Phishing - Statistics & Facts

Phishing – a common term associated with email fraud has emerged as one of the most prominent forms of cyberattacks today. Victims are lured via fake correspondence, often in the form of emails or social media messages leading to carefully constructed phishing sites. Such sites, often masquerading as log-in pages or online forms then capture users’ data which is subsequently used to commit online fraud or identity theft. It is also not uncommon for links in one of these cleverly disguised messages to create a gateway for malware to make its way into a system. In 2020, phishing mails were a leading point of entry for ransomware, constituting up to 54 percent of digital vulnerabilities. Poor user practices and lack of cybersecurity training were also significant contributors, both of which are factors closely related to interaction with phishing messages.

Rise in attacks since COVID-19

With the coronavirus pandemic shifting daily activities online in many parts of the world, cybercrime has risen to the forefront. The third quarter of 2021 saw an unprecedented surge of unique phishing websites – an increase of over 400 thousand to be exact. This figure continued to rise in the fourth quarter that year. In 2020, Mongolia and Israel were the countries most targeted by phishing attacks, followed by France. With an increasing rate of attacks comes a growing investment in cybersecurity, an industry which is forecast to reach 345 billion U.S. dollars worldwide by 2026 - a nearly 60 percent increase from 2021.

Are employees at fault?

Although being distracted was a leading cause of employees clicking on phishing e-mails, being fooled by legitimate looking messages came in a close second. Just over 40 percent had assumed the e-mails came from a senior executive at their organization, another testament to the accuracy of spear phishing – a highly targeted form of the attack, drawing from user contact lists and internet activity to further personalize messages sent. While the highest number of accidental clicks come from employees aged between 31 to 50, younger members of staff appear to be better at covering their tracks. Up to 42 percent of 16 to 24 year olds admitted to having made cybersecurity mistakes that their company will never know about. Meanwhile, this share was significantly less in the 35 to 54 age group.

U.S. Healthcare sector most targeted

In 2020, after the worst of the coronavirus pandemic only 18 percent of cybersecurity professionals said that they had experienced an increase in digital attacks between April and June that year. Over half claimed they had seen no change in the area. A year on however, the story was quite different with nearly half admitting to having seen at least a small increase in attacks following COVID-19. In FY 2019, the Department of Health and Human Services was the most targeted government sector by cybercriminals in the United States. The largest share of breaches occurred due to slip-ups or policy violations by authorized users, again highlighting the critical role employee training plays in stemming future attacks.

This text provides general information. Statista assumes no liability for the information given being complete or correct. Due to varying update cycles, statistics can display more up-to-date data than referenced in the text.

Number of unique phishing sites detected worldwide: 1270883

Online industry most targeted by phishing attacks: Financial institutions

Country most targeted by phishing attacks: Vietnam

Editor’s Picks Current statistics on this topic

Cyber Crime

Most reported types of cyber crime worldwide 2022, by number of individuals affected

Online industries most targeted by phishing attacks as of 3rd quarter 2022

Cyber Crime

Phishing: most targeted industry sectors Q3 2022

Countries most targeted by phishing attacks worldwide in 2022

Cyber Crime

Phishing: distribution of attacks 2022, by country

Recommended statistics

Overview

Basic Statistic Number of global phishing sites 2013-2022
Number of global phishing sites 2013-2022
Number of unique phishing sites detected worldwide from 3rd quarter 2013 to 3rd quarter 2022
Basic Statistic Phishing: number of affected brands 2009-2022
Phishing: number of affected brands 2009-2022
Number of brands and legitimate entities targeted by phishing attacks from January 2009 to July 2022
Premium Statistic Phishing: distribution of attacks 2022, by country
Phishing: distribution of attacks 2022, by country
Countries most targeted by phishing attacks worldwide in 2022
Basic Statistic Phishing attack rate among businesses worldwide 2021, by country
Phishing attack rate among businesses worldwide 2021, by country
Volume of successful phishing attacks on organizations worldwide 2021, by country
Basic Statistic Phishing: most targeted industry sectors Q3 2022
Phishing: most targeted industry sectors Q3 2022
Online industries most targeted by phishing attacks as of 3rd quarter 2022
Premium Statistic Phishing: most targeted organizations worldwide 2022, by industry
Phishing: most targeted organizations worldwide 2022, by industry
Worldwide organizations most targeted by phishing attacks in 2022, by industry
Basic Statistic Global spam categories 2020
Global spam categories 2020
Most prevalent spam content categories worldwide in 2020

