Cybercriminals manipulate technologies to steal data but how exactly do they trick people into divulging sensitive personal information?
Be it by phishing, baiting, tailgating, vishing, smishing, or water-holing, social engineering statistics show fooling people is a highly effective way for hackers to gain credentials, access data, and then launch large-scale attacks.
Let’s take a quick look at these stats to see the staggering impact social engineering has around the globe.
Astonishing Social Engineering Stats to Keep In Mind in 2026
- Cybercriminals use social engineering in 98% of attacks.
- Microsoft was impersonated in 23% of brand phishing attempts in Q2 2026.
- 33.2% of employees click on a simulated phishing email before security awareness training.
- There are 75 times as many phishing websites as malware sites.
- 75% of companies worldwide were victims of phishing in 2020.
- With 191,561 complaints, phishing and spoofing was the most reported cybercrime in the US in 2025.
- A ransomware attack is successful every 11 seconds.
- In 2019, the cost per compromised record was $150 on average.
- The US government allocated nearly $19 billion for cybersecurity in 2021.
What Is Social Engineering?
Basically, it’s convincing someone to perform a particular action.
Cybercriminals who use social engineering lure you to share your personal information, open infectious files, or give them access to restricted data.
Let’s take a look at some of the latest social engineering statistics.
1. Cyber attacks employ social engineering 98% of the time.
(Source: Purplesec)
In other words, many employees can’t detect social engineering threats and unknowingly open the doors for cybercriminals to steal money, access data, and tarnish your reputation.
Although there are some (21% if we consider both current and former employees) who may intentionally use social engineering hacks to get back at you.
2. Over 70% of all data breaches are due to social engineering.
(Source: GlobalSign)
It’s easier to fool people rather than to infiltrate a secure computer system, so it’s no surprise that about 70% to 90% of all data infiltration is due to phishing and social engineering attacks.
Cybercriminals can target any individual or company (our data breach statistics show how costly that gets), though statistics show that healthcare institutions, government agencies, and universities are the preferred targets for social engineering scams because of the information they store.
3. There are more than two million phishing websites.
(Source: IDAGENT)
As of Jan 17, 2021, the search engine powerhouse, Google recorded 2,145,013 phishing sites.
What happens is that hackers constantly feed the Dark Web with the data they steal, which then serves as fuel for further cyberattacks.
Just in 2020, hackers added approximately 22 million new records to the Dark Web.
4. 96% of phishing attacks use email.
(Source: Tessian)
Although the number of phishing sites is staggering, the latest social engineering stats reveal that only 3% of phishing attacks are carried out through a website, and 1% is via phone (either vishing or smishing).
Given how many emails are sent every day, that is a huge attack surface. A phishing email tricks individuals into taking action immediately. They typically cite emergencies to get you to reveal sensitive information.
The most common words cybercriminals use in emails are: urgent, request, important, payment, and attention.
5. 23% of brand phishing attempts impersonated Microsoft in Q2 2026.
(Source: Check Point)
Social engineering emails usually impersonate a well-known company to increase the chances of you opening them.
Microsoft is the preferred fake identity for attackers to adopt, with nearly double the share of the next closest brand. That’s no surprise given how many people use its software: Microsoft 365 alone has more than 450 million paid commercial seats.
LinkedIn, Google, Apple, and Amazon complete the top five most impersonated brands, and ChatGPT entered the top 10 for the first time.
6. The most common attachment in phishing emails is Windows executable files.
(Source: ESET Threat Report)
Phishing stats say attackers send a Windows executable file (usually disguised as a PDF, Excel, or Word file) 74% of the time.
They can also use script files (11%) or compressed files (4%), but executables are preferable because the program runs the moment you open it.
7. 18% of phishing victims lose money.
(Source: Tessian)
How dangerous is social engineering?
Pretty dangerous. It seems money is not the main motivator for cybercriminals—information is.
After a successful phishing attack, 60% of companies report lost data, 52% declare compromised credentials, and 29% complain of malware infection, which ends up damaging the company’s entire computer network.
Social Engineering Statistics in 2026
Companies are spending millions of dollars to protect themselves and their customers from data breaches, but it seems those are wasted efforts unless they train employees, as well.
Social engineering is a burning issue because it exploits people’s natural tendency to trust others and tricks them into revealing sensitive information.
8. The average organization faces 700 social engineering threats per year.
(Source: ZDNet)
So, how many businesses are targeted by spear-phishing attacks each day?
We know that in one year, attackers sent 12 million spear-phishing emails to three million mailboxes, affecting 17,000 organizations.
That means 46.5 companies receive an average of two spear-phishing emails each day.
9. Only 34% of companies provide social engineering awareness training.
(Source: GetApp)
Businesses around the world spend millions on security technologies, but they don’t take the time to educate employees on social engineering and data breaches. GetApp’s 2023 survey found that only about a third of companies cover social engineering in their training.
An earlier GetApp survey found that about 43% of employees don’t receive data security training regularly, and an alarming 8% have never received any.
10. 45% of millennial employees don’t know what phishing is.
