Security & Privacy
How many phishing emails are sent worldwide every day?
About 3.5 billion phishing emails are sent every day, close to 40,500 per second. That is roughly one for every person on Earth with an email account. Since late 2024, over 80% of those emails contain AI-generated content, which is why poor grammar no longer reliably gives them away. Phishing-as-a-Service kits, available on criminal markets for $50/month, have industrialised the operation.
Roughly 41K emails every second.
Source: APWG quarterly phishing reports through Q1 2026.
Last checked: 18 October 2026
What this means for you
In the time it takes to read this page (roughly 4 minutes), an estimated 9.7 million phishing emails will have been sent worldwide. That is not a rounding error. It reflects organised phishing-as-a-service operations.
Industry figures sometimes put phishing at about 1 in every 99 emails. That is a share of traffic sent, not of what lands in your inbox. Filters catch most of it; the emails that slip through are the ones that matter.
The most effective attacks today are spear-phishing emails that reference your name, company, or recent activity. AI generates them in milliseconds at near-zero cost, which is why the tell-tale spelling errors are largely gone. The pattern still holds: unexpected urgency, an unfamiliar sender domain, a link that wants your login. Catching those three things cuts the attack success rate significantly.
The numbers behind 3.5 billion daily attacks
3.5 billion phishing emails are sent every single day, about 40,500 every second
APWG82.6% of phishing emails analysed in late 2024-early 2025 contained AI-generated content
APWGPhishing attacks grew 5,753% between Q4 2004 and Q4 2016 alone
APWGPhishing was the initial attack vector in 15% of the breaches IBM studied in 2024, second only to compromised credentials (16%)
IBM / Ponemon InstituteOver 84% of phishing sites use HTTPS/SSL, making them appear legitimate to casual inspection
APWGThe average user receives 16 phishing emails per month
APWGPhishing-as-a-Service (PhaaS) kits are available for as little as $50/month on the dark web
APWGAPWG Q1 2025: 1,003,924 phishing attacks, largest quarterly count since late 2023; QR-code phishing spiked sharply
APWGWire-transfer BEC fraud increased 136% from Q3 to Q4 2025, the sharpest single-quarter jump on record (APWG Q4 2025)
APWGAttacks rebounded 13.8% in Q1 2026 after a two-quarter dip, but the real shift was where they landed: telecom brands went from 5.9% of all attacks to 33% in six months (APWG Q1 2026)
APWGPhishing emails sent vs. online scam victims, today
Billions of phishing emails go out every day. A small fraction succeed, but that fraction still adds up to millions of victims annually.
How the phishing industry scaled: 2010-2025
Phishing email volumes have grown from hundreds of millions per day in the early 2000s to roughly 3.5 billion per day by 2025, as Phishing-as-a-Service platforms and AI made launching targeted attacks nearly free. Growth in unique campaigns has since levelled off; what changed in early 2026 was which industries got targeted, not how many attacks went out.
Phishing emails per day, relative growth
Trend and forecast to 2027, based on APWG growth trajectory
Detailed breakdown by year
| Year | Rate | Est. per day | Context |
|---|---|---|---|
| 2010 | 17K/sec | 1.4B | Spear-phishing emerges |
| 2015 | 22K/sec | 1.9B | Financial sector primary target |
| 2018 | 29K/sec | 2.5B | SSL-enabled phishing sites rise |
| 2020 | 34K/sec | 3.0B | COVID-19 lure campaigns dominate |
| 2021 | 32K/sec | 2.7B | - |
| 2022 | 35K/sec | 3.0B | Rising |
| 2023-2024 | 39K/sec | 3.4B | AI-driven content; PhaaS expansion |
| 2025 | 41K/sec | 3.5B | QR-code phishing surges; BEC wire-transfer fraud spikes; smishing grows |
| 2027 (forecast) | 51K/sec | 4.4B | AI-personalised attacks; PhaaS scale |
When phishing became an industry
- 2004APWG begins systematic monthly tracking of phishing activity; Q4 average: 1,609 attacks/month
- 2007China overtakes the US as the top country hosting phishing websites
- 2009New all-time record: 56,362 unique phishing sites detected in a single month (August 2009)
- 20161.2 million phishing attacks in a single year, highest recorded at the time; 5,753% growth since Q4 2004
- 2020Phishing attacks double year-over-year for the first time; October 2020 breaks all monthly records
- 2022First year to exceed 4.7 million phishing attacks; Phishing-as-a-Service (PhaaS) becomes mainstream
- 2023Nearly 5 million attacks, worst year on record; QR-code phishing (quishing) surges
- 2024Over 82% of phishing emails contain AI-generated content; AI-assisted personalised attacks dominate
- 2026Total attack volume plateaus around 3.8 million/year, but telecom brands suddenly become the top target, jumping from 5.9% to 33% of all attacks in two quarters (APWG Q1 2026)
Phishing: the industrialisation of deception
What is phishing?
