Phishing Statistics Canada [2026]: Losses & Trends

In 2024, the Canadian Anti-Fraud Centre 2025 recorded 3,390 phishing reports — a 6.8% year-over-year increase. A further 937 spear-phishing reports generated $67.3 million in losses, ranking spear phishing second among all CAFC fraud categories by dollar impact. This post compiles phishing statistics for Canada using primary sources from CAFC, CCCS, Statistics Canada, and the OPC. For the broader fraud picture, the fraud statistics Canada hub maps losses across all fraud types.

What is phishing

Phishing is a social-engineering attack in which a threat actor impersonates a trusted entity to trick the recipient into revealing credentials, clicking a malicious link, or authorizing a fraudulent payment. Delivery channels include email, text message (smishing), and voice call (vishing). Spear phishing is a targeted variant aimed at a specific individual or organization. Business email compromise (BEC) is a spear-phishing sub-type in which attackers impersonate a known executive or supplier to redirect funds.

The CCCS National Cyber Threat Assessment 2025–2026 identifies phishing as one of Canada’s most-reported fraud types. Spear phishing carries one of the highest financial impacts of any fraud category. Three delivery channels are used in Canada:

• Email phishing — the dominant vector, targeting credentials, payment authorization, or malware delivery
• Smishing (SMS) — text messages impersonating government agencies, banks, or parcel carriers
• Vishing (voice) — phone calls from actors posing as CRA officials, bank fraud departments, or tech support

The CCCS National Cyber Threat Assessment 2025–2026 confirms that cybercriminals now offer Phishing-as-a-Service (PhaaS) kits. These kits hand buyers detailed instructions, email templates, and ready-to-use tools, lowering the skill barrier for attackers. AI accelerates the threat further. The CCCS warns that threat actors are almost certainly using LLMs to improve social-engineering attacks, generating grammatically correct phishing emails at scale that mimic human writing.

Phishing and BEC losses in Canada by year

Statistics Canada’s 2024 analysis of fraud costs documents the steep upward trend in total CAFC-recorded fraud losses. Phishing and spear phishing are consistently among the most-reported fraud types within that series.

Sources: CAFC 2025; 2021–2023 loss figures cited in CCCS NCTA 2025–2026.

The CAFC estimates that only 5–10% of fraud incidents reach law enforcement. The $638 million recorded in 2024 therefore likely represents less than one-tenth of actual national losses.

In 2024, spear phishing ranked second among all CAFC fraud categories by dollar loss, behind only investment fraud ($313 million) and ahead of romance scams ($58.9 million). General phishing generated 3,390 reports and 989 victims but carries no direct CAFC loss figure; financial harm from credential-phishing flows through subsequent fraud types such as account takeover.

The Royal Canadian Mounted Police documents Canadian BEC losses of approximately $30 million in 2020 and more than $26 million in the first half of 2021 alone. BEC losses have since been subsumed into the spear-phishing reporting line in CAFC annual data. The $67.3 million 2024 spear-phishing figure is the current best proxy for BEC-inclusive harm.

The cybercrime-statistics picture extends beyond phishing-specific losses. The broader arc is documented in the cybercrime statistics Canada post, which covers all CAFC fraud types and police-reported cybercrime rates from the Uniform Crime Reporting survey.

How phishing targets Canadian businesses

Statistics Canada’s 2023 CSCSC found that scams and fraud was the most common cyber security incident method, affecting 50% of impacted businesses in 2023. That rate rose six percentage points from 44% in 2021. Identity theft, a common outcome of credential-phishing, affected 31% of impacted businesses — up 11 percentage points from the 2021 figure.

Canadian businesses paid a steep price for those incidents:

• $1.2 billion spent on cyber incident recovery in 2023 — double the $600 million spent in 2021
• $11.0 billion spent on prevention and detection in 2023, up from $9.7 billion in 2021
• Only 13% of impacted businesses reported the incident to police in 2023 (up from 10% in 2021)
• 55% of non-reporting businesses resolved the issue internally
• 35% considered the incident too minor to report

A Statistics Canada 2020 survey provides the individual-level comparison: just over one-third of Canadians (34%) reported receiving phishing attacks since the start of the COVID-19 pandemic. Among those who experienced a cyber incident, 13% reported a financial loss and 13% suffered data loss. Fewer than 5% reported the incident to authorities.

