UK Phishing Statistics 2026
How many phishing emails are being sent, who they target, what they cost, and what stops them. Updated August 2026.
Sources: DCMS, Verizon DBIR, IBM, Proofpoint, APWG, NCSC, Senri client data.
3.4B
phishing emails are sent globally every single day, making it the most widespread cyber threat in existence.
AAG / Radicati Group
84%
of UK businesses that identified a cyber attack said phishing was the type of attack they experienced.
DCMS Cyber Security Breaches Survey 2024
36%
of all data breaches globally involved phishing as the initial attack vector.
Verizon 2024 Data Breach Investigations Report
Scale of the Problem
How many phishing emails are being sent — and how many are getting through.
phishing emails are blocked by Google every day. Microsoft blocks a similar volume across its platforms. What gets through is a fraction — but a fraction of billions is still a lot.
Google Transparency Report
of all emails sent globally are malicious — approximately 3.4 billion phishing emails per day out of 300+ billion total.
AAG / Radicati Group
phishing sites were active at any given time in 2023, a record high. Attackers spin up and tear down phishing pages in hours, making blocklists perpetually behind.
APWG Phishing Activity Trends Report
spoofed phishing emails were reaching staff inboxes every week at one of our own clients before we deployed anti-phishing policies. They had no idea.
Senri Client Data
Who Gets Targeted
Phishing doesn't discriminate by company size — but it does by sector.
of UK organisations experienced at least one phishing attack in 2023. It remains the most common cyber threat across all sectors and sizes.
Proofpoint State of the Phish 2024
receive the highest rate of targeted phishing emails — 1 in every 323 emails — compared to 1 in 823 for larger organisations. Attackers know smaller companies have weaker defences.
Symantec / Broadcom
is the most impersonated sector in phishing attacks, followed by technology companies, shipping/logistics, and government agencies.
APWG Phishing Activity Trends Report
is the most impersonated brand globally in phishing campaigns, used in approximately 33% of all brand-impersonation phishing emails.
Check Point Brand Phishing Report 2024
Cost of Phishing Attacks
What a successful phishing email actually costs a business.
is the average cost of a data breach that started with a phishing attack — higher than the overall average breach cost of $4.88M.
IBM Cost of a Data Breach Report 2024
is the median loss from a business email compromise (BEC) attack — a type of phishing where attackers impersonate a colleague or supplier to redirect payments.
FBI Internet Crime Complaint Center (IC3) 2023
in losses were reported to the FBI from business email compromise attacks alone in 2023 — making BEC the most financially damaging form of cyber crime.
FBI IC3 Annual Report 2023
of productivity is lost per employee who falls victim to a phishing attack, accounting for password resets, account recovery, security reviews, and re-training.
APWG / Proofpoint
Why Phishing Works
The psychology and mechanics behind successful attacks.
is the average time it takes a user to fall for a phishing email after opening it. Most people who click do so within the first minute.
Verizon 2024 Data Breach Investigations Report
of breaches involved a human element — social engineering, errors, or credential misuse. Technology alone can't solve a people problem.
Verizon 2024 Data Breach Investigations Report
phishing emails now have a higher click-through rate than human-written ones, making them harder to distinguish. AI tools have reduced the cost and skill required to launch sophisticated phishing campaigns.
Harvard Business School / Multiple studies 2024
of UK businesses provide regular cyber security awareness training to staff. The rest rely on their email filter and hope for the best.
DCMS Cyber Security Breaches Survey 2024
Email Security Gaps
The technical defences most businesses haven't turned on.
of domains globally have a DMARC policy set to reject or quarantine, meaning 86% of domains can be freely spoofed in phishing emails with no consequences.
Valimail DMARC Report
— the three email authentication protocols that prevent domain spoofing — are free to configure but rarely set up correctly on small business domains.
NCSC Email Security Guidance
of successful cyber attacks start with a phishing email. Email is still the number one attack vector, yet most businesses invest more in firewalls than email security.
CISA / Multiple reports
in Microsoft Defender are included in Business Premium licences but are not enabled by default. Most small businesses on Microsoft 365 have no anti-phishing protection turned on.
Microsoft / Senri Observations
How to Protect Your Business
Phishing protection isn't a single product — it's layers. The most effective defence combines technical controls with staff awareness:
- ✓Configure SPF, DKIM, and DMARC on your email domain to prevent spoofing
- ✓Enable anti-phishing policies in Microsoft Defender (included in Business Premium)
- ✓Enforce multi-factor authentication on every account — this alone stops 99% of credential-based attacks
- ✓Set up Conditional Access to block sign-ins from risky locations and unmanaged devices
- ✓Train your team to recognise phishing — not once a year, but regularly
- ✓Implement a reporting process so staff can flag suspicious emails without embarrassment
We configure all of this for our clients as part of our cybersecurity service. If you're not sure where you stand, our free security review checks your email domain configuration, identity policies, and anti-phishing setup.
Sources & Methodology
Statistics are compiled from the DCMS Cyber Security Breaches Survey (2024 & 2025), Verizon 2024 Data Breach Investigations Report, IBM Cost of a Data Breach Report 2024, Proofpoint State of the Phish 2024, APWG Phishing Activity Trends Reports, FBI IC3 Annual Report 2023, NCSC guidance, and Senri's own client data.
This page was last reviewed and updated in August 2026.
Is your email domain protected?
We'll check your SPF, DKIM, DMARC, and anti-phishing policies for free.