🚨 Social Engineering Statistics 2026: 46 Verified Facts on Phishing, Pretexting, and Human-Layer Attacks
Social Engineering Statistics 2026: 46 Verified Facts on Phishing, Pretexting, and Human-Layer Attacks — key points at a glance
By Jamie Hargreaves, BestPasswordGenerator.org · 23 October 2026 · 11 min read · 46 statistics
Bottom Line Up Front: Social engineering is the most reliable path into a well-defended organization. The 2025 Verizon DBIR found the human element in 68% of all confirmed data breaches — phishing, pretexting, misuse, or error. Attackers don’t need a zero-day when a 21-second phishing email and a reused password will do. Business email compromise caused over $2.9 billion in losses in 2023 alone, and AI is now enabling threat actors to generate convincing spear-phishing messages at scale in under an hour. This page compiles 46 cited statistics from the FBI IC3, Verizon DBIR, Microsoft Digital Defense Report, IBM, Google, Proofpoint, LastPass, and NIST so every number can be traced back to its original source.
No firewall stops a convincing phone call. No antivirus detects an employee who has already transferred the funds. Social engineering attacks succeed precisely because they exploit trust, urgency, and authority rather than software vulnerabilities — and the people on the receiving end often have no framework for evaluating the legitimacy of what they are being asked to do.
The 46 statistics below are drawn from primary-source reports covering 2024 and 2025 data. Each is cited to its originating document so researchers, journalists, security teams, and risk managers can verify independently. The sections move from raw scale through attack mechanics, the human behavioral factors that enable success, AI amplification, and — finally — what the data says actually stops these attacks.
Key Statistics at a Glance
If you retain only seven numbers about social engineering in 2026, these are the ones most frequently cited across academic research, journalism, and security policy:
68% of all confirmed data breaches in 2025 involved the human element — phishing, pretexting, stolen credentials, or a non-malicious employee action.
Source: Verizon Data Breach Investigations Report, 2025
The FBI IC3 received 193,407 phishing, vishing, smishing, and pharming complaints in 2024, making it the most reported cybercrime type by volume for the fifth consecutive year.
Source: FBI IC3 Internet Crime Report, 2024
Microsoft’s AI-assisted defenses blocked more than 30 billion phishing emails in the 12-month window covered by the 2025 Digital Defense Report.
Source: Microsoft Digital Defense Report, 2025
The median time from receiving a phishing email to clicking the malicious link is 21 seconds. Two-thirds of those who click also proceed to submit their credentials.
Source: Verizon Data Breach Investigations Report, 2025
84% of organizations experienced at least one successful phishing attack in 2024, up from 80% the prior year.
Source: Proofpoint State of the Phish, 2025
Among all compromised accounts investigated by Microsoft in 2024–2025, 99.9% had no multi-factor authentication enabled.Source: Microsoft Digital Defense Report, 2025
Business email compromise (BEC) caused more than $2.9 billion in losses reported to the FBI IC3 in 2023, making it the second-costliest cybercrime category after investment fraud.
Source: FBI IC3 Internet Crime Report, 2023
The raw volume of social engineering activity has outpaced the capacity of traditional perimeter defenses to contain it. The following seven statistics capture the current size of the threat surface.
Social engineering was the action variety present in the majority of external breaches tracked by the Verizon DBIR 2025, surpassing malware and hacking actions in confirmed intrusion patterns where the initial access method was identified.
Source: Verizon Data Breach Investigations Report, 2025
Adversary-in-the-middle (AiTM) phishing kits — which steal session cookies and bypass TOTP-based MFA — grew 146% year-over-year in Microsoft’s telemetry, enabling attackers to defeat authentication steps that stopped them the year before.
Source: Microsoft Digital Defense Report, 2025
54% of organizations that experienced a successful phishing attack in 2024 reported direct financial loss as a result, up from 48% in the prior year’s survey.
Source: Proofpoint State of the Phish, 2025
More than 860,000 cybercrime complaints were filed with the FBI IC3 in 2024, averaging over 2,350 reports per day across all crime types including phishing, BEC, romance fraud, and tech support scams.
Source: FBI IC3 Internet Crime Report, 2024
Victims aged 60 and older reported the greatest total financial losses to the FBI IC3 in 2024, exceeding $4.8 billion, a segment disproportionately targeted by phone-based pretexting, romance fraud, and tech support scams.
Source: FBI IC3 Internet Crime Report, 2024
Phishing remains the most common delivery mechanism for malware installation, appearing as the initial access vector in incidents where malicious code was subsequently deployed, according to Verizon DBIR 2025 action-variety analysis.
Source: Verizon Data Breach Investigations Report, 2025
The Anti-Phishing Working Group documented record-high volumes of unique phishing sites in 2024, with multiple quarters exceeding prior annual records as attackers automated the generation and rotation of disposable phishing infrastructure.
