaints Share of all complaints Phishing/spoofing losses BEC complaints BEC losses Breaches listing email Share of all breaches Individuals in email breaches
2020 1,209,066a 269,560 34% $270.8M 19,369 $1.87B 245 37.0% 13,184,483
2021 2,847,773 342,494 40% $126.4M 19,954 $2.40B 205 28.7% 7,720,126
2022 4,744,699 321,136 40% $160.0M 21,832 $2.74B 173 24.1% 5,813,541
2023 4,987,809 298,878 34% $18.7M 21,489 $2.95B 137 18.4% 2,923,961
2024 3,763,576 193,407 23% $70.0M 21,442 $2.77B 173 23.3% 3,794,586
2025 3,799,693 191,561 19% $215.8M 24,768 $3.05B 195 24.3% 3,377,324
2026* 2,040,863b IC3 2026 report not yet published 116 20.5% 1,002,990

a July to December 2020 only (APWG counting method changed in Q3 2020). b January to June 2026. *2026 HHS figures run to September 21.

Is it true that 90% of cyberattacks start with phishing?

Not in the primary data we could check. The figure circulates widely, but none of these sources produces anything close to it. When we coded every CISA #StopRansomware advisory by entry technique for our analysis of ransomware initial access vectors, phishing appeared in 13 of the 22 advisories that list initial access (59%), behind exploits of public-facing applications. In the HHS file, 24.3% of 2025 breaches listed email as a location of breached data. In IC3’s 2025 data, phishing/spoofing was 19% of complaints. Phishing is common in each dataset; it is not nine in ten in any of them.

What this means for MSPs

Reported phishing sites are still a third above their 2021 level, so falling complaint counts are not a reason to cut email security from a client stack. The money is in BEC: the average BEC complaint in 2025 reported about $123,005 lost. Practical priorities:

  • Phishing-resistant MFA first for admins and finance staff. CISA, NSA, the FBI and MS-ISAC write in their joint phishing guidance that “if weak forms of MFA are enabled, malicious actors can still obtain access through phishing and other techniques,” and that FIDO or PKI-based MFA is phishing resistant.
  • DMARC at reject. The same guidance says to ensure DMARC is set to “reject” for sent emails, so that spoofed emails impersonating the domain “are rejected at the mail server prior to delivery.”
  • Out-of-band payment checks. A call-back rule for any change to bank details targets BEC, the crime type with the second-largest losses in IC3’s 2025 data, behind investment fraud.
  • Mailbox breach readiness for healthcare clients. About one in four HHS-reported breaches in 2025 involved email. Turn on mailbox audit logging so that, after an account compromise, you can establish which messages and records were accessed.
  • Report phishing upstream. APWG’s counts depend on reports. Forwarding samples to reportphishing@apwg.org and filing BEC losses at ic3.gov quickly also feeds the FBI’s Recovery Asset Team.

Frequently asked questions

What are the latest phishing statistics?

APWG counted 3,799,693 unique phishing sites in 2025, about level with 3,763,576 in 2024 and below the record 4,987,809 in 2023. In January to June 2026 it counted 2,040,863, against 2,053,955 in the same months of 2025. June 2026 alone had 425,808, the highest monthly total since April 2023.

Is it true that 90% of cyberattacks start with phishing?

None of the primary datasets we checked shows a figure near 90%. Phishing is listed as an initial access technique in 13 of 22 CISA #StopRansomware advisories that name one (59%), email was a location of breached data in 24.3% of 2025 HHS healthcare breaches, and phishing/spoofing made up 19% of 2025 FBI IC3 complaints.

How many people are phished per year?

No source counts every phishing victim. The closest US measure is FBI IC3 complaints: IC3 received 191,561 phishing or spoofing complaints in 2025, down from 342,494 in 2021. These are reports, so the real number of people targeted is far higher.

How common is business email compromise?

The FBI IC3 received 24,768 business email compromise complaints in 2025, with reported losses of $3.05B, about $123,005 per complaint. Both are the highest of the 2020 to 2025 reports we read.

Are phishing attacks increasing?

Since 2021, yes: APWG’s count of phishing sites was 33% higher in 2025 than in 2021. Over two years, no: it fell 24% from the 2023 record and has been nearly flat since, with +1.0% in 2025.

How many healthcare data breaches involve email?

