The FBI's Internet Crime Complaint Center (IC3) received 191,561 phishing and spoofing complaints in 2025, more than any other crime type, with $215.8 million in reported losses. The Anti-Phishing Working Group (APWG) counted 1,069,681 phishing attacks in the second quarter of 2026, and Verizon's 2026 Data Breach Investigations Report puts phishing behind 16% of breaches. Figures below were checked against each publisher's own report in November 2026.
How many phishing complaints did the FBI receive in 2025?
IC3 received 191,561 phishing and spoofing complaints in 2025, according to its 2025 Internet Crime Report, published in 2026. That is the largest crime type by complaint count, ahead of extortion at 89,129 and investment fraud at 72,984, and about 19% of the 1,008,597 complaints IC3 received across all categories. IC3 defines the category as unsolicited email, text messages and telephone calls purportedly from a legitimate company requesting personal, financial or login credentials.
The count is slightly below 2024, when IC3 logged 193,407 phishing and spoofing complaints, and well below 2023's 298,878. Phishing and spoofing complaints were about 19% of the 1,008,597 total in 2025, so the category stays first while holding roughly flat in count.
IC3 data comes from voluntary complaints, so it measures what people chose to report, not every attack that happened. A drop in complaints is not evidence that fewer phishing messages were sent. The APWG figures further down point the other way.
Phishing is still the single most reported cybercrime type in the United States, but it is no longer growing in complaint count.
How much money does phishing cost victims?
Reported phishing and spoofing losses were $215,843,126 in 2025, up from $70,013,036 in 2024, according to IC3. That is roughly three times the 2024 figure, a rise of about 208%, and about 11.5 times the $18,728,550 reported in 2023. Spread across 191,561 complaints, the 2025 total works out to about $1,127 per complaint, a figure we calculated from IC3's two totals.
| Year | Phishing/spoofing complaints | Reported losses | Source |
|---|---|---|---|
| 2025 | 191,561 | $215,843,126 | FBI IC3 |
| 2024 | 193,407 | $70,013,036 | FBI IC3 |
| 2023 | 298,878 | $18,728,550 | FBI IC3 |
Phishing is not the costliest crime type in IC3's data. Investment fraud accounted for $8,648,617,756 in reported losses in 2025, and business email compromise (BEC) for $3,046,598,558 across 24,768 complaints. In a BEC attack, per APWG, a threat actor impersonates an employee, vendor or other trusted party in an email to trick someone into sending money. The loss figure for phishing and spoofing counts only complaints filed under that label, so it understates the role phishing plays as the first step in other fraud. Our data breach statistics cover the downstream cost when stolen credentials turn into breaches.
Complaints fell by about a third in two years while reported losses grew roughly elevenfold.
Who reports phishing, by age?
Adults aged 60 and over filed the most phishing and spoofing complaints in 2025: 48,064, per IC3's elder fraud section. That group also reported $77,020,936 in losses, about 36% of the year's phishing and spoofing total by our calculation. The next largest groups were ages 40 to 49 (27,800), 30 to 39 (27,433) and 50 to 59 (26,782).
Figure 1: Phishing and spoofing complaints to IC3 by age group, 2025. Source: FBI IC3, 2025 Internet Crime Report, Appendix and Elder Fraud section.
| Age group | Complaints | Reported losses |
|---|---|---|
| 60 and over | 48,064 | $77,020,936 |
| 40 to 49 | 27,800 | $33,063,856 |
| 30 to 39 | 27,433 | $32,669,619 |
| 50 to 59 | 26,782 | $30,918,367 |
| 20 to 29 | 19,765 | $7,954,797 |
| Under 20 | 2,380 | $360,429 |
The age-group counts add up to 152,224, below the 191,561 total, because not every complaint carries an age group. Among people 60 and over, phishing and spoofing complaints more than doubled from 23,252 in 2024 to 48,064 in 2025, and losses rose from $20,202,521 to $77,020,936.
Older adults file the most reports and lose the most per complaint, at about $1,602 against about $1,127 overall.
How many phishing attacks does APWG count?
APWG, a coalition of security firms, registrars and researchers, counted 1,069,681 phishing attacks in Q2 2026, up 10.1% from 971,181 in Q1 2026. Q1 was itself 13.8% above the 853,244 attacks in Q4 2025. Q2 is the highest quarterly total APWG has seen since Q3 2025, per its report published 28 August 2026.
Figure 2: Unique phishing sites reported to APWG per month, January to June 2026. Source: APWG, Phishing Activity Trends Reports, Q1 and Q2 2026.
Monthly counts stayed near 320,000 from January to May and then jumped. June 2026 reached 425,808 attacks, the highest monthly total since April 2023, when APWG tallied 597,789. Phishers also hit more brands: APWG recorded 941 unique brands across Q2 2026, up from 766 in Q1, and 552 brands in June alone.
APWG measures reported phishing sites, not total attacks, and relies on submissions from members and the public. APWG itself warns that mail systems sometimes block users from forwarding lure emails to its reporting address, so its email-campaign counts can understate activity.
