Phishing reports fell while losses rose elevenfold

Why this case matters

Phishing has always been the highest-volume, lowest-value scam in every dataset. That is changing, and the direction is unwelcome.

US complaints fell by more than a third in two years. Reported losses rose roughly elevenfold. Average loss per complaint went from about $63 — essentially nothing — to about $1,127.

Australia shows the same shape compressed into a single year: reports down a third, combined losses up 15.5%.

What is probably driving it

Two things, pulling in opposite directions on the two measures.

Volume is being filtered out. Email providers, mobile networks and browsers have got considerably better at blocking the mass version. Fewer generic phishing messages reach anyone, so fewer are reported. Australia’s Scamwatch data supports this: only 2.3% of the people who reported a phishing scam had lost any money at all.

The messages that get through are better. Targeted phishing — a real invoice conversation, a convincing bank alert, an OAuth consent request that steals no password at all — survives the filters and produces much larger losses when it lands.

The reporting caveat

Some of the complaint decline is likely people no longer bothering to report messages they recognised and deleted. That would deflate the count without changing anything real.

It would not, however, inflate the dollars. An elevenfold rise in reported losses is not a reporting artefact.

What it tells you about the scheme

The old mental model — phishing as a tide of obvious spam — describes a crime that is being handled reasonably well by infrastructure. What is left is the version aimed at a specific person, using a real context, and it is worth an order of magnitude more per attempt.

That is why the advice on the phishing page is built around verifying through a channel you chose, rather than around spotting a badly written message. The badly written ones are mostly being caught already.