UK phishing statistics: attacks identified by businesses and charities, suspicious emails reported to the NCSC, and wider fraud context. Reporting totals, confirmed crimes and payment losses are distinct measures.

Phishing was the most commonly identified attack type in the Cyber Security Breaches Survey 2025/26. This page combines that survey with NCSC operational figures, ONS household estimates and UK Finance industry data. The sources have different populations and definitions; they do not provide one complete total of UK phishing victims or losses.

Key facts and figures

  • 38% of UK businesses and 25% of charities experienced phishing attacks in the 12 months to the 2025/26 survey — the most common attack type (CSBS 2025/26).
  • 93% of businesses that experienced a cyber crime said phishing was involved; for charities the figure was 95% (CSBS 2025/26).
  • 10.9 million phishing reports were made to the NCSC's Suspicious Email Reporting Service in the year to the 2025 Annual Review.
  • 45 million+ reports have been sent to SERS in total since it launched in April 2020 (NCSC, 2025).
  • 412,000 malicious URLs have been removed by the NCSC since 2020 (NCSC Annual Review 2025).
  • 4.5 million fraud incidents were estimated among adults in England and Wales in the year ending March 2026, with no statistically significant annual change.
  • £1.28 billion was reported lost to payment fraud in 2025 by UK Finance members; this is not a phishing-only loss total.
  • 69% of organisations that suffered a breach or attack rated phishing the most disruptive type they faced (CSBS 2025/26).

Checked on 15 October 2026. CSBS fieldwork ran from August to December 2025; NCSC figures below are dated to its 2025 Annual Review. ONS headline figures cover the year ending March 2026, with its separate detailed nature-of-crime analysis still covering March 2025.

How common are phishing attacks in the UK?

38% of UK businesses and 25% of UK charities experienced phishing attacks in the 12 months before the Cyber Security Breaches Survey 2025/26 (fieldwork August–December 2025, published 30 April 2026). That makes phishing the most prevalent attack type by a distance. For context, 43% of businesses and 28% of charities identified any cyber breach or attack over the same period — equivalent to roughly 612,000 UK businesses and 57,000 charities — so where an organisation was attacked at all, phishing was almost always part of the picture.

The pattern is even starker among incidents serious enough to count as crimes. Of the organisations that experienced a cyber crime, phishing was involved for 93% of businesses and 95% of charities (CSBS 2025/26). Across the whole economy, 18% of all UK businesses and 13% of all charities experienced a phishing-based cyber crime in the last 12 months.

Among businesses and charities that could specify a breach or attack they had identified, 69% in each group selected phishing as the most disruptive type. That is a share of affected organisations, not evidence that a phishing incident is inherently more damaging than every other type of attack.

Business phishing prevalence was 38% in 2025/26, unchanged from the previous survey and significantly below 42% in 2023/24. The figures describe identified attacks over the preceding 12 months. Detection and reporting affect survey results; non-cyber ICO reports should not automatically be described as human mistakes.

How many phishing emails are reported in the UK?

The NCSC Annual Review 2025 records more than 10.9 million reports to the Suspicious Email Reporting Service during its review year, September 2024–August 2025. That is about 30,000 reports per day on average. Reports are not unique campaigns, victims or confirmed crimes.

By that review, the cumulative total since the service began in April 2020 exceeded 45 million reports. A cumulative total necessarily grows when new reports arrive; it does not by itself show that the reporting rate or the prevalence of phishing is accelerating.

How many phishing sites does the NCSC take down?

The NCSC’s 2025 review records 412,000 malicious URLs removed since 2020 through its suspicious-email work. Its separate Takedown Service summary reports 1.2 million commodity campaigns removed. Campaigns and URLs are different units; the two figures should not be added or described as the same cumulative series.

Government itself is a constant target. The NCSC reports that more than 26,000 phishing campaigns aimed at UK government departments were disrupted in the year to the 2025 Annual Review, with 79% resolved within 24 hours of detection.

Takedown figures describe the NCSC’s operational activity, while CSBS describes attacks recognised by surveyed organisations. Neither proves what share of all UK phishing campaigns use a particular toolkit or how many unique people were protected by each removal.

How many people fall victim to fraud and hacking?

The CSEW estimated 4.5 million fraud incidents among household residents aged 16 and over in England and Wales in the year ending March 2026. There was no statistically significant annual change in incident numbers. The estimated number of victims rose 10% to 3.8 million; incidents and people are different measures.

