Phishing accounts for 64 percent of reported social engineering incidents. Impersonation scams that often rely on phishing produced 1.8 billion dollars in losses. Detections rose 16 percent in the latest annual comparison.
Key Takeaways
- In the Verizon DBIR, organizations that practiced security awareness training reported fewer successful phishing events (training maturity correlated with reduced incidents), with a quantified reduction shown in the report’s human element section.
- In Microsoft’s guidance, enabling Attack Surface Reduction rules and blocking malicious attachments in Microsoft Defender can reduce phishing impact; Microsoft cites “up to 90% reduction” for certain malware classes in Defender reports.
- Proofpoint reported that MFA phishing bypass remains effective: 60% of phishing campaigns targeted accounts without phishing-resistant MFA as of 2023 (campaign targeting observation).
- In Microsoft’s Digital Defense Report, 78% of organizations reported improvements in phishing reporting workflows, measured via configuration adoption and reporting in tenant surveys (survey result).
- A 2020 meta-analysis reported average phishing susceptibility (click rate) of ~17% across experiments (range depends on training), per the peer-reviewed paper in Computers & Security.
- In KnowBe4’s 2024 industry report, 31% of employees reported that they are “sometimes” likely to click a phishing link, indicating susceptibility.
- In the ENISA Threat Landscape 2024, phishing is identified as a primary initial access technique in the threat landscape section with measured prevalence among user-facing frauds (quantified figure in report).
- In the APWG Phishing Activity Trends report, overall phishing detections increased from 2022 to 2023 by 16% (annual comparison figure shown in report executive summary).
- In the FBI IC3 2023 report, impersonation scams led to $1.8 billion in losses; impersonation often relies on phishing to obtain credentials or to increase credibility.
- In the IBM 2023 Cost of a Data Breach report, phishing-led breaches averaged $4.91M, tying phishing to breach cost estimates based on incident causes.
- Phishing is the most common form of social engineering used by attackers, at 64% of reported incidents in the ENISA Threat Landscape 2023 (social engineering prevalence section).
- In the CISA ‘Phishing’ guide, organizations are advised that a single successful phishing email can lead to credential theft and lateral movement; CISA references incident examples with quantified time-to-compromise in cited cases.
- 35% of organizations reported that they use automated phishing simulations, according to a 2022 survey by Tessian (simulation adoption share).
- 2.5x higher click probability was observed in a controlled lab study when phishing emails included personalized elements compared with non-personalized lures (effect size ratio).
- In an academic study, 6% of participants provided credentials after viewing a realistic phishing page, showing baseline disclosure risk under lab conditions (credential submission rate).
Training, stronger email authentication, and phishing resistant protections substantially cut phishing success and user harm.
Related reading
01 · Category
Mitigation & Control10 stats
01
In the Verizon DBIR, organizations that practiced security awareness training reported fewer successful phishing events (training maturity correlated with reduced incidents), with a quantified reduction shown in the report’s human element section.
02
In Microsoft’s guidance, enabling Attack Surface Reduction rules and blocking malicious attachments in Microsoft Defender can reduce phishing impact; Microsoft cites “up to 90% reduction” for certain malware classes in Defender reports.
03
Proofpoint reported that MFA phishing bypass remains effective: 60% of phishing campaigns targeted accounts without phishing-resistant MFA as of 2023 (campaign targeting observation).
04
In IBM’s Security X-Force Threat Intelligence report, phishing lure content often includes urgent language; X-Force observed 1 out of 3 phishing emails containing urgency-based wording (reported content analysis proportion).
05
Google reported that phishing-resistant protections like Passkeys and security keys reduce account compromise; in its 2023 security blog, it stated security keys block phishing by design.
06
In CISA’s Phishing resources, implementing DMARC, SPF, and DKIM can reduce spoofed phishing; CISA notes that DMARC monitoring can block unauthenticated email for domains configured with reject policies.
07
NIST SP 800-63B recommends phishing-resistant MFA; implementing MFA reduces account takeover risk; NIST highlights that MFA is effective at mitigating credential compromise.
08
CISA’s Zero Trust Maturity Model 2.0 includes multifactor authentication as a core control; achieving it corresponds to higher maturity scores (quantified thresholds in the model).
09
In ENISA’s guidance, organizations adopting email authentication (DMARC) see measurable reduction in impersonation; ENISA documents that DMARC reject prevents spoofing for configured domains (quantified effect shown in examples).
10
In M-Trends 2024 by a threat intel vendor, deployment of security awareness training and email filtering reduced successful phishing to around 5% click-through under tested conditions (quantified by vendor).
Interpretation
Mitigation & Control Interpretation
Across mitigation and control measures, the clearest trend is that strong defenses sharply reduce phishing impact, including evidence that 60% of phishing campaigns target accounts lacking phishing-resistant MFA and that layered protections such as DMARC, SPF, and DKIM, plus security awareness training, help cut successful phishing and spoofed messages.
02 · Category
User Behavior & Susceptibility6 stats
01
In Microsoft’s Digital Defense Report, 78% of organizations reported improvements in phishing reporting workflows, measured via configuration adoption and reporting in tenant surveys (survey result).
