In 2024, phishing is no longer just a “bad email” problem it is a full chain of compromises, with spear phishing tied to 65% of attacks in Verizon’s DBIR and MFA blocking 99.9% of account takeovers post phish. Yet traditional filters catch only 19% of phishing emails, while APWG found Microsoft brand impersonation leading the charge at 38% in Q4 2023. The gap between what filters stop and what attackers still land is where the real risk lives.
Key Takeaways
- Email spear-phishing involved in 65% of attacks per Verizon DBIR 2024
- APWG Q4 2023: 38% of phishing used brand impersonation of Microsoft
- Proofpoint 2024: 96% of phishing uses email as primary vector
- Only 19% of phishing emails detected by traditional filters per Proofpoint 2024
- KnowBe4 2024: Phishing simulation training reduced clicks by 55%
- Verizon DBIR 2024: MFA blocked 99.9% of account compromise post-phish
- The average global cost of a phishing attack in 2023 reached $4.91 million according to IBM's Cost of a Data Breach Report 2024
- FBI IC3 2023 reported total phishing losses exceeding $18.7 million from 298,878 complaints
- Verizon DBIR 2024 estimated phishing-related breaches cost an average of $4.45 million per incident
- In Q4 2023, the Anti-Phishing Working Group (APWG) detected 5,020,947 phishing attacks worldwide, marking a 47% increase from Q3
- Verizon's 2024 Data Breach Investigations Report (DBIR) found that 36% of all data breaches involved phishing as the initial access vector
- Proofpoint's 2024 State of the Phish report indicated that 84% of organizations experienced at least one successful phishing attack in the past year
- 84% of millennials have experienced phishing attempts, per Proofpoint 2024 State of the Phish
- KnowBe4 2024 report found finance sector employees 25% more phished than average
- Verizon DBIR 2024 showed 22% of phishing victims were executives (whaling)
Phishing keeps surging, yet MFA and training significantly reduce compromise and losses.
Related reading
01 · Category
Attack Vectors24 stats
01
Email spear-phishing involved in 65% of attacks per Verizon DBIR 2024
02
APWG Q4 2023: 38% of phishing used brand impersonation of Microsoft
03
Proofpoint 2024: 96% of phishing uses email as primary vector
04
KnowBe4 2024: Smishing (SMS phishing) rose 328% in simulations
05
IBM 2024: BEC phishing accounted for 17% of initial breaches
06
FBI IC3 2023: 50% of phishing via email, 20% phone (vishing)
07
Statista 2024: HTTPS phishing sites now 81% of total attacks
08
Cisco 2024: Malware phishing links in 79% of attacks
09
Zscaler 2024: QR code phishing (quishing) up 51% in 2023
10
Symantec 2024: Social media phishing 30% of non-email vectors
11
Barracuda 2024: Attachment-based phishing 42% of email threats
12
Sophos 2024: Phished credentials used in 60% ransomware attacks
13
Mimecast 2024: URL-based phishing dominant at 68%
14
Abnormal 2024: AI-generated phishing content up 400%
15
Hornetsecurity 2024: Holiday-themed phishing 250% spike
16
Keepnet 2024: Vishing success rate 12% vs. email 5%
17
SlashNext 2023: Mobile phishing apps 40% of Android threats
18
Netcraft 2024: Fast-flux DNS in 25% sophisticated phishing
19
Cofense 2024: Business email compromise via phishing 90% cases
20
PhishLabs 2023: Watering hole attacks in 15% targeted phishing
21
ENISA 2023: Supply chain phishing in 10% major incidents
22
Kaspersky 2023: Malicious links in 70% phishing emails
23
Cloudflare 2024: DDoS-phishing hybrids up 20%
24
Akamai 2023: Credential stuffing post-phishing in 80% breaches
Interpretation
Attack Vectors Interpretation
Attack vectors in phishing are overwhelmingly email led, with Verizon reporting 65% spear-phishing, Proofpoint finding 96% using email as the primary vector, and IBM noting BEC phishing at 17% of initial breaches.
