Voice phishing attacks jumped 442% between the first and second halves of 2024, and the volume in the first half of 2025 already exceeded all of 2024 (CrowdStrike, 2025 Threat Hunting Report). Mandiant ranked vishing the second most common initial infection vector for the entire year, present in 11% of intrusions where a vector could be identified (Mandiant, M-Trends 2026). On the consumer side, the FBI logged $20.9 billion in reported cybercrime losses in 2025, up 26%, with tech-support scams that typically begin as a phone call accounting for $2.13 billion (FBI, IC3 2025 Report). This analysis consolidates data from the FBI IC3, the FTC Consumer Sentinel Network, CrowdStrike, Mandiant, Pindrop, and 11 other primary sources to map how far and how fast voice-based fraud has moved.
TL;DR
- Vishing rose 442% from H1 to H2 2024, and H1 2025 volume already surpassed the full-year 2024 total (CrowdStrike, 2025 Threat Hunting Report).
- Voice phishing was the second most common initial infection vector for 2025, in 11% of intrusions, and the number one vector for cloud compromises at 23% (Mandiant, M-Trends 2026).
- US cybercrime losses hit $20.9 billion in 2025 across more than 1 million complaints, up 26% year over year (FBI, IC3 2025 Report).
- Adults 60 and older reported $7.75 billion in losses in 2025, a 59% jump, averaging $38,500 each (FBI, IC3 2025 Report).
- Consumers reported losing $3.5 billion to imposter scams in 2025, the top fraud category by report volume (FTC, 2025).
- Deepfake fraud attempts rose more than 1,300% in 2024, from one a month to seven a day (Pindrop, 2025).
- Contact centers faced an estimated $44.5 billion in fraud exposure in 2025, with a fraud attempt every 46 seconds (Pindrop, 2025).
- Hiya flagged 13.7 billion suspected spam calls in Q2 2025, about 150 million a day (Hiya, 2025).
- 70% of organizations shared sensitive data during simulated vishing calls, at an average cost of $14 million a year (Keepnet, 2024).
- Only 0.1% of people correctly identified every deepfake and real sample in a controlled test (iProov, 2025).
- Deloitte projects generative-AI-enabled fraud losses could reach $40 billion in the US by 2027 (Deloitte, 2024).
1. Vishing Has Become a Top Enterprise Attack Vector
The phone call has quietly overtaken the malicious email as the entry point attackers prefer. Email filters have matured; a live voice pressuring an employee has not. The clearest signal is that email phishing as an initial vector fell from 14% in 2024 to 6% in 2025, while voice phishing climbed to 11% to take the number two spot (Mandiant, M-Trends 2026). Against cloud environments the shift is even starker, where vishing is now the single most common way in. When attackers do get in by phone, the handoff to a follow-on operator is fast, with Mandiant measuring access transfers as short as 22 seconds.
| Metric | Value | Source |
|---|---|---|
| Increase in vishing, H1 to H2 2024 | 442% | CrowdStrike, 2025 Threat Hunting Report |
| Vishing rank as 2025 initial infection vector | #2, 11% of intrusions | Mandiant, M-Trends 2026 |
| Vishing as vector for cloud compromises | #1, 23% | Mandiant, M-Trends 2026 |
| Email phishing decline as vector, 2024 to 2025 | 14% to 6% | Mandiant, M-Trends 2026 |
| Pretexting share of social-engineering incidents | Over 50% (nearly doubled) | Verizon, DBIR 2025 |
| Breaches involving the human element | 60% | Verizon, DBIR 2025 |
| Organizations that shared sensitive data in vishing tests | 70% | Keepnet, 2024 Vishing Response Report |
| Average annual cost of vishing per organization | $14 million | Keepnet, 2024 |
Outlier note: on mobile specifically, vishing attacks rose 28% and smishing 22% year over year, and SMS-based lures made up 69.3% of all mobile phishing (Zimperium, 2025 Global Mobile Threat Report). For the wider breach picture, see our cybersecurity statistics 2026 roundup.