Click rates and reporting

Premium Statistic Employee interaction with malicious emails 2021
Employee interaction with malicious emails 2021
How employees interact with malicious emails 2021
Premium Statistic Why employees click on phishing emails in 2020
Why employees click on phishing emails in 2020
Reasons employees click on phishing emails in 2020
Premium Statistic Employees that click on phishing emails in 2020, by age
Employees that click on phishing emails in 2020, by age
Employees that click on phishing emails in 2020, by age
Premium Statistic U.S. and UK employees that have made security mistakes in 2021, by age
U.S. and UK employees that have made security mistakes in 2021, by age
Employees that have made security mistakes that their company will never know about in the U.S. and the UK in 2021, by age
Premium Statistic Time taken to report a suspected phishing emails in 2020
Time taken to report a suspected phishing emails in 2020
Average time it takes a user to report a suspected phishing email in 2020

Phishing types and delivery methods

Basic Statistic Leading cause of ransomware infection 2020
Leading cause of ransomware infection 2020
Most common delivery methods and cybersecurity vulnerabilities causing ransomware infections according to MSPs worldwide as of 2020
Premium Statistic Distribution of TLDs used by phishing sites in 2021
Distribution of TLDs used by phishing sites in 2021
Distribution of top-level domains used by phishing sites in 2021
Premium Statistic Proportion of phishing sites using brand names in 2020
Proportion of phishing sites using brand names in 2020
Proportion of phishing sites using brand names in the hostname, path, or both in 2020
Premium Statistic Percentage of phishing emails in 2020, by secure email gateway
Percentage of phishing emails in 2020, by secure email gateway
Percentage of phishing emails in 2020, by type and SEG

Spear-phishing

Basic Statistic Spear phishing and whaling attacks rate on organizations 2021
Spear phishing and whaling attacks rate on organizations 2021
Volume of spear phishing and whaling attacks on organizations worldwide in 2021
Premium Statistic Spear-phishing attack trends in 2021, by attack type
Spear-phishing attack trends in 2021, by attack type
Categories of spear-phishing attacks in 2021, by attack type
Premium Statistic Spear-phishing attacks in 2020, by day of the week
Spear-phishing attacks in 2020, by day of the week
Spear-phishing attacks in 2020, by day of the week

The COVID-19 pandemic and remote work

Premium Statistic Changes in cyber attack frequency following COVID-19 as of 2021
Changes in cyber attack frequency following COVID-19 as of 2021
Has your organization encountered changes in cyber attacks following COVID-19?
Premium Statistic Key cyberthreats related to the COVID-19 pandemic in 2020
Key cyberthreats related to the COVID-19 pandemic in 2020
Key cyberthreats related to the COVID-19 pandemic in 2020, by threat type
Premium Statistic Increases in cyber attacks according to IT professionals in 2021, by type
Increases in cyber attacks according to IT professionals in 2021, by type
Where do IT professionals see an increase in cyber attacks and attack attempts following the COVID-19 pandemic?
Basic Statistic Post-pandemic cybersecurity priorities worldwide 2020
Post-pandemic cybersecurity priorities worldwide 2020
Cybersecurity priorities after COVID-19 worldwide in 2020
Premium Statistic Remote work: importance of protecting users against phishing and cyber attacks 2021
Remote work: importance of protecting users against phishing and cyber attacks 2021
When enabling remote work, how important do you think it is to protect your users against phishing and cyber attacks?
Premium Statistic Global cybersecurity incidents after remote work transition 2020
Global cybersecurity incidents after remote work transition 2020
Change in cybersecurity incidents in organizations after transitioning to remote work due to COVID-19 worldwide as of 2020
Premium Statistic IT leaders' predictions for phishing emails relating to 'back to work' in 2021
IT leaders' predictions for phishing emails relating to 'back to work' in 2021
Will employees in the U.S. and the UK receive a surge in phishing emails related to 'back to work'?

Spotlight: Phishing in the U.S.

Basic Statistic Most reported types of cyber crime worldwide 2022, by number of individuals affected
Most reported types of cyber crime worldwide 2022, by number of individuals affected
Most commonly reported cyber crime categories worldwide in 2022, by number of individuals affected
Premium Statistic Cyber crime: attacks experienced by U.S. companies 2021
Cyber crime: attacks experienced by U.S. companies 2021
Most common types of cyber attacks experienced by companies in the United States in 2021
Premium Statistic Online security threats that U.S. consumers worry about in 2021
Online security threats that U.S. consumers worry about in 2021
Online security threats that consumers in the United States worry about in 2021
Premium Statistic U.S. government: number of cyber security incidents 2020, by attack vector
U.S. government: number of cyber security incidents 2020, by attack vector
Number of reported cyber attacks directed against the U.S. government in FY 2020, by attack vector
Basic Statistic U.S. government: number of department cyber security incidents 2019, by attack vector
U.S. government: number of department cyber security incidents 2019, by attack vector
Number of reported cyber attacks directed against selected departments and agencies of the U.S. government in FY 2019, by attack vector
Basic Statistic Threat actors for cyber security incidents in U.S. healthcare organizations 2019-2020
Threat actors for cyber security incidents in U.S. healthcare organizations 2019-2020
Common threat actors responsible for significant cyber security incidents in U.S. healthcare organizations in 2019 and 2020