02 · Category
Defensive Measures22 stats
01
Only 19% of phishing emails detected by traditional filters per Proofpoint 2024
02
KnowBe4 2024: Phishing simulation training reduced clicks by 55%
03
Verizon DBIR 2024: MFA blocked 99.9% of account compromise post-phish
04
IBM 2024: AI defenses cut phishing breach costs by $200K avg
05
APWG 2023: DMARC adoption reduced spoofing by 60% in adopters
06
Cisco 2024: Zero-trust models stopped 85% phishing escalations
07
Zscaler 2024: Cloud sandboxing caught 95% evasive phishing
08
Symantec 2024: Endpoint detection prevented 78% phishing malware
09
Barracuda 2024: Email gateways blocked 99% known phishing
10
Sophos 2024: Training + tech reduced ransomware from phishing to 23%
11
Mimecast 2024: URL defense stopped 92% malicious links
12
Abnormal 2024: Behavioral AI detected 99% BEC phishing
13
Hornetsecurity 2024: SPF/DKIM cut spoofed phishing by 70%
14
Keepnet 2024: Awareness training success rate 90% after 6 months
15
SlashNext 2023: Threat intel sharing blocked 80% repeat phishing
16
Netcraft 2024: Browser protections stopped 70% site visits
17
Cofense 2024: Reporting programs reduced dwell time by 50%
18
PhishLabs 2023: SIEM rules caught 65% advanced persistent phishing
19
ENISA 2023: EU-wide CERTs mitigated 75% phishing campaigns
20
Kaspersky 2023: Anti-phishing tech blocked 99.8% attempts for users
21
Cloudflare 2024: Gateway filters prevented 98% phishing traffic
22
Akamai 2023: Bot management stopped 90% automated phishing probes
Interpretation
Defensive Measures Interpretation
Across defensive measures, the trend is clear that combining technology and training can dramatically cut phishing impact, with traditional filters catching just 19% while MFA blocks 99.9% of post-phish account compromises and phishing simulation training cuts clicks by 55%.
03 · Category
Financial Losses27 stats
01
The average global cost of a phishing attack in 2023 reached $4.91 million according to IBM's Cost of a Data Breach Report 2024
02
FBI IC3 2023 reported total phishing losses exceeding $18.7 million from 298,878 complaints
03
Verizon DBIR 2024 estimated phishing-related breaches cost an average of $4.45 million per incident
04
Proofpoint 2024 State of the Phish reported average financial loss per successful phishing attack at $4.9 million for large orgs
05
Ponemon Institute's 2023 study found phishing costs organizations $14.8 million annually on average
06
Statista 2024 data showed global phishing cybercrime losses at $52.5 billion in 2023
07
FTC 2023 Consumer Sentinel reported $12.5 billion in fraud losses, with phishing topping at $2.7 billion
08
IBM 2024 report detailed phishing-led breaches costing $5.6 million on average in healthcare
09
KnowBe4 2024 benchmarking found average phishing training ROI saves $1.7 million per prevented attack
10
APWG 2023 Economic Impact Report estimated $43 billion annual global phishing losses
11
Cisco 2024 Cybersecurity Report valued average phishing downtime at $1.2 million per incident
12
Zscaler 2024 ThreatLabz reported $10.5 billion in BEC phishing losses in 2023
13
Symantec 2024 ISTR noted $4.2 billion lost to phishing in the US alone
14
Barracuda 2024 report calculated $1.8 million average cost for SMB phishing breaches
15
Sophos 2024 ransomware report linked phishing to $2.73 million average recovery cost
16
Mimecast 2024 email security study found $4.5 million average BEC phishing loss
17
Abnormal Security 2024 reported $25 billion projected global phishing losses for 2024
18
Hornetsecurity 2024 trends estimated €1.8 billion EU phishing losses yearly
19
Keepnet 2024 stats showed $190,000average loss per phishing employee click
20
SlashNext 2023 report valued credential phishing at $6 billion annually
21
Netcraft 2024 data indicated $500 million in financial phishing losses Q1
22
Cofense 2024 report calculated $3.9 million average org phishing cost
23
PhishLabs 2023 trends found $8.4 million average enterprise phishing breach cost
24
ENISA 2023 landscape reported €60 billion EU cyber losses with phishing 20%
25
Kaspersky 2023 report showed $1 billion+ losses from phishing in Russia
26
Cloudflare 2024 Q1 threats valued blocked phishing at $2.5 billion potential loss
27
Akamai 2023 SOTI reported $4 billion in account takeover phishing losses
Interpretation
Financial Losses Interpretation
Across 2023, phishing drove staggering Financial Losses, with estimates ranging from an average $4.91 million per breach globally to global cybercrime losses of $52.5 billion, showing that the impact is both consistently costly per incident and massive at scale.