Phishing works by impersonation: an email arrives appearing to be from a bank, a government agency, a cloud service, or a colleague, and asks the recipient to click a link or hand over credentials. The name comes from "fishing," but the operation now runs at industrial scale. Spear-phishing targets specific individuals using personal details scraped from LinkedIn or corporate websites. Whaling targets executives. As of late 2024, AI generates over 80% of the content, so the tell-tale spelling errors are largely gone.
Scale and growth
The Anti-Phishing Working Group (APWG) has tracked phishing since 2004, when monthly attack volumes were in the thousands. By 2016, annual attacks exceeded 1.2 million. By 2023, nearly 5 million unique phishing campaigns were recorded in a single year, roughly 250 times the 2004 annualised rate of about 19,300 campaigns. Counts have since fallen back: 2024 landed at about 3.76 million campaigns and full-year 2025 at about 3.8 million, barely above 2024. The total volume of phishing emails (including the mass-mailing of known campaigns) still runs to approximately 3.5 billion per day, around 40,500 per second. The plateau in unique campaigns hides continued growth in emails sent per campaign.
The AI inflection point
From late 2024, AI-assisted phishing became the dominant method. Analysis of phishing emails in the period September 2024 - February 2025 found that 82.6% contained AI-generated content (APWG Q4 2024). AI tools allow criminal groups to create highly convincing, multi-language, personalised phishing campaigns in minutes, bypassing traditional signature-based detection. Phishing-as-a-Service (PhaaS) kits that include AI-powered content generation are available on the dark web for as little as $50/month.
Who is targeted?
Financial services consistently represent the largest proportion of phishing targets, approximately 30% of attacks as of 2024. SaaS platforms and webmail services (Gmail, Microsoft 365) follow closely, as compromised credentials provide access to entire organisational environments. Cryptocurrency exchanges have grown dramatically as targets since 2021. In 2023, the cryptocurrency sector accounted for 88% of all deepfake fraud cases catalogued by Sumsub, reflecting the convergence of phishing and synthetic media tactics.
Financial impact
Phishing is one of the most economically damaging cyberattack categories. IBM's Cost of a Data Breach Report 2024 identifies phishing as the initial attack vector in 15% of breaches, second only to compromised credentials (16%), and places the average total cost of a phishing-enabled breach at $4.88 million. Business Email Compromise (BEC) attacks, a form of highly targeted phishing, cost US organisations $2.9 billion in 2023 alone (FBI IC3).
What 3.5 billion emails a day actually means
At 40,500/sec, statistically every person on Earth (about 8.2 billion) would receive one phishing email roughly every 2.3 days
The daily phishing email volume of 3.5 billion is almost as large as the number of people with email accounts (4.3 billion), roughly 0.8 per account holder per day
If every phishing email were a single sheet of paper (0.1 mm thick), the annual stack of about 1.3 trillion sheets would be roughly 128,000 km tall, about a third of the way to the Moon
What security researchers have found
The following data points come from security industry reports and academic research on phishing volume, impact, and trends.
| Year | Finding | Value | Source |
|---|---|---|---|
| 2004 | APWG begins systematic monitoring of unique phishing campaigns/sites (trend proxy for email volume); Q4 2004: ~1,609 campaigns/month. Email volume estimates not yet available. | 19K unique phishing campaigns/year (APWG trend proxy) | APWG |
| 2007 | APWG: 23,917 unique phishing reports and 30,999 unique phishing sites in July 2007; China surpasses US as top hosting nation. Campaign counts track the trend in email blast volume. | 24K unique phishing campaigns (single month, APWG trend proxy) | APWG |
| 2016 | APWG: 1,220,523 unique phishing campaigns/year, 65% increase over 2015. Each campaign typically generates millions of emails; this trend underpins the email volume estimate. | 1M unique phishing campaigns/year (APWG trend proxy) | APWG |
| 2020 | APWG: 1,845,814 unique phishing campaigns, doubled from 2019; COVID-related lures drive surge in email blasts | 2M unique phishing campaigns/year (APWG trend proxy) | APWG |
| 2022 | APWG: 4.7 million unique phishing campaigns recorded; Phishing-as-a-Service makes launching email blasts trivial | 5M unique phishing campaigns/year (APWG trend proxy) | APWG |
| 2024 | APWG: ~3.76 million unique phishing attacks (down from nearly 5 million in 2023); 82.6% of analysed phishing emails contained AI-generated content; email-volume estimate for the live counter ~3.4B emails/day | 5M unique phishing campaigns/year (APWG trend proxy) | APWG |
| 2025 | APWG Q1 2025: 1,003,924 phishing attacks, the highest quarterly count since late 2023; QR-code phishing (quishing) spiked sharply; BEC wire-transfer fraud up 33% vs Q4 2024 | 1M unique phishing attacks in Q1 2025 (APWG) | APWG |
| 2025 | APWG Q4 2025: 853,244 attacks; wire-transfer BEC up 136% vs Q3 2025; SMS phishing (smishing) usage continued rising throughout 2025; full-year 2025 attacks estimated at ~3.8 million unique campaigns | 853K unique phishing attacks in Q4 2025 (APWG) | APWG |
| 2026 | APWG Q1 2026: 971,181 attacks, up 13.8% quarter-on-quarter but still slightly below Q1 2025's count; full-year 2025 confirmed at ~3.8 million attacks (+1% vs 3.76M in 2024). The volume has largely plateaued; the telecom sector's share of attacks quintupled instead | 971K unique phishing attacks in Q1 2026 (APWG) | APWG |
Frequently asked questions
- How many phishing emails are sent per day?