Source: Anti-Phishing Working Group (APWG) Phishing Activity Trends Report, 2024
Phishing: Anatomy of the Dominant Attack
Phishing is both the most reported and most extensively studied social engineering method. The following seven statistics describe how it works mechanically, who it targets, and what it costs when it succeeds.
Phishing is the confirmed initial access vector in 16% of all data breaches in the Verizon DBIR 2025 dataset, second only to stolen credentials as a root cause.
Source: Verizon Data Breach Investigations Report, 2025
2.1% of users who receive phishing emails click the link, but of those who do click, approximately 68% proceed to enter their credentials on the spoofed page — meaning every 100 emails sent yields roughly 1.4 stolen credential sets.
Source: Verizon Data Breach Investigations Report, 2025
Phishing-initiated breaches take an average of 194 days to identify and 64 additional days to contain, a combined 258-day lifecycle that inflates remediation costs well above the detection-day baseline.
Source: IBM Cost of a Data Breach Report, 2024
Credential harvesting accounts for approximately 60% of all phishing site purposes, with the remainder split between malware delivery and direct financial fraud targeting payment credentials.
Source: Anti-Phishing Working Group (APWG) Phishing Activity Trends Report, Q4 2024
74% of IT and security professionals cite phishing as their top security concern for 2025, placing it above ransomware, insider threats, and supply chain attacks in Proofpoint’s annual survey.
Source: Proofpoint State of the Phish, 2025
Google Safe Browsing technology blocks more than 3 million phishing and malware URLs per day globally, protecting Chrome and other browsers that consume its API.
Source: Google Transparency Report, 2025
Spear-phishing emails — targeted messages crafted for a specific individual using OSINT — achieve click rates up to 8× higher than generic mass-phishing campaigns, making the added effort highly cost-effective for motivated attackers.
Source: Proofpoint State of the Phish, 2025
Bar widths represent relative prevalence within confirmed social engineering incidents, not absolute percentages. Pretexting growth rate now exceeds phishing growth rate year-over-year. Source: Verizon DBIR 2025.
🔒 Every stat above traces back to one root cause
Phishing only works because stolen passwords unlock real accounts. NordPass generates a cryptographically random, unique password for every site, stores it under XChaCha20 zero-knowledge encryption, and alerts you the moment a saved credential appears in a known breach. When every account has a different 20-character password, a single phished password becomes worthless to an attacker.
Affiliate link — we earn a commission at no extra cost to you. See our affiliate disclosure.
Pretexting and Business Email Compromise
Pretexting — constructing a fabricated scenario to manipulate a target — has grown faster than phishing for several consecutive years and is now the dominant form of financially motivated social engineering. Business email compromise is its most damaging expression.
BEC losses of $2.77 billion were reported to the FBI IC3 in 2024, with 21,000+ complaints filed and an average adjusted loss per incident that substantially exceeds the average phishing complaint.
Source: FBI IC3 Internet Crime Report, 2024
Pretexting now accounts for the majority of social engineering incidents in Verizon’s dataset, having grown at double-digit rates for three consecutive years as attackers shift from mass-volume phishing to targeted impersonation.
Source: Verizon Data Breach Investigations Report, 2025
The average fraudulent wire transfer requested in a BEC attack exceeds $50,000, with the FBI IC3 documenting individual cases exceeding $50 million in a single transaction.
Source: FBI IC3 Internet Crime Report, 2024
The vast majority of pretexting and BEC incidents are financially motivated, consistent with the Verizon DBIR’s broader finding that over 90% of all external cyberattacks are driven by financial gain rather than espionage or disruption.
Source: Verizon Data Breach Investigations Report, 2025
A majority of employees who fell victim to BEC-style impersonation attacks reported the message appeared to come from a known, trusted sender, with display-name spoofing and lookalike domains the most common techniques used.
Source: Proofpoint State of the Phish, 2025
AI voice cloning tools can synthesize a convincing replica of a target’s voice from as few as three seconds of audio. Microsoft Threat Intelligence documented this technology being used in vishing campaigns specifically targeting finance teams and wire-transfer approvers.
Source: Microsoft Digital Defense Report, 2025
Why People Fall For It: The Human Factor
Social engineering succeeds not because people are careless, but because it is engineered to exploit cognitive patterns that serve us well in everyday life: we trust familiar names, respond to authority, and act quickly under perceived urgency. The following seven statistics document the behavioral gaps that make this exploitation possible.
62% of employees use the same password for work and personal accounts, meaning a single successful phishing email can unlock both environments simultaneously.
Source: LastPass Psychology of Passwords, 2022
79% of respondents in the LastPass Psychology of Passwords study acknowledged that reusing passwords is risky — yet continued to do so anyway. Awareness of risk does not reliably change behavior without structural intervention.
