Photo by Michal Biernat on Unsplash
- Teaching people to "spot the typo" is a defense built for a threat that retired around 2023. Generative AI removed the grammar tells.
- As of November 4, 2026, the most recent authoritative U.S. figures available for this analysis remain the FBI IC3 2023 Internet Crime Report: 880,418 complaints and $12.5 billion in reported losses, with 298,878 phishing/spoofing complaints — the largest single category by volume.
- Volume and dollars don't live in the same place. Phishing/spoofing was roughly a third of all complaints; Business Email Compromise, a narrow phishing variant, accounted for over $2.9 billion — roughly a quarter of every reported dollar lost.
- That split means the right answer isn't more awareness slides. It's phishing-resistant MFA for the login, and a callback rule for the wire.
The Common Belief: You Can Spot a Phish
298,878.
That is how many phishing and spoofing complaints the FBI's Internet Crime Complaint Center logged in its 2023 Internet Crime Report — out of 880,418 total complaints and $12.5 billion in reported losses. Run the division and phishing/spoofing is roughly 34% of everything Americans bothered to report that year. One in three. As of November 4, 2026, that report remains the cleanest primary-source baseline for U.S. complaint volume, and readers should treat any newer vendor figure as needing its own verification. This analysis builds on reporting compiled by AI Fallback, cross-checked against primary material from the FBI IC3, CISA, and NIST.
The conventional advice attached to that number has barely changed in a decade: look for bad grammar, odd greetings, mismatched sender domains. Security researchers have spent the last two years pointing out the obvious problem with that guidance — generative AI erased the language tells. The vendor telemetry is blunt about scale. SlashNext reported roughly a 1,265% increase in malicious phishing emails in the twelve months following the mainstream release of ChatGPT in late 2022.
So the awareness-training pitch now asks users to detect something that, by construction, contains nothing to detect. A threat actor with a language model writes cleaner English than most internal IT announcements. (Which is its own quiet indictment of internal IT announcements.)
Where It Breaks Down: Volume Is Not the Expensive Part
Here is what the surface coverage of "AI supercharges phishing" consistently misses. The category that generates the most noise is not the category that generates the most loss.
Chart: Phishing and spoofing made up roughly 34% of all complaints filed with the FBI's IC3 in 2023 — the largest single category by count.
Now put the dollars beside the counts. BEC losses reported to IC3 exceeded $2.9 billion in 2023 against $12.5 billion in total reported losses — about 23% of every dollar, concentrated in a form of attack that arrives as a handful of highly targeted messages, not a flood. The blast radius of mass phishing is wide and shallow: stolen credentials, account takeover, one person's inbox. The blast radius of BEC is narrow and deep: a single finance employee changing payment details on an invoice.
That asymmetry is the practical finding, and it points different defenses at different problems. Security awareness training scales with volume, so it helps most against the wide-and-shallow tier. It is close to useless against a well-researched BEC lure that references a real contract and a real counterparty. Conversely, phishing-resistant MFA kills credential theft outright but does nothing about a request to wire money to a new account — because no credential was ever stolen.
There is a real divergence in the source literature here worth naming. Vendor telemetry such as SlashNext's frames the story as volume: AI made phishing cheap, so there is simply more of it. Breach-centric analysis like the Verizon Data Breach Investigations Report keeps emphasizing that breach success still hinges on the human element and credential reuse rather than raw email count. Both are right about different halves. More lures raise the number of attempts; weak authentication determines how many attempts convert. Our read: the conversion rate is the variable you actually control, and it is the cheaper one to fix.
Photo by Samsung Memory on Unsplash
The Defense Stack When Detection Fails
Design the stack assuming the user will click. Not because users are careless — because the message was engineered to be indistinguishable.
Tech control: phishing-resistant authentication. CISA's guidance is unambiguous that FIDO/WebAuthn passkeys are the gold standard, because the authentication is cryptographically bound to the legitimate site and cannot be relayed or replayed the way an SMS code or one-time passcode can. NIST SP 800-63B formalizes this, defining which authenticators qualify as phishing-resistant and at what assurance level. Apple, Google, and Microsoft have all shipped passkeys as a mainstream password replacement, which means this is no longer an enterprise-only control. If an attacker runs a real-time proxy that captures a victim's six-digit code, a passkey simply does not produce a credential the proxy can forward.