- Estimates place phishing email volume at approximately 3.5 billion per day globally in the current live baseline (up from about 3.4 billion in 2024). This figure represents emails specifically designed to deceive recipients, based on security industry analysis of global email traffic patterns.
- What percentage of emails are phishing?
- About 1-3% of all global email traffic is classified as phishing. With approximately 350 billion total emails sent daily in 2024, that puts the daily phishing volume at 3.5-10 billion attempts.
- How has phishing changed over time?
- Phishing attack volumes grew about 5,700% from Q4 2004 to 2016 alone, and by 2023 the annual campaign count was roughly 250 times the 2004 run rate (19,308 campaigns/year), driven by professional criminal organisations, Phishing-as-a-Service platforms, and AI-generated content. The APWG recorded nearly 5 million unique campaigns in 2023. Since 2024, AI generates over 80% of phishing email content, making detection harder than at any point in the category's history.
- What are the most targeted industries?
- Financial services consistently account for the largest share of phishing targets (around 30%), followed by SaaS/webmail platforms (25%), e-commerce/retail (15%), and social media (10%). The cryptocurrency sector is increasingly targeted.
- What is the average cost of a phishing attack?
- According to IBM's Cost of a Data Breach Report 2024, the average cost of a data breach with phishing as the initial vector is approximately $4.88 million, factoring in detection, response, legal, and reputational costs.
Cite this rate
AnythingCounter derived rate, last checked October 2026: about 40,509 phishing emails per second (about 3.5 billion phishing emails per day).
Method: APWG 2025 campaign trajectory, converted to a per-second rate (daily total ÷ 86,400).
Suggested citation: AnythingCounter, "Phishing emails launched," October 2026, https://anythingcounter.com/phishing-emails-per-day
Primary source: APWG.
How this number is calculated, and how much to trust it
The 2025 live rate of ~40,509/sec is based on APWG Q1 2025 and Q4 2025 campaign trajectory, extrapolated to approximately 3.5 billion phishing emails per day. 3,500,000,000 ÷ 86,400 seconds = 40,509/sec. The 2024 baseline was ~3.4B/day (39,351/sec); APWG Q1 2025 showed +QR-code and BEC surges consistent with a ~3% volume increase. Phishing volume fluctuates seasonally; Q4 holiday peaks are roughly 30% above the annual average. The rate includes spear-phishing (targeted) and mass-blast campaigns. APWG's Q1 2026 report (published May 2026) confirms full-year 2025 landed at roughly 3.8 million unique campaigns, almost unchanged from 2024, so the live rate has not been revised upward; what changed is the target list, not the volume.
APWG remains the most granular public dataset on phishing activity, regularly cited by CISA, FBI, and national CERTs. Nobody publishes a hard daily email count, so the live rate scales APWG's campaign trajectory to about 3.5 billion phishing emails per day. The most recent APWG check was Q1 2026 (May 2026); the collection methodology has not changed.
Sources: see below. More detail on our methodology page.
Sources
APWG Phishing Activity Trends Reports (Archive 2004-2023) - APWG Phishing Activity Trends Report Q4 2024 - APWG Phishing Activity Trends Report Q1 2025 - APWG Phishing Activity Trends Report Q4 2025 (includes full-year 2025 summary: 3.8 million phishing attacks total, +1% vs 2024; BEC wire-transfer attacks +136% in Q4). More detail on our methodology page.
Worth a look... Online scam victims - Romance scam money lost - Cyberbullying victims.