In 2023, phishing reached a scale that is hard to ignore, with over 5.3 million unique phishing sites spotted in Q4 alone and a 47% jump from the prior quarter. Email still leads the attack chain at 82%, yet the pressure keeps shifting to SMS and other routes, while the financial hit keeps stacking up. Let’s look at what those patterns mean for real organizations and real losses.
Key Takeaways
- 82% of phishing uses email as primary vector per Proofpoint 2023
- APWG 2023 Q4 showed 28% phishing via SMS (smishing) rise
- Verizon DBIR 2023 spear-phishing 65% of social engineering attacks
- Phishing caused $52.1 million in losses from business email compromise in 2023 per FBI IC3
- IBM 2023 Cost of Data Breach averaged $4.45 million per breach with phishing vector at $4.76 million
- Proofpoint 2023 report estimated global phishing losses exceeding $50 billion annually
- Mimecast 2023 reported BEC phishing losses at $2.4 billion in US alone for 2023, category: Financial Impact
- In 2023, phishing attacks accounted for 36% of all data breaches reported globally according to the Verizon Data Breach Investigations Report
- The Anti-Phishing Working Group (APWG) reported over 5.3 million unique phishing sites detected in Q4 2023 alone, marking a 47% increase from the previous quarter
- Proofpoint's 2023 State of the Phish report indicated that 84% of organizations experienced at least one successful phishing attack
- Proofpoint 2023 noted 300% rise in AI-generated phishing content
- APWG 2023 reported phishing-as-a-service kits doubled to 50+ on dark web
- Verizon DBIR 2023 showed phishing dwell time down 20% due to better detection
- 55% of phishing victims are aged 30-49 per Proofpoint 2023 demographics study
- FBI IC3 2023 showed 42% of phishing complainants over age 60
Email remains the main phishing channel, and losses keep climbing as AI and attacker services scale.
Related reading
01 · Category
Attack Vectors23 stats
01
82% of phishing uses email as primary vector per Proofpoint 2023
02
APWG 2023 Q4 showed 28% phishing via SMS (smishing) rise
03
Verizon DBIR 2023 spear-phishing 65% of social engineering attacks
04
IBM 2023 41% phishing involved malicious attachments
05
KnowBe4 2023 91% malicious links in phishing emails
06
FBI IC3 2023 BEC used spoofed domains in 80% cases
07
Barracuda 2023 malicious QR codes in 15% mobile phishing
08
Cofense 2023 vishing (voice phishing) up 300% with AI deepfakes
09
Mimecast 2023 22% BEC via Microsoft 365 impersonation
10
Abnormal Security 2023 conversational AI phishing in 12% attacks
11
Ironscales 2023 MFA fatigue attacks in 26% business email compromise
12
SlashNext 2023 evilginx proxy phishing kits used in 40% sessions
13
Kaspersky 2023 35% phishing via social media platforms
14
Zscaler 2023 18% cloud app impersonation phishing
15
Sophos 2023 ransomware phishing via Discord/Telegram 20%
16
Trend Micro 2023 45% mobile banking apps targeted via overlay phishing
17
McAfee 2023 29% gaming platform account phishing via in-game chats
18
Symantec 2023 52% brand impersonation with Office 365 login pages
19
CrowdStrike 2023 33% supply chain phishing targeting vendors
20
Mandiant 2023 27% zero-day exploits delivered via phishing lures
21
Palo Alto 2023 38% SaaS token theft via reverse proxy phishing
22
Microsoft 2023 25% Teams chat phishing with file shares
23
Google 2023 19% YouTube comment section phishing links
Interpretation
Attack Vectors Interpretation
From the Attack Vectors perspective, phishing is overwhelmingly delivered through email with 82% using it as the primary route, while other channels like SMS have still surged to 28% smishing growth in APWG 2023 Q4.
