Is Phishing the Most Common Cyber Attack?

 

The Story Behind the Numbers

Phishing is when criminals send fake emails, texts, or messages designed to trick you into clicking a malicious link or handing over your password – and it really is the most common cyber attack in the latest data. In 2025, the FBI’s Internet Crime Complaint Center logged 1,008,597 complaints. Of these, 191,561 were classified as Phishing/Spoofing – about 18.99% of all reports. That is more than double the next category, Extortion, at 8.84%. And extortion is not “small money” either: IBM’s 2025 data puts the average cost of a ransomware attack at about $5.08 million, higher than the $4.44 million average cost of a typical data breach. Investment fraud climbs to third place with 7.24% of complaints – a notable rise that pushes Personal Data Breach to fourth at 6.69%, while non-payment/non-delivery scams account for 5.6%. Together, the top 10 crime types account for a large share of what victims actually report. So when people in the U.S. say they were hit by “a cyber attack,” the odds are high it started with a phishing email, fake login page, or spoofed message designed to trick them into handing over passwords or money.

Why This Data is Important

Phishing sits at the top of the chart because it is cheap, easy to automate, and reusable across many targets. And the scale is massive: estimates suggest around 3.4 billion phishing emails are sent every day. Attackers only need a small success rate to turn thousands of fake emails or messages into real money. That’s scarier with AI in the mix, because testing shows AI-written phishing can pull far more clicks and credential submissions than older, human-written attempts. Once someone clicks the wrong link, criminals can steal passwords, reset accounts, or infect your Mac, PC, or smartphone with malware that can spread through connected networks. Basic habits – using strong passwords, turning on multi-factor authentication, and learning how to spot suspicious messages – go a long way. Adding a VPN can help by encrypting your traffic and hiding your real IP address, especially on public Wi-Fi. Gamers who worry about DDoS and ping spikes can also benefit from a well-chosen VPN. A VPN can also limit your exposure if you accidentally visit a malicious site, but if you suspect malware is already on your device, here’s how to remove a virus from your computer.

Looking Ahead: Future Outlook

Phishing is unlikely to lose its top spot soon. Generative text tools, cheap phishing kits, and stolen email lists make it simple to keep sending believable lures at scale. In just three months, researchers tracked 81,710 distinct phishing email campaigns, which shows how industrialized this outreach has become. Expect more messages that look and sound like real customer-service emails, delivery notices, or bank alerts. At the same time, the sharp rise of investment fraud – now the third most reported crime – signals that scammers are increasingly targeting financial decisions, not just login credentials. For everyday users, that means combining cautious clicking with layered defenses – good password hygiene, multi-factor logins, and a reliable, fast VPN – whenever you go online.

Source & Methodology

Complaint counts and crime categories come from the 2025 annual report of the FBI IC3. We used the “Crime Types by Complaint Count” table and the reported total of 1,008,597 complaints. Percentage shares were calculated by dividing each crime type’s complaints by the 2025 total and rounding to two decimal places. The chart focuses on the 10 most frequently reported crime types.