More related reading
04 · Category
Incidence Rates30 stats
01
In Q4 2023, the Anti-Phishing Working Group (APWG) detected 5,020,947 phishing attacks worldwide, marking a 47% increase from Q3
02
Verizon's 2024 Data Breach Investigations Report (DBIR) found that 36% of all data breaches involved phishing as the initial access vector
03
Proofpoint's 2024 State of the Phish report indicated that 84% of organizations experienced at least one successful phishing attack in the past year
04
The FBI's Internet Crime Complaint Center (IC3) 2023 report logged 298,878 phishing complaints, resulting in over $18.7 million in losses
05
APWG Q3 2023 trends showed phishing sites hosted on HTTPS increased to 74% of all detected phishing pages
06
KnowBe4's 2024 Phishing by Industry Benchmarking Report revealed an average of 1 in 9.5 employees vulnerable to phishing across industries
07
IBM's 2024 Cost of a Data Breach Report noted phishing as the top initial attack vector in 16% of breaches globally
08
Statista reported 300,497 phishing attacks detected in the US alone in 2023 by APWG
09
Google's Transparency Report for Q4 2023 blocked 2.3 million phishing sites daily on average
10
Microsoft's Digital Defense Report 2024 stated they blocked 300 million phishing attempts daily across their services
11
APWG Phishing Activity Trends Report for Q1 2024 showed a record 1.5 million unique phishing reports received
12
ENISA Threat Landscape 2023 identified phishing as the most common cyber threat, involved in 94% of malware infections
13
PhishLabs 2023 Phishing Threat Trends Report found 90% of phishing attacks use social engineering tactics
14
FTC Consumer Sentinel Network reported 806,182 phishing-related complaints in 2023
15
Cloudflare's 2024 Q1 Threat Report blocked 20.9 million phishing attempts daily
16
Barracuda Networks 2024 Phishing Threat Trends noted 1 in 5 emails contained phishing attempts
17
Zscaler's 2024 ThreatLabz Report detected 2.7 billion phishing threats in 2023
18
Cisco's 2024 Cybersecurity Report found 90% of organizations faced phishing attacks in the last 12 months
19
Kaspersky's 2023 Spam and Phishing report blocked 383 million phishing attempts on its users
20
Symantec Internet Security Threat Report 2024 identified 67% rise in phishing attacks year-over-year
21
Akamai State of the Internet 2023 reported 1.2 billion credential stuffing attacks, often phishing precursors
22
Sophos State of Ransomware 2024 noted phishing in 47% of ransomware entry points
23
Mimecast 2024 State of Email Security found 68% increase in phishing volume
24
Abnormal Security 2024 Phishing Report detected 1.3 billion phishing emails in 2023
25
Hornetsecurity 2024 Phishing Trends Report showed 300% rise in phishing during holidays
26
Keepnet Labs 2024 Phishing Statistics indicated 3.4 billion phishing emails sent daily worldwide
27
SlashNext 2023 Phishing Report identified 2.9 million phishing sites monthly average
28
Netcraft 2024 Phishing Report blocked 1.1 million phishing sites in Q1
29
AREA 1 Security 2023 Phishing Trends found 85% of breaches start with phishing
30
Cofense 2024 Phishing Threat Report reported 22 billion phishing emails in 2023
Interpretation
Incidence Rates Interpretation
Incidence rates are escalating sharply, with APWG detecting 5,020,947 phishing attacks in Q4 2023 a 47% jump from Q3, while the scale of impact is underscored by 36% of breaches in Verizon’s 2024 DBIR involving phishing as the initial access vector.
