Report: 90% of Cyberattacks Start With Phishing

Phishing has become one of the most widespread and persistent cyber threats today. Often using deceptive emails as a point of entry, they target both individuals and organizations.

This report highlights the latest phishing statistics and trends over time, including demographic insights and how this type of attack compares to other cybercrimes.

• Top 5 Phishing Statistics
• What Percentage of Cyber Attacks Are Phishing?
• How Common is Phishing?
• Number of Phishing Attacks Over Time
• Number of Phishing Attacks vs Other Internet Crimes
• Cost of Phishing Attacks vs Other Internet Crimes
• Phishing Attack Impact by Age

Top 5 Phishing Statistics

• Phishing emails are associated with more than 90% of successful cyber attacks.
• 0.89 million phishing attacks were reported in Q3 2025.
• The FBI received in excess of 191,000 phishing complaints in 2025.
• Phishing accounts for around 1% of all losses from internet crime.
• Over 60s report over 3.5x more phishing attacks than all other ages combined.

What Percentage of Cyber Attacks Are Phishing?

Phishing emails are the route of over 90% of successful cyber attacks, according to the Cybersecurity and Infrastructure Security Agency.

Source: CISA

How Common is Phishing in 2025?

In Q3 2025, the Anti-Phishing Working Group recorded approximately 0.89 million phishing attacks. That’s a 21% fall from the previous quarter (over 1.13 million).

In the UK, 93% of businesses have been affected by phishing. That figure is slightly higher (95%) for charities, according to the official UK government website.

However, industries aren’t targeted equally.

Media production companies report 2.91 malicious threats per user per year. That’s more than 2x the global average of 1.4.

Here are the top five industries most affected by phishing:

Rank	Industry	Malicious Threats Reported	Breaches per 1,000 Attempts
1	Media Production	2.91	138
2	Government	2.08	93.31
3	Manufacturing & Construction	1.65	81.28
4	Financial Service	1.41	45.77
–	Average	1.4	74.56
5	Oil & Energy	1.28	47.32

Fueling a surge in phishing emails is the rise of generative AI. Since launch, the number of phishing emails has rocketed by 1,265%.

Sources: APWG, GOV.UK, Hoxhunt, DeepStrike

Number of Phishing Attacks Over Time

Phishing reports grew year-over-year between 2017 and 2021, peaking at 323,972.

Since then, there has been an annual decline, with 2025’s total of 191,561 down 40% since 2021.

Here’s a look at the number of phishing reports since 2017:

Year	Number of Phishing/Spoofing Reports
2017	25,344
2018	26,379
2019	114,702
2020	241,342
2021	323,972
2022	321,136
2023	298,878
2024	193,407
2025	191,561

Source: IC3

Number of Phishing Attacks vs Other Internet Crimes

According to the FBI’s latest data, phishing is by far the most common type of cyber attack. 

With over 191,000 complaints in 2025, phishing reports outnumbered the rest of the top three combined (extortion and investment) – approximately 162,000.

Here’s the full breakdown of internet crimes by the number of complaints in 2025:

Rank	Type of Crime	Complaints	Proportion of Complaints
1	Phishing/Spoofing	191,561	19%
2	Extortion	89,129	8.8%
3	Investment	72,984	7.2%
4	Personal Data Breach	67,456	6.7%
5	Non-Payment/ Non-Delivery	56,478	5.6%
6	Tech/Customer Support	47,794	4.7%
7	Government Impersonation	32,424	3.2%
8	Identity Theft	31,675	3.1%
9	Business Email Compromise	24,768	2.5%
10	Employment	24,688	2.4%
11	Confidence/Romance	23,159	2.3%
12	Harassment/Stalking	21,557	2.1%
–	Other	20,031	2%
13	Credit Card/Check Fraud	18,774	1.9%
14	Real Estate	12,368	1.2%
15	Advanced Fee	7,762	0.8%
16	Lottery/Sweepstakes/ Inheritance	5,623	0.6%
17	Threats of Violence	4,826	0.5%
18	Data Breach	3,963	0.4%
19	Ransomware	3,611	0.4%
20	IPR/Copyright and Counterfeit	2,386	0.2%
21	Overpayment	2,194	0.2%
22	SIM Swap	971	0.1%
23	Malware	893	0.1%
24	Botnet	715	0.1%
25	Charity	662	0.1%

Source: IC3

Cost of Phishing Attacks vs Other Internet Crimes

In 2025, $20.88 billion was lost to internet crimes. Of that total, phishing accounts for approximately 1%.