Statistics Canada’s fraud analysis places business phishing exposure in a broader trend: fraud-related cybercrime violations numbered nearly 48,900 in 2023 — almost double the count recorded in 2019. Only 26% of businesses had a written cybersecurity policy in 2023, despite the rising spending figures.

Phishing victimization by sector and business size

Business size and sector both shape phishing exposure, according to Statistics Canada CSCSC data and OPC breach reports.

By business size

Statistics Canada 2023 CSCSC found that large businesses faced cyber-incident rates nearly double the national average:

Sources: Statistics Canada CSCSC 2023; 2021 size breakdown from Statistics Canada CSCSC 2021.

The 2021 CSCSC data showed that four in ten businesses reported zero direct cybersecurity spending that year, indicating a protection gap most acute in small-business segments. Scams and fraud (the phishing-inclusive category) affected 44% of all impacted businesses in 2021; ransomware affected 11%; identity theft affected 20% (up from 14% in 2019).

By sector

The Office of the Privacy Commissioner’s 2023–2024 Annual Report found that 321 cyber incidents accounted for 46% of all reported PIPEDA breaches. Unauthorized access — the breach mode most often initiated by phishing or credential theft — accounted for 75% of private-sector breaches that year. Sector distribution of private-sector PIPEDA breach reports:

Source: OPC Annual Report 2023–2024.

In 2024–2025, the picture sharpened. The OPC’s 2024–2025 Annual Report recorded 686 PIPEDA breach reports affecting approximately 20 million individual Canadian accounts. Unauthorized access rose to 81% of all breach causes. The financial sector remained the single largest reporting sector at 31% of all reports, followed by telecommunications (12%) and services (11%). For organizations weighing sector-specific exposure, the elder fraud statistics post covers how CRA-impersonation smishing and technology-facilitated phishing disproportionately target older Canadians.

Spear phishing and business email compromise (BEC)

Spear phishing is the most financially damaging phishing variant tracked by the Canadian Anti-Fraud Centre. In 2024 it generated $67.3 million in reported losses from just 937 reports and 608 confirmed victims — roughly $110,000 per confirmed victim. It ranked second only to investment fraud among all CAFC fraud categories by dollar loss.

The gap between general phishing and spear phishing is instructive. General phishing produced 3,390 reports in 2024 with no direct loss assigned; spear phishing produced 937 reports with $67.3 million in losses. General phishing casts a wide net hoping for a credential click. Spear phishing is designed from the outset to execute a financial transfer.

Business email compromise is the most damaging BEC sub-type. The RCMP documents three primary BEC schemes targeting Canadian organizations:

• Payroll fraud — redirecting employee direct-deposit instructions to an attacker-controlled account
• Vendor impersonation — fraudulent invoice payment requests mimicking a known supplier
• Financial-sector targeting — impersonating bank or brokerage clients to initiate unauthorized transfers

The RCMP notes that BEC has stolen more than $26 billion globally, including from Canadian businesses. Domestically, the CAFC recorded approximately $30 million in BEC losses in 2020 and more than $26 million in the first half of 2021 alone.

The CCCS NCTA 2025–2026 identifies credential-theft infrastructure as a core component of the phishing-BEC pipeline. The assessment cites the Genesis Market case, where cybercriminals bought account credentials and digital fingerprints to access victims’ online accounts without triggering security warnings. PhaaS kits on criminal marketplaces automate this credential-harvesting step. Actors with minimal technical skill can now launch convincing BEC campaigns.

Smishing, vishing, and voice phishing in Canada

Smishing and vishing have moved from niche tactics to mainstream fraud delivery channels. Both exploit the same psychology as email phishing (urgency, authority, and fear) but on channels where many recipients apply less scepticism than they would to a suspicious email.