The same bulletin estimated 798,000 computer misuse incidents, also with no statistically significant annual change. Recorded fraud and cybercrime were temporarily omitted during the transition from Action Fraud to Report Fraud. These figures are broader context, not a count of phishing attacks.

The separate ONS detailed analysis for the year ending March 2025 found no contact with the offender in 79% of fraud incidents. Among incidents with contact, first contact was by phone in 39%, online in 32% and email in 13%. In hacking incidents, social or messenger accounts were accessed in 26% and email in 16%. These are different denominators and none is a phishing conversion rate.

How much money is lost to payment fraud?

UK Finance members reported £1.28 billion in gross payment-fraud losses in 2025, up 4%. The total covers authorised and unauthorised payment fraud and includes money later recovered. It should not be labelled as phishing losses: the report does not assign the whole amount to phishing or other social engineering.

Authorised push payment fraud accounted for £576.4 million, up 19%, across 248,070 confirmed cases. Unauthorised fraud losses were £703.4 million, down 5%, while confirmed cases rose 11% to 3,814,128. Cases concern accounts or cards, not necessarily distinct people. The report says 66% of APP cases originated online, a case share rather than a share of losses.

Measure2025 figureChange on 2024
Total payment fraud losses£1.28 billion+4%
APP fraud losses£576.4 million+19%
APP fraud cases248,070+7%
Unauthorised fraud losses£703.4 million−5%
Unauthorised fraud cases3.81 million+11%

The table uses UK Finance’s Annual Fraud Report 2026, published in June 2026 and covering calendar year 2025. Its case counts and gross losses are industry-reported measures, not a national phishing-only total.

How do I report a phishing email or text in the UK?

Use the official reporting routes below. A suspicious-message report helps investigation and prevention but is not a substitute for contacting your bank promptly if money or account access is at risk.

  • Suspicious emails — forward them to report@phishing.gov.uk, the NCSC's Suspicious Email Reporting Service.
  • Suspicious texts or call numbers — report them through 7726, the free service available on most UK mobile networks.
  • If you have lost money or suffered a crime — contact your bank when relevant and report to Report Fraud in England, Wales or Northern Ireland, or Police Scotland in Scotland.

NCSC reports are analysed to identify malicious content and support action with relevant service providers. Not every report results in a takedown, and the number of reports is not the number of sites removed or people defrauded.

Frequently asked questions

How common are phishing attacks in the UK?

Very. Phishing was the most prevalent attack type in the Cyber Security Breaches Survey 2025/26, experienced by 38% of UK businesses and 25% of charities in the previous 12 months. Among organisations that suffered a cyber crime, phishing was involved in 93% of business cases and 95% of charity cases.

How many phishing emails are reported in the UK each year?

The NCSC's Suspicious Email Reporting Service received over 10.9 million reports in the year to its 2025 Annual Review — roughly 30,000 a day — and has received more than 45 million in total since launching in April 2020.

How much money is lost to phishing and online fraud in the UK?

UK Finance reports £1.28 billion in payment-fraud losses for 2025, including £576.4 million in APP fraud. Those are not phishing-only losses. Separately, the CSEW estimated 4.5 million fraud incidents among adults in England and Wales in the year ending March 2026.

How do I report a phishing email or text in the UK?

Forward suspicious emails to report@phishing.gov.uk and report suspicious texts or call numbers through 7726 on participating networks. If money has been lost, contact your bank promptly and report to Report Fraud in England, Wales or Northern Ireland, or Police Scotland in Scotland.

Are phishing attacks increasing or decreasing?

Business phishing prevalence was 38% in the 2025/26 survey, unchanged from the previous year and below 42% in 2023/24. NCSC reporting totals measure a different activity. The latest CSEW fraud estimate showed no statistically significant annual change and is not a phishing-specific measure.

Are there separate spear phishing statistics for the UK?

The cited Cyber Security Breaches Survey reports phishing as a combined category, without a separate representative UK spear-phishing prevalence estimate. Targeted campaigns may appear in other operational or vendor research, whose sample and definitions need to be checked before comparison.

Sources & references

Phishing is the most common cyber attack UK organisations face — and it succeeds when people click without thinking. Train your team to spot suspicious emails and handle personal data safely.

Explore the GDPR & Data Protection Course →
Mark McShane
Mark McShane
Health & Safety Training Specialist, Online CPD Academy

Mark writes about GDPR, data protection and accredited online training for GDPR & Data Protection Course, part of Online CPD Academy.