(Source: Proofpoint)
Social engineering statistics by age show that the older employees are, the more familiar they are with the subject.
65% of employees older than 39 can define phishing correctly, compared to just 47% of 18- to 22-year-olds.
However, the opposite is true for vishing—34% of employees in the 18-22 age group know what vishing is, whereas just 20% of employees who are older than 55 are familiar with the term.
11. 43% of IT workers were victims of social engineering attacks in 2020.
(Source: ZDNet)
However, the most common targets are neither CEOs nor people in IT.
Employees who don’t have a financial or executive role receive 80% of the threats.
12. About a third of employees fail a phishing test.
(Source: KnowBe4)
KnowBe4’s 2026 benchmarking report puts the global baseline Phish-Prone Percentage (PPP) at 33.2%. That is the share of untrained employees who click a simulated phishing link or open a malicious attachment.
The report draws on 42 million simulations sent to 14.8 million users at 64,000 organizations, and the rate varies by industry and organization size.
The good news: after a year of security awareness training and regular simulated phishing, the fail rate dropped to 4.2%. For more on how these attacks work, see our phishing statistics.
13. 60% of employees in the US click on emails even if they think them suspicious.
(Source: Graphus)
A recent study showed that although 78% of participants had recently received training against social engineering threats, 60% admitted to opening suspicious emails.
Social engineering statistics say that 45% of them don’t report the issue to the IT department after clicking.
Social Engineering News
Over the years, many companies across different industries have been the unfortunate targets of data breaches.
A few examples that come to mind are the 2017 Equifax Breach (which affected nearly 150 million consumers), the 2020 Marriott Breach (which impacted 5.2 million guests), and the Twitter Breach (which targeted 130 accounts in 2020). Our list of the biggest data breaches has many more.
Now, let’s look at some global stats.
14. Mongolia had the highest phishing attack rate in 2020.
(Source: Statista)
Social engineering statistics by country show Mongolia was the most targeted country, with 15.54% of online users affected by phishing attacks during the third quarter of 2020.
Israel came in second place with 15.24%, followed by France (12.58%) and Brazil (11.86%).
15. Phishing emails affected over one million businesses in the UK.
(Source: INFOTECH)
The email attacks affected 1.3 million businesses in the UK, costing them nearly £7 billion.
It’s particularly difficult for small businesses to fend off these attacks because most of them (73%) don’t have IT security measures in place.
16. Phishing was the most reported cybercrime in the United States in 2025.
(Source: FBI IC3)
The FBI’s Internet Crime Complaint Center received 191,561 phishing and spoofing complaints in 2025, more than for any other crime type. That compares with 193,407 in 2024 and 298,878 in 2023.
Fewer complaints did not mean smaller losses. Reported phishing losses rose to about $215.8 million in 2025, up from roughly $70 million a year earlier.
Across all crime types, the IC3 logged 1,008,597 complaints and $20.9 billion in reported losses in 2025, up 26% from 2024. For a longer view of these attacks, see our cybersecurity statistics.
17. More than $15,000 is lost every minute due to phishing.
(Source: Varonis)
The latest social engineering stats reveal that around $17,700 is lost every minute due to phishing. That equates to $1,062,000 per hour and $25,488,000 per day.
18. Social engineering attacks cost companies $130,000 on average.
(Source: Security Info Watch)
That’s just considering the money and data that the average company loses. However, there are additional associated costs that the business must cover, such as recovery fees and security updates.
Now factor in how common cyberattacks are (internet privacy stats say one occurs every 39 seconds) and it should come as no surprise that experts predicted the global annual cost of cybercrime would reach an astronomical $10.5 trillion by 2025.
Ways to Prevent a Social Engineering Attack
Cyber attackers can manipulate you and get access to your credentials, passwords, and information. But you can prevent that from happening.
We at Webtribunal thought we’d give you some tips on how to protect yourself from social engineering frauds:
- Be wary – Don’t open unknown email attachments, double-check URLs, and keep in mind that if something sounds too good to be true, it probably is.
- Use two-factor authentication – It’s a simple way to strengthen account security. Keeping your software up to date and installing a good antivirus are good ideas too.
- Don’t reuse passwords – Unique and complicated are your best bet, but they’re also hard to come up with and memorize. If you need help with that, you can get a password manager (our password statistics show why it matters). They’re safe to use and do their part in protecting you from online threats.
- Keep up to date with social engineering trends – Cybercriminals are often coming up with new ways to trick you into giving them what they want. Look up examples of social engineering and read up on what the latest scamming techniques are so you don’t fall for them.
- Consider using identity protection software – They scan the Dark Web for your information, notify you of any breaches, keep track of your credit score, and some even offer identity theft insurance.
Wrap Up
If the social engineering statistics that we just covered prove anything, it’s that social engineering is a threat to millions of companies and individuals around the globe.
With technological advancement, hacking evolves as well—emails often don’t look as scammy as they are anymore.
So, keep your eyes peeled, educate your employees on the dangers of social engineering, and take some steps to protect your identity online.
Better safe than sorry, right?