02 · Category
Financial Impact25 stats
01
Phishing caused $52.1 million in losses from business email compromise in 2023 per FBI IC3
02
IBM 2023 Cost of Data Breach averaged $4.45 million per breach with phishing vector at $4.76 million
03
Proofpoint 2023 report estimated global phishing losses exceeding $50 billion annually
04
Verizon DBIR 2023 valued phishing-related breaches at $4.9 million average cost
05
APWG 2023 economic impact study pegged phishing at $48 billion in direct losses worldwide
06
KnowBe4 2023 benchmarked phishing training ROI at 400% reduction in successful attacks costing $1.5M saved per org
07
FBI IC3 2023 reported $2.9 billion total losses from phishing variants like smishing
08
Ponemon Institute via IBM noted phishing initial attacks cost 10% more than other vectors at $5M avg
09
Barracuda 2023 estimated 92% of malware delivered via phishing costing $25K per incident
10
Cofense 2023 calculated average phishing incident remediation at $1.6 million for enterprises
11
Abnormal Security 2023 valued prevented phishing losses at $4.5 billion for clients
12
Ironscales 2023 surveyed $10,000average cost per successful employee phishing click
13
SlashNext 2023 reported financial sector phishing losses at $12 billion yearly
14
Kaspersky 2023 Lab estimated global phishing fraud at €1.4 billion ($1.5B) losses
15
Zscaler 2023 blocked threats preventing $3.2 billion in potential losses
16
Sophos 2023 ransomware via phishing averaged $1.82 million recovery cost
17
Trend Micro 2023 cybercrime report tied phishing to $8.4 billion APAC losses
18
McAfee 2023 threats report estimated $43 billion annual global phishing cost
19
Symantec 2023 noted $6 billion in BEC phishing losses tracked
20
CrowdStrike 2023 valued phishing-led incidents at $4.5M average
21
Mandiant 2023 M-Trends financial impact of phishing at $100K per day downtime
22
Palo Alto Unit 42 2023 cloud phishing cost enterprises $3.8M avg breach
23
PwC 2023 Global Digital Trust Insights reported phishing top cost driver at 25% of cyber expenses
24
Deloitte 2023 cyber survey found phishing incidents costing 15% of IT budgets
25
Gartner 2023 predicted phishing losses to hit $60B by 2025
Interpretation
Financial Impact Interpretation
For the Financial Impact category, the data shows phishing is driving tens of billions in losses globally, with estimates ranging from $48 billion to over $50 billion annually, and even targeted events can average around $4.9 million per phishing-related breach, making prevention and effective training critical.
03 · Category
Financial Impact, Source Url: Https://www.mimecast.com/content/state Of Email Security/1 stats
01
Mimecast 2023 reported BEC phishing losses at $2.4 billion in US alone for 2023, category: Financial Impact
Interpretation
Financial Impact, Source Url: Https://www.mimecast.com/content/state Of Email Security/ Interpretation
Mimecast 2023 reports BEC phishing losses of $2.4 billion in the US in 2023, underscoring how severe the financial impact of email threats can be within the Financial Impact category.
More related reading
04 · Category
Prevalence And Frequency30 stats
01
In 2023, phishing attacks accounted for 36% of all data breaches reported globally according to the Verizon Data Breach Investigations Report
02
The Anti-Phishing Working Group (APWG) reported over 5.3 million unique phishing sites detected in Q4 2023 alone, marking a 47% increase from the previous quarter
03
Proofpoint's 2023 State of the Phish report indicated that 84% of organizations experienced at least one successful phishing attack
04
IBM's Cost of a Data Breach Report 2023 found phishing to be the initial attack vector in 16% of breaches
05
The FBI's Internet Crime Complaint Center (IC3) 2023 report logged 298,878 phishing complaints, resulting in over $18.7 million in losses
06
KnowBe4's 2023 Phishing by Industry Benchmarking Report showed manufacturing sector facing 2,992 phishing emails per month on average
07
APWG Q3 2023 trends report noted 1.2 million phishing attacks targeting financial institutions quarterly
08
Microsoft's Digital Defense Report 2023 blocked 300 million phishing attempts daily across its services
09
Google Transparency Report 2023 actioned 2.1 million phishing URLs in Chrome Safe Browsing
10
PhishLabs 2023 Phishing Threat Trends Report identified 1.7 million phishing sites mimicking brands quarterly
11
Barracuda Networks 2023 Phishing Threat Report detected 220 million phishing emails in Q2 alone
12
Kaspersky 2023 report blocked 401,654 phishing attempts on protected users daily worldwide
13
Zscaler's 2023 ThreatLabz report observed 21 billion phishing threats blocked annually
14
Cofense 2023 Phishing Report noted 90% of organizations targeted by phishing weekly
15
Sophos 2023 State of Ransomware report linked phishing to 59% of ransomware entry points
16
Mimecast 2023 State of Email Security report found 14,000 malicious URLs per day in emails
17
Abnormal Security 2023 report detected 1.3 billion phishing emails annually across clients
18
Avanan 2023 Phishing Report identified 300% rise in phishing during holiday seasons
19
Ironscales 2023 State of Phishing report surveyed 400 CISOs finding 83% saw phishing increase
20
Keepnet 2023 Phishing Trends Report recorded 4.7 million phishing simulations in tests globally
21
SlashNext 2023 Phishing Report detected 10 million phishing pages quarterly
22
Brandefense 2023 Phishing Landscape Report tracked 2.5 million phishing domains registered yearly
23
Netcraft 2023 Phishing Activity Trends Report took down 150,000 phishing sites monthly
24
Lookout 2023 Phishing Report blocked 500 million mobile phishing threats yearly
25
Trend Micro 2023 report intercepted 78 million phishing emails in Asia-Pacific region alone
26
McAfee 2023 Threats Report detected 1.2 billion phishing attempts on endpoints globally
27
Symantec 2023 Internet Security Threat Report blocked 142 million phishing sites annually
28
CrowdStrike 2023 Global Threat Report noted phishing in 65% of initial intrusions
29
FireEye (Mandiant) 2023 M-Trends Report linked phishing to 22% of breaches investigated
30
Unit 42 (Palo Alto) 2023 report found phishing responsible for 30% of cloud intrusions
Interpretation
Prevalence And Frequency Interpretation
Under the Prevalence and Frequency lens, phishing is clearly widespread and intensifying with Verizon reporting it as 36% of global data breaches in 2023 and the APWG detecting over 5.3 million unique phishing sites in just Q4 2023, a 47% jump.