05 · Category
Victim Profiles26 stats
01
84% of millennials have experienced phishing attempts, per Proofpoint 2024 State of the Phish
02
KnowBe4 2024 report found finance sector employees 25% more phished than average
03
Verizon DBIR 2024 showed 22% of phishing victims were executives (whaling)
04
FBI IC3 2023 data indicated seniors over 60 filed 40% of phishing complaints
05
Statista 2024 survey: 36% of remote workers fell for phishing in 2023
06
IBM 2024 Cost of Breach: Healthcare workers 30% more susceptible to phishing
07
APWG 2023 trends: 55% of phishing targets financial services customers
08
Cisco 2024 report: Gen Z 28% more likely to click phishing links
09
Proofpoint 2024: Women reported 15% higher phishing victimization rates
10
FTC 2023: 25-34 age group highest phishing loss reporters at $1.2B
11
KnowBe4 2024: IT staff phished at 1 in 7 rate vs. company avg 1 in 10
12
Zscaler 2024: Mobile users 40% more targeted by SMS phishing (smishing)
13
Symantec 2024: Small business owners 2x more likely to be phished
14
Barracuda 2024: Healthcare pros clicked 1.8x more phishing emails
15
Sophos 2024: C-suite executives targeted in 54% of ransomware phishing
16
Mimecast 2024: Hybrid workers 35% higher phishing click rates
17
Abnormal 2024: Finance employees receive 3x more BEC phishing
18
Hornetsecurity 2024: Students 45% vulnerability rate to phishing
19
Keepnet 2024: Managers phished at 22% success rate vs. 12% staff
20
SlashNext 2023: Retail customers 60% of phishing site visitors
21
Netcraft 2024: Over-50s lost $1.5B to tech support phishing
22
Cofense 2024: New hires clicked 4x more phishing simulations
23
PhishLabs 2023: Government employees 28% phishing susceptibility
24
ENISA 2023: EU citizens 1 in 10 fell for phishing yearly
25
Kaspersky 2023: Families with kids 20% higher home phishing risks
26
Cloudflare 2024: US users 42% of global phishing victims
Interpretation
Victim Profiles Interpretation
Under the victim profiles lens, phishing clearly hits specific groups hardest, with 84% of millennials reporting phishing attempts and remote workers also seeing a 36% rate of falling for phishing in 2023.
report visual · Breakdown
Phishing vectors: email dominates
Email spear-phishing is the most common delivery vector, while SMS/phishing and other channels still contribute meaningfully.
65%
Email spear-phishing involved in 65% of attacks per Verizon DBIR 2024
35%
Mimecast 2024: Hybrid workers 35% higher phishing click rates
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Alexander Schmidt. (2026, February 13). Phishing Attack Statistics. Gitnux. https://gitnux.org/phishing-attack-statistics
MLA
Alexander Schmidt. "Phishing Attack Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/phishing-attack-statistics.
Chicago
Alexander Schmidt. 2026. "Phishing Attack Statistics." Gitnux. https://gitnux.org/phishing-attack-statistics.
Sources & references
30 datasets cited across this report · attribution is report-level
akamai.com