The FBI Says Phishing Scams Are the #1 Cybercrime — And It's Not Even Close

In 2023, the FBI's Internet Crime Complaint Center (IC3) received over 298,000 complaints about phishing scams — more than any other cybercrime category. That number has topped the charts for five consecutive years. If your organization hasn't been targeted yet, I promise you: it has. Your people just haven't reported it.

I've spent years helping organizations respond to breaches that started with a single phishing email. A forged invoice. A spoofed Microsoft 365 login page. A fake HR benefits update sent on a Friday afternoon. These attacks work because they exploit trust, urgency, and habit — not software vulnerabilities. And the financial damage is staggering.

This post breaks down how modern phishing scams actually operate, what they cost businesses of every size, and the specific steps I've seen work to shut them down.

What Are Phishing Scams, Exactly?

Phishing scams are social engineering attacks where a threat actor impersonates a trusted entity — a bank, a vendor, a colleague, even your CEO — to trick someone into handing over credentials, clicking a malicious link, or transferring funds. They arrive via email, text message (smishing), voice call (vishing), and even QR codes.

The goal is almost always one of three things: steal login credentials, deploy malware or ransomware, or initiate a fraudulent wire transfer. According to the Verizon 2024 Data Breach Investigations Report, the human element was involved in 68% of all breaches — and phishing was the top initial access vector.

The $4.88M Lesson Most Organizations Learn Too Late

IBM's 2024 Cost of a Data Breach Report pegged the global average breach cost at $4.88 million. Phishing was the most common initial attack vector, and breaches that started with phishing took an average of 261 days to identify and contain.

Think about that. A threat actor sits inside your network for nearly nine months before anyone notices. During that time, they're moving laterally, escalating privileges, exfiltrating data, and setting up persistence mechanisms.

Small and mid-sized businesses get hit hardest proportionally. They often lack dedicated security teams, rely on a single email gateway, and assume their employees "know better." In my experience, that assumption is the single biggest risk factor I see.

Real Costs Beyond the Breach

  • Regulatory fines: The FTC has taken action against companies for failing to implement reasonable security measures after phishing-related breaches. The FTC's case archive is full of examples.
  • Customer churn: Post-breach customer attrition rates average 3-5%, which compounds for years.
  • Legal exposure: Class action lawsuits following data breaches have become routine, not exceptional.
  • Operational downtime: Ransomware deployed via phishing can shut down operations for weeks.

How Modern Phishing Scams Actually Work in 2026

Forget the Nigerian prince emails. Today's phishing scams are sophisticated, targeted, and often indistinguishable from legitimate communications. Here's what I'm seeing right now.

Business Email Compromise (BEC)

A threat actor compromises or spoofs a vendor's email address and sends your accounts payable team a revised invoice with new banking details. The email thread looks authentic because it is authentic — they've been monitoring the real conversation for weeks. The FBI IC3 reported that BEC caused over $2.9 billion in losses in 2023 alone — the highest-dollar cybercrime category by far.

Adversary-in-the-Middle (AiTM) Phishing

These attacks use reverse proxy toolkits to intercept credentials and session tokens in real time. The victim enters their username, password, and even their multi-factor authentication code — and the attacker captures all of it. This technique bypasses traditional MFA completely. I've seen it used against organizations that thought MFA made them bulletproof.

QR Code Phishing (Quishing)

Attackers embed malicious QR codes in emails, parking signs, restaurant menus, and even internal company documents. When scanned, the code redirects to a credential harvesting page. It's effective because most mobile devices don't preview the full URL before loading it.

AI-Generated Phishing

Large language models have eliminated the grammar and spelling errors that used to be reliable red flags. Threat actors now generate flawless, context-aware phishing emails at scale. Some even clone executive voices for vishing attacks using publicly available earnings call recordings.

Why Technology Alone Won't Save You

I'm a big advocate for layered technical defenses. You should absolutely deploy email filtering, DMARC/DKIM/SPF, endpoint detection and response, and phishing-resistant MFA like FIDO2 security keys. CISA's Shields Up guidance is a solid starting point for hardening your environment.

But here's what I've learned from responding to hundreds of incidents: technology catches the known threats. The novel ones — the carefully crafted spear-phishing email that references a real project your team is working on — those sail right past your filters and land in someone's inbox.

The last line of defense is always a human being making a split-second decision. That's why security awareness training isn't optional. It's infrastructure.

What Actually Works to Stop Phishing Scams

Based on what I've seen succeed across organizations of all sizes, here's the playbook that actually reduces phishing risk.

1. Continuous Security Awareness Training

Annual compliance training is theater. It checks a box and changes nothing. Effective training is continuous, scenario-based, and tied to real-world phishing scams your employees will actually encounter. Our cybersecurity awareness training program is built around this principle — short, frequent modules that build pattern recognition over time.

2. Realistic Phishing Simulations

You can't measure what you don't test. Regular phishing simulations show you exactly where your organization is vulnerable — which departments, which roles, which attack types. More importantly, they create teachable moments. When someone clicks a simulated phish, they get immediate feedback. That feedback loop is where behavior actually changes. Our phishing awareness training for organizations includes simulation campaigns designed around the latest threat intelligence.

3. Phishing-Resistant MFA

Standard SMS or app-based MFA is better than nothing, but AiTM attacks have proven it's not enough. FIDO2 security keys and passkeys are the current gold standard. They bind authentication to the legitimate domain, which means a phishing site can't relay the token. If you do nothing else this quarter, start migrating your high-risk accounts to phishing-resistant MFA.

4. Zero Trust Architecture

Zero trust isn't a product you buy. It's a design philosophy: never trust, always verify. Every access request gets authenticated, authorized, and encrypted — regardless of whether it originates inside or outside the network. This limits the blast radius when a phishing attack does succeed, because a compromised credential doesn't automatically grant access to everything.

5. Incident Response Playbooks

Your employees need to know exactly what to do when they suspect a phishing email. Not "forward it to IT" — a specific, documented process. Who do they contact? What button do they click to report? What happens next? The faster you can identify and contain a phishing compromise, the lower the cost.

How Do I Know If an Email Is a Phishing Scam?

This is the question I get asked most often. Here are the signals that should trigger suspicion:

  • Urgency or threats: "Your account will be suspended in 24 hours" or "Immediate action required."
  • Mismatched sender details: The display name says "Microsoft" but the email address is from a random domain.
  • Unexpected attachments or links: Especially ZIP files, Office documents with macros, or shortened URLs.
  • Requests for credentials or payment changes: Legitimate companies almost never ask for passwords via email.
  • Too-good-to-be-true offers: Gift cards, refunds, or prizes you didn't apply for.

When in doubt, don't click. Verify through a separate channel — call the sender using a number you already have, not one from the suspicious email.

The Bottom Line on Phishing Scams in 2026

Phishing scams aren't going away. They're getting faster, more targeted, and harder to detect. AI is making them more convincing. Phishing-as-a-service kits are making them more accessible to low-skill attackers. And the shift to remote and hybrid work has expanded the attack surface dramatically.

But organizations that combine strong technical controls with continuous, realistic training are seeing measurable results. I've watched companies cut their phishing click rates by 80% within six months of implementing regular simulations and targeted education.

Your employees aren't your weakest link — they're your most scalable sensor network. But only if you invest in training them properly. Start with a comprehensive security awareness program and add hands-on phishing simulations to make the training stick.

The threat actors are investing in their craft every single day. The question is whether you're investing in your defenses at the same pace.