Phishing remains the most reported starting point for data breaches. In 2024, 36% of breaches involved phishing. AI-generated phishing has made detection harder by nearly eliminating grammatical errors. BEC losses exceeded $2.9 billion in 2023. Learn how to identify AI phishing emails.
Phishing is not a peripheral risk. The fact that 36% of data breaches involve phishing means security teams must treat inbox threats as a primary attack path. AI-generated phishing makes this worse by removing the spelling and grammar errors that people often use as warnings. Employees who complete simulated phishing training click far less often. That reduction is one of the few directly measurable controls. For help separating real emails from AI-written ones, see how to verify AI vs human.
The $2.9 billion in BEC losses reported by the FBI IC3 shows that phishing is not only about stolen credentials. Attackers target wire transfers and invoice fraud after compromising email accounts. Prevention starts with freezing credit and limiting identity exposure, but it also requires reporting. Use the FBI IC3 portal and review CISA guidance for enterprise controls. Families concerned about vulnerable relatives should review protecting elderly parents from AI scams.
Phishing in Data Breaches
| Stat | Detail | Source |
|---|---|---|
| Most reported starting point | Phishing is the most reported starting point for data breaches | Verizon DBIR, 2024 |
| 36% of breaches | 36% of data breaches involved phishing | Verizon DBIR, 2024 |
AI-Generated Phishing and Training Effect
| Stat | Detail | Source |
|---|---|---|
| Grammar error reduction | AI-generated phishing nearly eliminated grammatical errors, making detection harder | KnowBe4, 2024 |
| Simulated phishing click rate | Employee click rates on simulated phishing drop sharply after training | KnowBe4, 2024 |
Business Email Compromise Losses
| Stat | Detail | Source |
|---|---|---|
| $2.9B+ in 2023 | Business email compromise (BEC) losses exceeded $2.9 billion in 2023 | FBI IC3, 2024 |
Frequently Asked Questions
What share of data breaches starts with phishing?
Verizon’s 2024 Data Breach Investigations Report found that 36% of data breaches involved phishing. It was the most reported starting point for breaches. This makes phishing awareness a core control.
How does AI make phishing emails harder to detect?
KnowBe4’s 2024 analysis says AI-generated phishing nearly eliminated grammatical errors. Many recipients relied on poor grammar as a warning sign. Without that cue, detection depends more on verifying sender details and links. See how to identify AI phishing emails.
Does phishing awareness training actually work?
Yes. KnowBe4 reports employee click rates on simulated phishing drop sharply after training. Repeated testing and feedback are key. That makes security awareness programs a measurable risk reduction tool.
How large are business email compromise losses?
The FBI Internet Crime Complaint Center reported BEC losses exceeded $2.9 billion in 2023. BEC often starts with a phishing email that leads to fraudulent wire transfers. Report suspected BEC attempts to the FBI IC3.
Where should I report an AI phishing attempt?
File a complaint with the FBI IC3 and follow the step-by-step reporting guide. You can also review prevention guidance from CISA.