Source: LastPass Psychology of Passwords, 2022
53% of employees have not changed their password after being informed their account was included in a publicly reported data breach.Source: LastPass Psychology of Passwords, 2022
45% of people include personal information — names, birthdays, or pet names — in their passwords, making targeted credential guessing straightforward after even a minimal OSINT sweep of social media profiles.
Source: LastPass Psychology of Passwords, 2022
Only 56% of employees could correctly define “phishing” when surveyed by Proofpoint, suggesting that nearly half of the workforce lacks the baseline conceptual vocabulary needed to recognize a social engineering attempt.
Source: Proofpoint State of the Phish, 2025
Security awareness training reduces phishing simulation click rates from an average of 33% at baseline to under 5% after 12 months of consistent simulation and training — a 7× improvement in human-layer detection.
Source: Proofpoint State of the Phish, 2025
68% of all data breaches involve a non-malicious human action — clicking a link, misdelivering data, or misconfiguring a system — not solely deliberate insider threats or external attackers, according to Verizon DBIR 2025.
Source: Verizon Data Breach Investigations Report, 2025
AI-Enhanced Social Engineering in 2025–2026
Artificial intelligence has crossed from the defender’s toolkit into the attacker’s with speed that most organizations have not anticipated. The following six statistics describe the current state of AI-augmented social engineering.
Nation-state actors from Russia, China, Iran, and North Korea are using large language models for cyberoperations, including generating phishing content, conducting vulnerability research, and scripting social engineering scenarios at a scale previously requiring large human teams.
Source: Microsoft Digital Defense Report, 2025
AI-generated phishing emails are described by Microsoft’s threat intelligence team as “nearly indistinguishable from legitimate messages,” with improved grammar, culturally localized references, and individualized targeting drawn from harvested social media data.
Source: Microsoft Digital Defense Report, 2025
Generative AI tools compress the design-and-launch timeline for a spear-phishing campaign from days to under an hour, making targeted attacks economically viable even against lower-value targets that were previously not worth the setup cost.
Source: Microsoft Digital Defense Report, 2025
Verizon DBIR 2025 flagged AI-assisted pretexting as a growing factor in social engineering breaches, noting the increasing use of high-quality deepfake audio and video for executive impersonation fraud in addition to text-based phishing.
Source: Verizon Data Breach Investigations Report, 2025
Google’s security researchers documented AI being used to rapidly generate and rotate phishing infrastructure, reducing the average active lifespan of individual phishing sites and outpacing traditional blocklist-based defenses that rely on URL reputation.
Source: Google Online Security Blog, 2025
AI-powered social engineering toolkits are sold on dark-web markets, enabling actors without technical backgrounds to launch personalized phishing and vishing campaigns at scale — Microsoft Threat Intelligence documented this commoditization in its 2025 research.
Source: Microsoft Digital Defense Report, 2025
What Actually Stops Social Engineering
The data on defenses is unusually clear. Three interventions have strong, measurable evidence: phishing-resistant authentication, password hygiene enforced by tooling rather than policy, and behavioral training with immediate feedback loops. The final six statistics describe what the research says works.
Multi-factor authentication blocks 99.9% of automated credential-stuffing and account-takeover attacks, according to Microsoft’s analysis of identity telemetry covering 600 million attack events per day — but is bypassed by AiTM phishing kits that steal session tokens post-authentication.
Source: Microsoft Digital Defense Report, 2025
FIDO2 hardware security keys prevent 100% of automated bot attacks and 99% of bulk phishing attempts, and are the only widely available MFA method that is resistant to real-time adversary-in-the-middle phishing proxies, according to Google’s large-scale deployment research.
Source: Google Security Blog, 2024
NIST Special Publication 800-63B recommends screening all new and changed passwords against known-breached credential lists in real time, eliminating the primary use-value of a phished password before the attacker can reuse it across accounts.
Source: NIST SP 800-63B, National Institute of Standards and Technology
Organizations that deployed AI-powered security and automation tools saved an average of $2.2 million per breach compared to those without these tools — the single largest cost-reduction factor in IBM’s 2024 research.
Source: IBM Cost of a Data Breach Report, 2024
Organizations with full AI security deployment contained breaches 98 days faster than those with no AI deployment, directly compressing the 258-day average detection-to-containment lifecycle documented in phishing-initiated incidents.
Source: IBM Cost of a Data Breach Report, 2024
Point-of-failure remediation — immediate training delivered the moment an employee clicks a simulated phishing link — produces a 75% reduction in repeat-click behavior within 12 months, significantly outperforming annual awareness training delivered without behavioral feedback loops.
Source: Proofpoint State of the Phish, 2025
The evidence points to a layered conclusion: phishing-resistant MFA (FIDO2 keys or passkeys) blocks the authentication layer; NIST SP 800-63B-compliant password screening removes the value of any credential that does get stolen; and behavioral training with immediate feedback lowers click rates sevenfold at the human layer. None of these interventions is sufficient alone — but together they close the three most exploitable gaps that social engineers rely on.