2. Phone-Scam Losses Keep Setting Records
Reported losses are not just rising; they are compounding. The FBI total crossed a threshold that reframes the scale of the problem: US cybercrime losses reached $20.9 billion in 2025 across more than 1 million complaints, the first year the complaint count passed seven figures (FBI, IC3 2025 Report). Two categories that almost always run through a phone line, tech-support and government-impersonation scams, drove much of the growth, with tech-support losses alone climbing from $1.46 billion to $2.13 billion in a single year.
| Metric | Value | Source |
|---|---|---|
| Total US cybercrime losses, 2025 | $20.877 billion across 1,008,597 complaints (up 26%) | FBI, IC3 2025 Report |
| Tech-support scam losses, 2025 | $2.134 billion (47,794 complaints) | FBI, IC3 2025 Report |
| Government-impersonation complaints, 2025 | 32,424 (nearly doubled from 17,367) | FBI, IC3 2025 Report |
| Business impersonator losses, FTC 2025 | Nearly $1 billion | FTC, 2025 |
| Imposter-scam losses reported to FTC, 2025 | $3.5 billion | FTC, 2025 |
| Government-impersonator losses, FTC 2025 | About $920 million (up from $789M) | FTC, 2025 |
| Median loss when fraud starts with a phone call, 2024 | $2,210 (vs $497 median overall) | FTC, Consumer Sentinel Data Book 2024 |
| US losses to phone scams, 2023 | $25.4 billion | Truecaller, 2024 report |
Context: the FTC found that fraud beginning with a phone call carried the highest median loss of any contact method in 2024, at $2,210, more than four times the $497 median across all fraud (FTC, Consumer Sentinel Data Book 2024). The phone converts curiosity into money faster than any inbox.
3. AI Voice Cloning Turns Vishing Into Deepfake Fraud
The economics of the scam call changed once a convincing voice became cheap to manufacture. A criminal no longer needs to sound plausible; the software does. Deepfake fraud attempts rose more than 1,300% in 2024, moving from about one incident a month to seven a day (Pindrop, 2025 Voice Intelligence and Security Report). Because a usable clone can be built from roughly three seconds of audio (FTC, 2023), any voicemail greeting or short video clip is now raw material. The clearest enterprise damage shows up in call centers, which face a projected $44.5 billion in fraud exposure for 2025.
| Metric | Value | Source |
|---|---|---|
| Rise in deepfake fraud attempts, 2024 | Over 1,300% (1/month to 7/day) | Pindrop, 2025 Voice Intelligence Report |
| Contact-center fraud attempt frequency, 2025 | Every 46 seconds | Pindrop, 2025 |
| Synthetic-voice attack growth, insurance / banking | +475% / +149% | Pindrop, 2025 |
| Projected 2025 contact-center fraud exposure | $44.5 billion | Pindrop, 2025 |
| Businesses hit by audio and video deepfakes, 2024 | 49% | Regula, 2024 Deepfake Survey |
| Average business loss to deepfakes | About $450,000 | Regula, 2024 |
| Projected US generative-AI fraud losses by 2027 | Up to $40 billion (from $12.3B in 2023) | Deloitte, 2024 |
| Audio-deepfake incidence, crypto sector | 55% | Regula, 2024 |
The counterweight to this is consent: the same voice-conversion technology becomes legitimate when a person clones only their own voice, on their own device, with a clear record of permission, which is the model behind on-device voice-cloning software. For the fraud side of that coin, see our voice-cloning fraud statistics and voice-cloning statistics 2026.