Reported phishing sites ran about 25% above the Q4 2025 level by Q2 2026, a comparison we calculated from APWG's figures, the opposite direction from IC3's complaint count.
Which sectors do phishers target?
SaaS and webmail brands were the most attacked sector in Q2 2026, drawing 29.1% of phishing attacks, up from 20% in Q1, according to APWG member Crane Authentication. Payment brands took 13.2%, financial institutions 11.4%, logistics and shipping 9.6% and social media 8.5%. Telecom, the top sector in Q1 at 33%, fell to 4.2%.
Figure 3: Share of phishing attacks by industry sector, Q2 2026. Source: APWG, Phishing Activity Trends Report Q2 2026, citing Crane Authentication.
Crane also reported that attackers are moving off the web page and onto the phone. Voice phishing ("vishing") rose 20% and text-message phishing ("smishing") rose 40% from Q1 to Q2 2026.
Business email compromise is climbing too. APWG member Fortra found the number of wire-transfer BEC attacks it observed in Q2 2026 rose 88% over the previous quarter, and the average amount requested rose 45% to $61,732, from $42,663 in Q1. Fortra attributed much of the increase to a single group it calls Scripted Sparrow. For small firms weighing that exposure, see our small business data breach figures.
Webmail and payment accounts now draw more than 42% of attacks between them, and the phone is the fastest-growing channel.
What share of breaches start with phishing?
Verizon's 2026 Data Breach Investigations Report found phishing was the initial access vector in 16% of breaches, the same as the previous year. Pretexting, a related tactic where the attacker interacts with the victim in real time, accounted for 6%. Exploitation of vulnerabilities led at 31%, up from 20%, and credential abuse fell from 22% to 13%.
Figure 4: How the 2026 DBIR separates phishing from pretexting; both can lead to stolen credentials, malware or a bank transfer. Source: Verizon, 2026 DBIR, Social Engineering pattern and Key topics sections.
Verizon says the human element was present in 62% of breaches, up from 60%, and Social Engineering was its third most common breach pattern at 16%. In its phishing simulations, the median click rate was 1.4% for email campaigns and about 2% for phone-centric ones, a 40% difference, though only 35 non-email campaigns were in the sample. Of the Social Engineering breaches Verizon examined, 41% involved vectors other than email.
Verizon also noted that phishing's share of initial access has barely moved over several years, even as AI assistance spread through attacker toolkits. Phishing accounted for 44% of the AI-assisted initial access techniques it mapped. Our human error breach data and ransomware figures show where those foothold attempts tend to lead.
Phishing is a steady 16% of breach entry points, while the faster growth sits in exploitation and phone-based social engineering.
The Bottom Line
Phishing is the most reported cybercrime type at the FBI, with 191,561 complaints and $215.8 million in reported losses in 2025, and independent counts from APWG show attack volume climbing through 2026, to 1,069,681 in the second quarter. Verizon's breach data keeps phishing at 16% of initial access, so it is a persistent entry point but no longer the main one. The practical shift is toward phones, webmail logins and impersonation. If you run a website or app, publish a privacy policy that states plainly what personal data you collect and how you protect it, and check the rules that apply to your business, since this data is not legal advice. Training that covers voice calls and text messages, not just email, matches where the 2026 reports show the growth.
Frequently Asked Questions
How many phishing complaints did the FBI receive in 2025? The FBI's Internet Crime Complaint Center (IC3) received 191,561 phishing and spoofing complaints in 2025, the most of any crime type, out of 1,008,597 complaints in total. Reported losses were $215,843,126.
How many phishing attacks happen each quarter? The Anti-Phishing Working Group (APWG) tallied 1,069,681 phishing attacks in the second quarter of 2026, up 10.1% from 971,181 in the first quarter. June 2026 alone reached 425,808, the highest monthly total since April 2023.
What share of data breaches start with phishing? Verizon's 2026 Data Breach Investigations Report found phishing was the initial access vector in 16% of breaches, the same share as the previous year. Exploitation of vulnerabilities led at 31%, and pretexting accounted for 6%.
Which industry is phished most often? In Q2 2026, APWG member Crane Authentication found SaaS and webmail brands were the most attacked sector at 29.1% of all phishing attacks, up from 20% in Q1 2026. Payment brands followed at 13.2%.
Where the Numbers Come From
- FBI Internet Crime Complaint Center: 2025 Internet Crime Report (2026). Complaint counts, losses and age-group tables from voluntary public complaints; 1,008,597 complaints in 2025.
- APWG: Phishing Activity Trends Report, 2nd Quarter 2026. Published 28 August 2026; attack counts from member and public reports, with sector, BEC and voice/text findings from contributing members Crane Authentication and Fortra.
- APWG: Phishing Activity Trends Report, 1st Quarter 2026. Published 21 May 2026; January to March attack counts and the Q4 2025 comparison.
- Verizon: 2026 Data Breach Investigations Report (2026). More than 22,000 confirmed breaches analyzed; initial access, Social Engineering and phishing simulation findings.
Note: All figures verified as of November 2026. Ratios and per-complaint averages marked as calculated are our own arithmetic from the cited totals.
