Phishing in 2026: Numbers, Trends and How to Defend Your Organization

Phishing means tricking people into handing over credentials, payment data or money through a forged message or website. It is the oldest trick in online fraud and still the most reliable one. This page collects the current numbers in one place, explains the trends behind them and lists the defenses that work in 2026. We update it every year, so each figure states the period it covers and links to its source.

How common is phishing in 2026?

Very. After a dip in late 2025, the APWG count rose 13.8% in the first quarter of 2026 and another 10.1% in the second. June 2026 alone saw 425,808 attacks, the highest monthly figure since April 2023 (APWG, Q2 2026). Microsoft detected about 8.3 billion email phishing threats in the first quarter and 7.6 billion in the second (Q1, Q2).

In Europe the picture is the same. ENISA's Threat Landscape 2026, which covers incidents from 2025, names phishing as the most common intrusion vector among social engineering techniques at 77.8%, followed by malicious spam at 13%. Verizon's 2026 Data Breach Investigations Report finds a human element in 62% of breaches, up from 60% a year earlier.

The reported numbers understate the problem. The FBI only sees complaints people file, APWG only sees attacks its members find, and most incidents never reach either. Read the table as a floor, not a total.

What are the biggest phishing trends in 2026?

AI writes the lure

Broken grammar used to be the easiest tell. That is gone. In a study by Heiding, Schneier and colleagues published in 2026, spear phishing emails generated fully by AI reached a 54% click rate, the same as emails written by human experts and well above the 12% of the control group (Evaluating Large Language Models' Ability to Automate Spear Phishing). The authors also estimate that automation makes large campaigns up to 50 times more profitable.

The incident data points the same way. The FBI recorded 22,364 complaints with an AI component in 2025, with losses of nearly $893 million (IC3 2025). IBM's 2026 Cost of a Data Breach study found that one in four malicious breaches was AI-enabled, mostly through deepfake impersonation and AI-built malware, at an average cost of $6 million (IBM). Europol notes that AI-generated text now reflects local language and cultural nuance, which removes another warning sign (IOCTA 2025).

Phishing kits and phishing-as-a-service

Many phishing sites are not built by hand. They come from phishing kits rented by subscription, complete with templates for dozens of brands, hosting and a dashboard for stolen data. The better ones work as a reverse proxy: they pass the victim's login to the real service in real time and capture the session, which defeats SMS codes and push approvals.

Two cases show the scale. In March 2026, a Europol-supported operation led technically by Microsoft took down 330 domains that formed the core of Tycoon2FA, a phishing-as-a-service platform built to bypass multi-factor authentication (Europol). Microsoft reports that phishing linked to Tycoon2FA fell 92% afterwards. In November 2025 Google sued the operators of "Lighthouse", an SMS phishing kit that Google says harmed more than a million victims in over 120 countries (Google). Takedowns like these help, but the next platform usually fills the gap.

Phishing moves beyond email

Email is still the main channel, but the others are catching up. In Verizon's phishing simulations, the median click rate for text messages and voice calls was 40% higher than for email, although that rests on far fewer campaigns. APWG reported rising threat volumes on every social media platform in early 2026. Microsoft saw weekly malicious call attempts in Teams reach almost ten times the mid-2025 baseline by June 2026. And QR code phishing peaked at 18.7 million attacks in March 2026. Europol links the rise of phishing and smishing directly to Europe's move to two-factor authentication: when a password alone is no longer enough, criminals phish for the second factor too (IOCTA 2026).

Brand impersonation: lookalike domains, fake shops and ads

Phishing works because it borrows trust. Check Point counted Microsoft in 23% of brand phishing attempts in Q2 2026, and ChatGPT entered the top ten for the first time (Check Point). Germany's BSI observes a shift away from banks towards online retailers, logistics companies and streaming services (BSI Lagebericht 2025).

The fake does not stop at the email. Attackers register lookalike domains, build shops with copied product catalogs and buy ads to reach victims. In our DoppelCart investigation we traced a single fake-shop network to around 119,000 domains. In our study for the ARD documentary, 3.5% of Google ad placements we logged led to a fake shop, and reported ads stayed live for 11.2 days on average. None of that touches the victim's company network, which is why it is easy to miss.

Which phishing channels matter, and what stops them?

What does phishing cost organizations?

The direct losses are large. US victims reported more than $20 billion in cybercrime losses to the FBI in 2025, 26% more than a year earlier, with business email compromise alone at about $3.05 billion (IC3 2025). IBM puts the global average cost of a data breach at a record $4.99 million in its 2026 study. In Germany, Bitkom's 2026 survey attributes 76% of the damage from data theft, espionage and sabotage to cyberattacks, between €160.4 billion and €205.8 billion a year (Bitkom).

A second cost is harder to count. When customers are phished in your name, they come to you: support tickets about orders you never received, chargebacks, angry reviews. We saw this in the DoppelCart cases, where fake shops listed the real store's support address. Your systems were never breached, yet the damage lands on your brand.

How do you defend against phishing in 2026?

Training alone does not hold against lures that are as good as a colleague's email. The controls that work assume someone will click and limit what happens next, while also watching the infrastructure attackers build in your name.

1. Use phishing-resistant login. Passkeys and FIDO2 security keys are bound to the real domain, so a relay kit cannot reuse them. Start with admins, finance and anyone with access to customer data.
2. Revoke sessions, not just passwords. Kits that steal session cookies keep access after a password reset. Make session revocation part of every phishing response.
3. Enforce DMARC. A DMARC policy of reject stops direct spoofing of your own domain. It does nothing against lookalike domains, which is why the next point matters.
4. Monitor your brand outside the perimeter. New lookalike domains, fake shops, cloned social profiles and ads with your name are the setup phase of a campaign. Domain monitoring and social media monitoring catch them before or while they go live.
5. Have a takedown route ready. Know who removes a phishing site (host, registrar, platform) and what evidence they need. Our website takedown guide covers the steps, and phishing takedown is the service if you would rather hand it over.
6. Verify payments out of band. Any change of bank details or urgent transfer request gets a callback on a known number. It defeats the classic BEC scenario of a fake invoice or a changed account number.
7. Train for all channels. Include SMS, voice, QR codes and Teams calls in awareness work and simulations, not only email.
8. Make reporting easy and fast. A report button for staff and a public address for customers give you the earliest signal you will get.

What to do after a phishing attack

For an organization, the first hour decides how big the damage gets:

1. Reset the affected credentials, revoke all active sessions and check for new mailbox rules, forwarding and registered devices.
2. If money was sent, contact your bank at once and ask for a recall. The sooner, the better the odds.
3. Capture the phishing page before it disappears. Our website scan stores a screenshot and the source, and who is hosting shows where to send the abuse report.
4. Check whether personal data was exposed. Under the GDPR, a reportable breach has to be notified to the supervisory authority within 72 hours.
5. Report it. In the US, file with the FBI at ic3.gov; the FTC asks consumers to forward phishing emails to [email protected] and texts to 7726. In the UK, forward emails to [email protected] (NCSC). In Germany, file a police report and forward phishing emails to [email protected].
6. Warn customers if your brand was used, with a concrete description of the message.

Where nebty fits

Email security, login protection and training are inside-the-perimeter work, and plenty of good tools cover them. nebty covers the outside: lookalike domains, fake shops, fake profiles and ads that use your brand, plus the takedowns to remove them. If you want to see what is already out there, the free trial shows the current findings for your brand.

Frequently asked questions