Process control: out-of-band verification on money movement. Any change to banking details, any unexpected wire request, any urgent vendor payment gets verified by calling a phone number already on file — never a number supplied in the message. This is the control that addresses the $2.9 billion tier, and it is free. Deepfake voice and video have already appeared in high-profile BEC cases, so "it sounded like the CFO" is no longer verification.
People control: reporting speed, not detection accuracy. Stop grading staff on whether they spotted the lure. Grade the organization on how fast a suspicious message reaches the security inbox, because that single metric feeds both threat intelligence and incident response. A report at minute three is containment; at hour six it is forensics. This is also where authentication telemetry gets strange in environments full of automated identities — a measurement problem AI Agents has examined in the context of login metrics, and one that matters if you plan to alert on anomalous sign-ins.
The fair pushback: passkeys are not supported everywhere, and legacy systems, shared service accounts, and smaller vendors still force passwords plus SMS. True. That is what compensating controls are for — enforce passkeys on email, identity provider, and finance systems first, since those are the accounts that convert a phishing click into a payout, and accept weaker authentication on the low-value remainder until support catches up.
Harden This Today
One thing, not thirty. Turn on a passkey for your primary email account, right now, and remove SMS as a recovery method afterward.
Email is the master key: it resets every other password you own. Protecting it with a credential that cannot be phished collapses the most common attack path in one move. For a small business, extend the same change to the identity provider and to anyone with authority to move money — typically fewer than ten accounts. Then write the callback rule for payment changes into your actual procedures, not a training deck.
The bottom line: on balance, the data suggests organizations are over-investing in teaching people to detect what AI has made undetectable, and under-investing in the two controls that work regardless of how convincing the message is. Cybersecurity best practices in a post-generative-AI threat landscape are less about sharper eyes and more about authentication and data protection that fail safe when the eyes miss.
Frequently Asked Questions
What are the warning signs of a phishing email in 2026?
Behavioral signals now outrank linguistic ones. Urgency around money or credentials, a request to change payment details, an unexpected login prompt, a QR code in place of a link, and any message pushing you to a sign-in page you did not navigate to yourself. Security researchers broadly agree that spelling and grammar errors are no longer reliable tells, since generative AI produces clean copy by default.
How do I protect myself from phishing attacks without becoming a security expert?
Enable phishing-resistant MFA — a passkey or hardware security key — on email, banking, and your identity provider. CISA recommends FIDO/WebAuthn credentials specifically because they cannot be relayed or replayed by an attacker. Add one habit: verify any money-related request by calling a number you already had, not one in the message.
What should I do if I clicked on a phishing link and entered my password?
Treat it as an active incident, in this order: change the password from a different device, revoke active sessions in the account's security settings, enroll a passkey, check for new forwarding rules or recovery addresses the attacker may have added, and notify your IT or security contact so incident response can check for lateral movement. If financial details were exposed, contact the bank and file a report with the FBI's IC3.
What is the difference between phishing, smishing, vishing, and quishing?
Same playbook, different channel. Phishing arrives by email, smishing by SMS or messaging app, vishing by voice call — increasingly with cloned audio — and quishing hides the malicious destination inside a QR code to bypass email link scanning. The defense is identical across all four: verify out of band and use authentication that cannot be handed over.
Does multi-factor authentication actually stop phishing attacks?
It depends entirely on the factor. SMS codes and app-generated one-time passcodes can be captured by a real-time proxy page and replayed within seconds, so they reduce risk without eliminating it. FIDO2 passkeys and hardware keys are bound to the legitimate domain, which is why NIST SP 800-63B classifies them as phishing-resistant and CISA treats them as the standard worth migrating to.
Disclaimer: This article is editorial commentary for informational purposes only and does not constitute professional security consulting advice, nor does it reflect independent product testing. Always consult a qualified cybersecurity professional for your specific environment. Figures cited from the FBI IC3 2023 Internet Crime Report and vendor telemetry should be re-verified against the latest published editions before being used for budgeting or risk decisions. Research based on publicly available sources current as of November 4, 2026.