The $8.65 billion lost from internet investment crimes is around 40x more than phishing losses (approximately $215.84 million).

Here are the 2025 internet crime records in full:

Type of Crime	Loss	Proportion of Total Loss
Investment	$8.65 billion	41.4%
Business Email Compromise	$3.05 billion	14.6%
Tech/Customer Support	$2.13 billion	10.2%
Personal Data Breach	$1.31 billion	6.3%
Confidence/Romance	$929 million	4.4%
Government Impersonation	$798 million	3.8%
Other	$512 million	2.5%
Non-Payment/ Non-Delivery	$503 million	2.4%
Data Breach	$435 million	2%
Employment	$363 million	1.7%
Credit Card/Check Fraud	$283 million	1.4%
Real Estate	$275 million	1.3%
Phishing/Spoofing	$216 million	1%
Lottery/Sweepstakes/ Inheritance	$194 million	<1%
Identity Theft	$186 million	<1%
Advanced Fee	$156 million	<1%
Extortion	$122 million	<1%
Ransomware	$32 million	<1%
Harassment/Stalking	$28 million	<1%
IPR/Copyright and Counterfeit	$27 million	<1%
Overpayment	$23 million	<1%
Malware	$19 million	<1%
SIM Swap	$17 million	<1%
Botnet	$14 million	<1%
Threats of Violence	$10 million	<1%
Charity	$8 million	<1%

Total phishing losses remained relatively stable between 2018 and 2021, ranging from $44 million to $58 million annually.

This is how phishing losses have changed each year since 2017:

Year	Total Phishing/Spoofing Losses
2017	$29.7 million
2018	$57.8 million
2019	$54.2 million
2020	$44.2 million
2021	$52.1 million
2022	$160 million
2023	$18.7 million
2024	$70 million
2025	$215.8 million

Source: IC3

Phishing Attack Impact by Age

Breaking things down by age, people over 60 are by far the most affected individuals when it comes to phishing attacks.

In 2025, 48,064 phishing attacks were reported by the 60+ age group. That’s more than double any other complaint.

Here’s a look at phishing attack statistics by age groups:

Age Group	Phishing Attacks Reported	Total Internet Crimes Reported	Phishing Attack Proportion
Under 20 Years	2,380	31,254	15.6%
20 to 29 Years	19,765	112,069	13%
30 to 39 Years	27,433	153,293	18%
40 to 49 Years	27,800	167,066	18.3%
50 to 59 Years	26,782	124,820	17.6%
60+ Years	48,064	201,266	31.6%

Following the same trend, the over-60s have reported much larger financial losses through phishing than any other age group.

Once again, the total is more than all other age groups combined, and over 570x more than losses reported by people under 20.

Here’s a breakdown of the financial losses relating to phishing by age:

Age Group	Phishing Losses	Total Internet Crime Losses	Phishing Losses Proportion
Under 20 Years	$0.36 million	$67 million	0.2%
20 to 29 Years	$7.95 million	$563 million	4.4%
30 to 39 Years	$32.67 million	$1.74 billion	17.95%
40 to 49 Years	$33.06 million	$2.96 billion	18.2%
50 to 59 Years	$30.92 million	$3.68 billion	16.7%
60+ Years	$77.02 million	$7.75 billion	42.3%

Source: IC3

Conclusion

While phishing dominates the cyber attack landscape by volume, its financial impact is relatively low compared to other internet crimes.

Older adults are disproportionately affected, both in terms of attack frequency and monetary loss.

Understanding the patterns behind phishing attacks is key to better protection and awareness in 2026 and beyond. For those looking to join the fight against these threats, earning an online bachelor’s degree provides the necessary technical foundation, while an online master’s degree equips leaders to design enterprise-wide defense strategies.