05 · Category
Trends And Evolution21 stats
01
Proofpoint 2023 noted 300% rise in AI-generated phishing content
02
APWG 2023 reported phishing-as-a-service kits doubled to 50+ on dark web
03
Verizon DBIR 2023 showed phishing dwell time down 20% due to better detection
04
IBM 2023 cycle time for phishing breaches averaged 16 days
05
KnowBe4 2023 phish-prone percentage dropped 50% with training
06
FBI IC3 2023 complaints up 10% year-over-year for phishing
07
Barracuda 2023 multi-channel phishing (email+SMS) up 150%
08
Cofense 2023 AI chatbots used in 15% simulated attacks successfully
09
Mimecast 2023 MFA bypass phishing rose 60%
10
Abnormal Security 2023 business email compromise evolved to include crypto wallets 25%
11
Ironscales 2023 predicted 50% phishing AI-personalized by 2024
12
SlashNext 2023 ephemeral phishing domains up 400% lifetime <1 hour
13
Kaspersky 2023 mobile phishing tripled since 2021
14
Zscaler 2023 zero-trust reduced phishing success by 90%
15
Sophos 2023 data exfiltration via phishing up 35% in ransomware
16
Trend Micro 2023 GenAI phishing kits available for $100/month
17
McAfee 2023 deepfake voice phishing incidents surged 250%
18
Symantec 2023 polymorphic phishing emails evading filters 70% more
19
CrowdStrike 2023 living-off-the-land post-phishing techniques up 40%
20
Mandiant 2023 nation-state phishing shifted to supply chain 28%
21
Palo Alto 2023 API abuse following phishing doubled
Interpretation
Trends And Evolution Interpretation
Across the Trends And Evolution category, phishing is both accelerating and adapting with proofpoint’s reported 300% rise in AI generated content and APWG’s finding that phishing as a service kits doubled to 50 plus, even as faster detection has cut phishing dwell time by 20%.
06 · Category
Victim Demographics23 stats
01
55% of phishing victims are aged 30-49 per Proofpoint 2023 demographics study
02
FBI IC3 2023 showed 42% of phishing complainants over age 60
03
KnowBe4 2023 benchmarked finance employees 25% more likely to fall for phishing
04
Verizon DBIR 2023 noted 74% of healthcare phishing targets non-technical staff
05
APWG 2023 consumer reports indicated women 8% more susceptible to email phishing
06
IBM 2023 breach report found executives 3x more targeted in whaling phishing
07
Cofense 2023 surveyed IT staff clicking 14% higher phishing rates
08
Mimecast 2023 email security found millennials (25-40) 30% of victims
09
Ironscales 2023 CISO survey 62% of incidents involved remote workers
10
Barracuda 2023 targeted HR departments in 40% of spear-phishing
11
Abnormal Security 2023 noted small businesses (<500 emp) 2x victimization rate
12
SlashNext 2023 financial phishing hit retail workers 35% of cases
13
Kaspersky 2023 user stats showed students 22% phishing click rate
14
Zscaler 2023 remote user phishing susceptibility up 50% post-pandemic
15
Sophos 2023 ransomware phishing targeted mid-level managers 45%
16
Trend Micro 2023 APAC study 65% victims under 35 in mobile phishing
17
McAfee 2023 consumer 28% seniors (60+) fell for tech support phishing
18
Symantec 2023 families 40% parents targeted via kid-related phishing
19
CrowdStrike 2023 devs/engineers 18% higher click rates in tests
20
Mandiant 2023 finance sector execs 50% of whaling victims
21
Palo Alto 2023 SMB owners 60% primary targets
22
Google 2023 consumer study 52% Android users hit by smishing
23
Microsoft 2023 70% phishing on non-US English speakers mis-targeted
Interpretation
Victim Demographics Interpretation
Across victim demographics, phishing is hitting middle aged users hardest with 55% of victims aged 30 to 49 while older individuals are also heavily represented at 42% of complainants over 60, showing that risk is broad and not limited to a single age group.
report visual · Breakdown
Phishing delivery vectors: email dominates; SMS is rising
Email remains the primary phishing delivery vector, while smishing continues to grow as an additional channel.
82%
82% of phishing uses email as primary vector per Proofpoint 2023
18%
Zscaler 2023 18% cloud app impersonation phishing
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Priya Chandrasekaran. (2026, February 13). Phishing Attacks Statistics. Gitnux. https://gitnux.org/phishing-attacks-statistics
MLA
Priya Chandrasekaran. "Phishing Attacks Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/phishing-attacks-statistics.
Chicago
Priya Chandrasekaran. 2026. "Phishing Attacks Statistics." Gitnux. https://gitnux.org/phishing-attacks-statistics.
Sources & references
33 datasets cited across this report · attribution is report-level