In 2025, 195 of the 802 breaches of 500 or more records reported to HHS listed email as a location of breached information (24.3%), affecting 3,377,324 individuals. 158 of those 195 were classed as hacking or IT incidents.

Download the data. phishing-statistics-apwg-fbi-ic3-hhs-2019-2026.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.

Methodology

APWG. We downloaded all 30 quarterly Phishing Activity Trends Reports from Q1 2019 to Q2 2026 from docs.apwg.org (retrieved October 2026) and extracted the monthly “Number of unique phishing Web sites (attacks)” from each report’s statistical highlights table. APWG defines this as unique base URLs of phishing sites reported by members, Global Research Partners and the public. With its Q3 2020 report APWG changed how it counts sites, so we use only July 2020 onward for trends. Annual totals are sums of the monthly values; they reproduce APWG’s own published annual figures (4,987,809 for 2023, about 3.76 million for 2024, about 3.8 million for 2025). One inconsistency: APWG’s Q2 2025 text gives 1,130,393 attacks for that quarter, but its monthly table sums to 1,050,031. We use the monthly table, which is the figure consistent with APWG’s 2025 annual total.

FBI IC3. We read the 2020 to 2025 Internet Crime Reports and took the counts and losses for Phishing/Spoofing and Business Email Compromise from each report’s crime type tables. IC3 merged phishing and spoofing into one category in its 2023 report and restated 2021 and 2022 on that basis; we use the restated values. For 2020 we added the separate Phishing/Vishing/Smishing/Pharming (241,342) and Spoofing (28,218) rows; the same method applied to 2021 gives 342,494, matching IC3’s restatement. Losses are as reported by complainants and published by IC3. IC3 data covers complaints filed, not all incidents.

HHS OCR. The full breach portal export (current and archived breaches of 500 or more records, 2009 to 2026), downloaded October 2026. A breach counts as an email breach if its “Location of Breached Information” field includes Email, alone or with other locations. Years are breach submission years. The location field records where the data was, not how the attacker got in, so an email breach is not proof of phishing; we report hacking/IT incidents separately as the closer proxy. 2026 is partial (to September 21) and recent submissions are added with a lag.

What we did not use. Vendor surveys and simulated-phishing click rates, because their samples and methods change from year to year. We did not include Google Safe Browsing counts because no downloadable series was available to us.

Not advice. This is an analysis of public data, not security advice for any specific environment.

Cite as:The Uptime Report. "Phishing Statistics 2026: Attacks Up 33% Since 2021, FBI Phishing Complaints Down 44%." October 2026. https://theuptimereport.com/phishing-statistics/

References

  1. Anti-Phishing Working Group, Phishing Activity Trends Reports, Q1 2019 to Q2 2026 (for example Q4 2025 and Q2 2026). Accessed October 2026.
  2. FBI Internet Crime Complaint Center, 2020 Internet Crime Report. Accessed October 2026.
  3. FBI Internet Crime Complaint Center, 2021 Internet Crime Report. Accessed October 2026.
  4. FBI Internet Crime Complaint Center, 2022 Internet Crime Report. Accessed October 2026.
  5. FBI Internet Crime Complaint Center, 2023 Internet Crime Report. Accessed October 2026.
  6. FBI Internet Crime Complaint Center, 2024 Internet Crime Report. Accessed October 2026.
  7. FBI Internet Crime Complaint Center, 2025 Internet Crime Report. Accessed October 2026.
  8. US Department of Health and Human Services, Office for Civil Rights, Breach Portal. Accessed October 2026.
  9. CISA, NSA, FBI and MS-ISAC, Phishing Guidance: Stopping the Attack Cycle at Phase One. Accessed October 2026.

Research library

More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

Threats and breaches

Infrastructure and uptime

Regulation and disclosure

Workforce and pay

MSP market and spending

Comments

3 responses to “Phishing Statistics 2026: Attacks Up 33% Since 2021, FBI Phishing Complaints Down 44%”

  1. Ransomware Statistics 2026: Monthly Leak-Site Data

    […] Phishing Statistics 2026Four phishing measures, one evidence board […]

    Reply
  2. Highest Paying Cities for IT Jobs 2026: Metro Pay

    […] Phishing Statistics 2026Four phishing measures, one evidence board […]

    Reply
  3. Data Centers by State 2026: Sites, Jobs, and Power

    […] Phishing Statistics 2026Four phishing measures, one evidence board […]

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

More posts