How often is phishing hitting Australian businesses in 2026? Scamwatch data shows phishing has been the most-reported scam type to the National Anti-Scam Centre in recent years, with hundreds of thousands of reports across all scam types annually and reported losses in the hundreds of millions of dollars. This page sets out the statistics that matter for Australian businesses, what they measure, and the benchmarks a training program should track internally.
TL;DR
- Phishing has consistently ranked among the most-reported scam types in Scamwatch data from the National Anti-Scam Centre.
- Reported losses across all scam types run to hundreds of millions of dollars a year, and reported figures understate real losses.
- OAIC notifiable data breach statistics show malicious or criminal attacks are the leading source of breaches reported under the Privacy Act.
- A simulated-phishing benchmark for your own workforce matters more than national statistics: track click rate trend, report rate trend and repeat-failure rate.
- The two national datasets are updated on different cycles; check both before citing.
Phishing and scam reports: the national picture
Scamwatch, run by the National Anti-Scam Centre, publishes monthly statistics from public scam reports. Phishing has ranked at or near the top of reported scam types in recent reporting periods, and total reported losses across all scam categories have run to hundreds of millions of dollars per year. Two cautions apply to every number on that dashboard: reported losses are self-reported and understate actual losses, and the reporting categories were revised with 2025-onwards data, so older comparisons need care.
What the OAIC breach statistics show
The OAIC's Notifiable Data Breaches statistics, published twice yearly, show malicious or criminal attacks as the leading source of data breaches reported under the Privacy Act, with the bulk of those attacks being phishing, compromised credentials and similar human-targeted vectors. Health, finance and Australian government entities typically file the most notifications. For a business, the takeaway is structural: the attackers who breach Australian organisations get in through people far more often than through zero-day exploits.
The benchmarks your own program should track
National statistics tell you the threat is real; they do not tell you whether your workforce is improving. Three internal benchmarks do:
| Benchmark | What it measures | Healthy direction in 2026 |
|---|---|---|
| Click rate | % of staff who click a simulated phish | Trending down month over month; watch trend, not absolute number |
| Report rate | % of staff who report a simulated phish | Trending up; the single best predictor of real-incident response |
| Repeat-failure rate | % of learners clicking twice within a quarter | Falling; under 10% is a strong result for a mature program |
| Completion rate | % of assigned courses completed on time | Above 90%; below 70% signals delivery problems, not behaviour problems |
Click rate is the least useful of the four on its own, because template difficulty varies campaign to campaign. A 30% click rate on a sophisticated lookalike-domain template is a better result than a 5% click rate on a template staff have seen twelve times. Trend beats level, every month.
How to read these statistics honestly
- Reported losses understate real losses. Most fraud goes unreported; the ACCC states this directly in its Targeting Scams reports.
- Categories change. Scamwatch revised its scam-type categories for 2025-onwards data, so a chart that blends pre-2025 and post-2025 categories needs a footnote.
- Simulated results are not national results. A 12% internal click rate on an easy template says nothing about how your staff handle a targeted BEC email.
- Attribution is hard. OAIC categories group phishing with compromised credentials; both are human-targeted, which is the point that matters for training budgets.
FAQ
How common is phishing in Australia in 2026? Phishing has consistently ranked at or near the top of scam types reported to Scamwatch, the National Anti-Scam Centre's public reporting service, with total scam losses across all categories running to hundreds of millions of dollars a year.
Where do the national phishing statistics come from? Two main sources: Scamwatch (public scam reports to the National Anti-Scam Centre, updated monthly) and the OAIC's Notifiable Data Breaches statistics (breaches reported under the Privacy Act, published twice yearly).
What click rate should a phishing simulation aim for? There is no universal target; template difficulty varies too much. Track the trend: click rate falling and report rate rising month over month is what a working program looks like.
What is a good phishing report rate? A rising one. Report rate is the best single predictor of how a real incident will go, because reporting gives your team minutes instead of days.
Do reported scam losses reflect actual losses? No — reported losses are self-reported and understate actual losses. Treat them as a floor, not a ceiling.
Which Australian organisations report the most data breaches? The OAIC's statistics consistently show health service providers, the finance sector and Australian government entities among the top notifiers, with malicious or criminal attacks the leading source.
One last thing
The most useful phishing statistic for your business is one no dashboard publishes: your own report rate trend. National numbers justify the budget; the internal trend tells you whether the budget is working. Pull yours monthly — here is how to read human risk reporting if you do not have a number yet.