4. The Global Flood of Scam and Spam Calls
Before a scam succeeds, it has to reach a phone, and the sheer volume of unwanted calls is the pipeline that feeds every downstream loss. Hiya flagged 13.7 billion suspected spam calls in the second quarter of 2025 alone, about 150 million every day (Hiya, 2025). The problem is worldwide rather than American: in several European markets, close to half of all calls from unknown numbers are now spam, and the global tally of money lost to scams dwarfs any single country’s figure.
| Metric | Value | Source |
|---|---|---|
| Suspected spam calls flagged, Q2 2025 | 13.7 billion (150M/day) | Hiya, Global Call Threat Report 2025 |
| Unwanted calls, Q1 2025 | 12.5 billion (up from 11.3B in Q4 2024) | Hiya, 2025 |
| Share of UK calls that are fraud | 13% (28% spam) | Hiya, 2025 |
| Non-contact calls that are spam, Spain / France | 43.9% / 43.0% | Hiya, 2025 |
| Total lost to scams worldwide, 12 months | $1.03 trillion | GASA and Feedzai, Global State of Scams 2024 |
| Scam victims who recovered their money | 4% | GASA and Feedzai, 2024 |
| US adults who received spam calls in a year | 92% | Truecaller, 2024 report |
Outlier note: nearly half of global consumers reported facing a scam attempt at least once a week, and in Brazil, Hong Kong, and South Korea exposure approached daily (GASA and Feedzai, 2024). The recovery rate of 4% is the number that stings most, since almost none of the money comes back.
5. Who Gets Targeted: Older Adults Bear the Brunt
The losses are not spread evenly, and the concentration among older victims is widening rather than closing. Adults 60 and older reported $7.75 billion in losses in 2025, a 59% increase, on 201,266 complaints that averaged $38,500 each (FBI, IC3 2025 Report). Government-impersonation complaints from that age group nearly doubled, and more than 12,000 seniors reported single losses above $100,000. The pattern reflects who answers unknown calls and who has retirement savings to drain.
| Metric | Value | Source |
|---|---|---|
| Losses reported by adults 60+, 2025 | $7.748 billion (up 59%) | FBI, IC3 2025 Report |
| Complaints and average loss, adults 60+, 2025 | 201,266 complaints (up 37%), $38,500 average | FBI, IC3 2025 Report |
| Victims 60+ losing over $100,000 | 12,444 | FBI, IC3 2025 Report |
| Senior government-impersonation losses, 2025 | $413 million (8,628 complaints) | FBI, IC3 2025 Report |
| Adults 18-44 vs 45+ likelihood of phone-scam loss | 3x more likely | Truecaller, 2024 report |
| US adults who lost money to a phone scam, 2023 | 56.2 million (21%) | Truecaller, 2024 report |
Context: while older adults lose the largest sums per incident, Truecaller found younger adults aged 18 to 44 were three times more likely to lose any money at all to a phone scam, at 33%, most recent available (Truecaller, 2024 report on 2023 data). Vishing is not a single-demographic problem.
6. Detection and Defense: Humans Cannot Hear the Difference
Awareness training assumes people can eventually spot the fake, and the audio evidence undercuts that assumption. Only 0.1% of people correctly identified every real and synthetic sample in a controlled study, even after being explicitly told to watch for deepfakes (iProov, 2025). When the fake is a familiar voice on a live call, the odds are worse still. Defenses are lagging: organizations are far more prepared for email phishing than for the phone-based equivalent.
| Metric | Value | Source |
|---|---|---|
| People who identified all real and fake samples | 0.1% | iProov, Deepfake Detection Study 2025 |
| People not confident telling a cloned voice from real | 70% | McAfee, 2023 |
| Victims who lost money after an AI voice-clone message | 77% | McAfee, 2023 |
| US organizations that experienced a TOAD attack | 81% | Proofpoint, State of the Phish |
| Telephone-oriented attacks detected per month | 10 million (peak 13M) | Proofpoint, State of the Phish |
| Phishing simulations correctly reported by users | About 20% | Verizon, DBIR 2025 |
| Audio sample length needed to clone a voice | About 3 seconds | FTC, 2023 |
Outlier note: Proofpoint’s telephone-oriented attack figures of roughly 10 million incidents a month are the most recent published, drawn from its State of the Phish research (Proofpoint, most recent available). The direction of travel is consistent across every detection dataset. For the visual side of synthetic media, see our deepfake statistics 2026.
