How many phishing attacks happen per day?
The Anti-Phishing Working Group logged almost five million unique phishing attacks in 2023, its worst year on record, which averages more than 13,000 distinct attacks per day. That counts campaigns and sites, not messages: the raw volume of phishing emails sent daily is orders of magnitude higher, with industry estimates running into the billions. The direction matters more than the decimal: volume keeps climbing as AI makes convincing lures cheaper to produce.
What the numbers actually count
The most careful public series comes from the APWG's quarterly Phishing Activity Trends Reports, which track observed phishing attacks, sites and targeted brands. Vendor figures for emails sent per day are estimates built from mail-filter telemetry and should be read as scale indicators, not counts.
For a defender the practical takeaway is not the global total but the local one: a mid-sized business can expect phishing attempts to arrive most days, and the human element features in roughly two thirds of the breaches Verizon analyses each year. The question is not whether your staff will see phish, it is what they do in the first minute after one arrives.
| Measure | Figure | Basis |
|---|---|---|
| Unique phishing attacks, 2023 | Almost 5 million | APWG observed and reported attacks |
| Average per day, 2023 | More than 13,000 | Derived from the APWG annual total |
| Phishing emails sent per day | Billions (estimate) | Industry mail-filter telemetry, not directly measured |
See how your team handles the one attack that matters, the one aimed at them. Free phishing simulation, no card required.
Run a free phishing test