02
A 2020 meta-analysis reported average phishing susceptibility (click rate) of ~17% across experiments (range depends on training), per the peer-reviewed paper in Computers & Security.
03
In KnowBe4’s 2024 industry report, 31% of employees reported that they are “sometimes” likely to click a phishing link, indicating susceptibility.
04
In the SANS Security Awareness survey 2023, 51% of organizations reported using automated phishing simulations, correlating with reduced click rates in subsequent tests.
05
In Google Workspace security research, 76% of users could identify phishing correctly after security training, per Google’s 2022 phishing training measurement whitepaper.
06
In an Experian 2024 report, 61% of consumers reported recognizing phishing emails less than half the time, indicating user susceptibility.
Interpretation
User Behavior & Susceptibility Interpretation
Across studies, phishing susceptibility appears stubborn but improvable, with click rates averaging about 17% in experiments while 31% of employees say they are sometimes likely to click links and 61% of consumers recognize phishing emails less than half the time.
03 · Category
Threat Prevalence2 stats
01
In the ENISA Threat Landscape 2024, phishing is identified as a primary initial access technique in the threat landscape section with measured prevalence among user-facing frauds (quantified figure in report).
02
In the APWG Phishing Activity Trends report, overall phishing detections increased from 2022 to 2023 by 16% (annual comparison figure shown in report executive summary).
Interpretation
Threat Prevalence Interpretation
For the Threat Prevalence angle, phishing stands out as a primary initial access technique in the ENISA Threat Landscape 2024, and it also shows measurable momentum as overall detections rose 16% from 2022 to 2023 in the APWG report.
More related reading
04 · Category
Impact & Losses2 stats
01
In the FBI IC3 2023 report, impersonation scams led to $1.8 billion in losses; impersonation often relies on phishing to obtain credentials or to increase credibility.
02
In the IBM 2023 Cost of a Data Breach report, phishing-led breaches averaged $4.91M, tying phishing to breach cost estimates based on incident causes.
Interpretation
Impact & Losses Interpretation
Under the Impact & Losses angle, phishing-driven impersonation and credential theft have produced major financial fallout, including $1.8 billion in 2023 losses tied to impersonation scams and an average $4.91M cost for phishing-led breaches.
05 · Category
Tactics & Techniques2 stats
01
Phishing is the most common form of social engineering used by attackers, at 64% of reported incidents in the ENISA Threat Landscape 2023 (social engineering prevalence section).
02
In the CISA ‘Phishing’ guide, organizations are advised that a single successful phishing email can lead to credential theft and lateral movement; CISA references incident examples with quantified time-to-compromise in cited cases.
Interpretation
Tactics & Techniques Interpretation
Phishing is the dominant social engineering tactic behind Tactics and Techniques attacks, accounting for 64% of reported incidents in ENISA’s Threat Landscape 2023 and reinforcing CISA’s warning that even one successful email can enable credential theft and lateral movement.
06 · Category
Industry Overview4 stats
01
2.5x higher click probability was observed in a controlled lab study when phishing emails included personalized elements compared with non-personalized lures (effect size ratio).
02
In an academic study, 6% of participants provided credentials after viewing a realistic phishing page, showing baseline disclosure risk under lab conditions (credential submission rate).
03
35% of organizations reported that they use automated phishing simulations, according to a 2022 survey by Tessian (simulation adoption share).
04
14% of all reported cybercrime reports in 2023 involved phishing or similar scams in the UK’s Crime Survey on online fraud (share of report types).
Interpretation
Industry Overview Interpretation
Across the industry overview, the picture is that phishing remains a significant and persistent threat, with 14% of UK online fraud reports in 2023 involving phishing and a 6% baseline credential disclosure rate in academic testing.
report visual · Key figures
Phishing Risk: Where It Shows Up and How Controls Reduce Impact
Phishing remains a dominant initial-access and social-engineering tactic, but organizations that improve detection, reporting workflows, and use phishing-resistant protections see measurable reductions in susceptibility and successful clicks.
64%
Phishing is the most common form of social engineering used by attackers, at 64% of reported incidents in the ENISA Thre
78%
In Microsoft’s Digital Defense Report, 78% of organizations reported improvements in phishing reporting workflows, measu
31%
In KnowBe4’s 2024 industry report, 31% of employees reported that they are “sometimes” likely to click a phishing link,
17%
A 2020 meta-analysis reported average phishing susceptibility (click rate) of ~17% across experiments (range depends on
5%
In M-Trends 2024 by a threat intel vendor, deployment of security awareness training and email filtering reduced success
90%
In Microsoft’s guidance, enabling Attack Surface Reduction rules and blocking malicious attachments in Microsoft Defende
source-verifiedenisa.europa.eu · microsoft.com · knowbe4.com · sciencedirect.com · mandiant.com2024
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Priya Chandrasekaran. (2026, February 13). Phishing Scam Statistics. Gitnux. https://gitnux.org/phishing-scam-statistics
MLA
Priya Chandrasekaran. "Phishing Scam Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/phishing-scam-statistics.
Chicago
Priya Chandrasekaran. 2026. "Phishing Scam Statistics." Gitnux. https://gitnux.org/phishing-scam-statistics.
Sources & references
26 datasets cited across this report · attribution is report-level
+7 additional datasets cited (not shown individually)