Summary: Vishing (Voice Phishing) And Phone Scams by the Numbers
| Metric | Value | Source |
|---|---|---|
| Vishing increase, H1 to H2 2024 | 442% | CrowdStrike, 2025 Threat Hunting Report |
| Vishing rank as 2025 initial infection vector | #2, 11% of intrusions | Mandiant, M-Trends 2026 |
| Vishing as cloud-compromise vector | #1, 23% | Mandiant, M-Trends 2026 |
| Total US cybercrime losses, 2025 | $20.877 billion (up 26%) | FBI, IC3 2025 Report |
| Tech-support scam losses, 2025 | $2.134 billion | FBI, IC3 2025 Report |
| Losses reported by adults 60+, 2025 | $7.748 billion (up 59%) | FBI, IC3 2025 Report |
| Victims who lost money after an AI voice-clone message | 77% | McAfee, 2023 |
| Vishing rise on mobile devices, 2025 | 28% | Zimperium, 2025 |
| Imposter-scam losses reported to FTC, 2025 | $3.5 billion | FTC, 2025 |
| Median loss when fraud starts by phone, 2024 | $2,210 | FTC, Consumer Sentinel Data Book 2024 |
| Deepfake fraud attempt increase, 2024 | Over 1,300% | Pindrop, 2025 |
| Projected contact-center fraud exposure, 2025 | $44.5 billion | Pindrop, 2025 |
| Businesses hit by audio and video deepfakes, 2024 | 49% | Regula, 2024 |
| Projected US generative-AI fraud losses by 2027 | Up to $40 billion | Deloitte, 2024 |
| Suspected spam calls flagged, Q2 2025 | 13.7 billion | Hiya, 2025 |
| Total lost to scams worldwide, 12 months | $1.03 trillion | GASA and Feedzai, 2024 |
| US losses to phone scams, 2023 | $25.4 billion | Truecaller, 2024 report |
| Organizations sharing data in vishing tests | 70% ($14M average annual cost) | Keepnet, 2024 |
| People identifying all real and fake samples | 0.1% | iProov, 2025 |
| Audio needed to clone a voice | About 3 seconds | FTC, 2023 |
Methodology and Sources
Data was gathered from primary reports, government datasets, and named vendor research published mainly in 2025 and 2026; every market-size or growth figure was traced to its originating organization, cross-referenced where two sources overlapped, and flagged as most recent available when the strongest dataset predated 2025. Figures are reported as published, without rounding for effect.
- Federal Bureau of Investigation, Internet Crime Complaint Center (IC3) 2025 Annual Report (2026)
- Federal Trade Commission, Consumer Sentinel Network Data Book 2024 (2025) and 2025 imposter-scam data (2026)
- CrowdStrike, 2025 Global Threat Report and 2025 Threat Hunting Report
- Mandiant (Google Cloud), M-Trends 2026
- Verizon Business, 2025 Data Breach Investigations Report (DBIR)
- Pindrop, 2025 Voice Intelligence and Security Report
- Deloitte Center for Financial Services, Deepfake banking fraud risk analysis (2024)
- Regula, Deepfake Fraud Doubles Down survey (2024)
- McAfee, Artificial Imposters AI voice-cloning study (2023)
- Hiya, Global Call Threat Report 2025
- Truecaller, US Spam and Scam Report (2024, covering 2023 data)
- Global Anti-Scam Alliance and Feedzai, Global State of Scams Report 2024
- Zimperium, 2025 Global Mobile Threat Report
- Keepnet Labs, 2024 Vishing Response Report
- iProov, Deepfake Detection Study 2025
- Proofpoint, State of the Phish
- Federal Trade Commission, consumer alert on AI voice cloning (2023)
Data watch: Mandiant’s M-Trends report and Verizon’s DBIR are both published annually, usually in the spring, so their next editions will carry updated vishing and pretexting figures that this page will fold in once released. Pindrop’s Voice Intelligence and Security Report, CrowdStrike’s threat reports, and the GASA/Feedzai Global State of Scams report also run on yearly cycles, with next editions expected roughly a year after the ones cited above.
Last updated: July 5, 2026. We review and update this page quarterly as new data is published.