• CRA impersonation smishing — the most-reported variant: a text message mimics a Government of Canada alert, offers a fraudulent Interac e-transfer, and redirects the victim to a spoofed financial-institution login page to harvest banking credentials
• Parcel-carrier smishing — messages impersonating Canada Post or courier companies claiming a package is held pending a fee payment
• Bank fraud-alert smishing — messages posing as financial-institution security teams, prompting credential entry on a fake portal
• Vishing callback scams — robocall or live-agent calls posing as CRA, RCMP, or Service Canada, demanding immediate payment or personal information under threat of arrest or account freeze

The CAFC Fraud Prevention Month 2025 report documents smishing as a distinct fraud category in 2024 data, with CRA-impersonation variants among the most-reported types. Impersonation fraud overall was described by federal authorities as one of the fastest-growing fraud categories in Canada.

The CCCS NCTA 2025–2026 adds a state-actor dimension. Iranian state-sponsored actors have combined social engineering with spear phishing to support transnational repression and surveillance. These campaigns use fake personas and spoofed SMS messages to build rapport before harvesting credentials. The same delivery channels used in consumer fraud serve targeted espionage campaigns against Canadian residents.

Credential harvesting and brand impersonation trends

The CCCS NCTA 2025–2026 identifies AI as the primary accelerant of credential-harvesting campaigns. Large language models let attackers craft phishing emails at scale, with convincing, grammatically correct language that mimics human writing. Spelling and grammar errors, once reliable detection signals, no longer distinguish malicious messages from legitimate ones. Combined with PhaaS kits, AI-enhanced phishing reduces both cost and skill barriers.

CRA impersonation is the most commonly reported brand-impersonation phishing tactic in Canada. Fraudsters use spoofed CRA branding — including official Government of Canada logos — in both email and SMS campaigns to harvest SIN numbers, banking credentials, or prompt fraudulent payments. The CAFC 2024 data confirms that impersonation fraud is one of the fastest-growing fraud categories in Canada.

Phishing-initiated unauthorized access is the dominant cause of private-sector data breaches reported to Canada’s Privacy Commissioner. In 2024–2025, unauthorized access accounted for 81% of all 686 PIPEDA breach reports — up from 75% the year before. Approximately 20 million individual Canadian accounts were affected. The OPC 2024–2025 Annual Report does not disaggregate by specific initial-access vector; CCCS NCTA and CAFC data consistently identify phishing as the primary credential-theft mechanism.

The convergence of AI-generated messages, PhaaS infrastructure, and established brand impersonation templates represents a structural shift in the threat environment. Defenders can no longer treat message quality as a reliable signal. A grammatically polished email bearing official CRA branding, arriving via a spoofed government domain, is the new baseline attack format.

What this means for Canadian organizations

Three findings from this data stand out for organizations making security decisions:

• Reported losses capture a small fraction of actual harm. The CAFC’s $638 million 2024 total represents 5–10% of estimated actual fraud, per the CAFC’s own standing disclosure. The RCMP Gazette notes that fraud harm extends beyond money to emotional, reputational, and operational damage that never appears in dollar figures.
• Under-reporting is structural, not incidental. Statistics Canada’s 2023 CSCSC found only 13% of impacted businesses reported cyber incidents to police, most often resolving them internally (55%). CAFC and police-reported data therefore understate the true scale of business losses.
• The protection gap is widest at the small-business level. Four in ten businesses reported zero cybersecurity spending in 2021. By 2023 the overall spending figure had risen sharply, yet only 26% of businesses had a written cybersecurity policy.

The RCMP’s National Cybercrime Coordination Centre directs Canadian individuals and organizations to report phishing and BEC incidents to the CAFC Fraud Reporting System. Each report is disproportionately valuable precisely because reporting rates are so low.

As licensed PIs, we see the downstream consequences of phishing regularly. BEC fraud cases arrive after funds have cleared a wire transfer, when the client is tracing funds or building a civil recovery case. Corporate investigations can document the attack chain, identify responsible parties, and support litigation counsel. For cases involving online identity fraud, social media and internet investigations preserve the digital footprint before evidence disperses. The fraud research hub maps the full landscape of fraud types affecting Canadians and Canadian businesses.