Phishing and deepfakes: the 2025 numbers and how to spot them
Brazil saw 553 million phishing attempts blocked in a year, and deepfake fraud losses reached $2.5 billion in 2025. See the data and the warning signs.
Phishing, the fake message that tries to steal passwords, data or money, remains the entry point for most digital scams. In 2025 it gained a boost from AI, which made convincing text and fake voices and videos (deepfakes) cheaper to produce.
Phishing worldwide
The Anti-Phishing Working Group (APWG) counted about 3.8 million attacks in 2025, versus 3.76 million in 2024 (APWG), peaking at 1,130,393 in Q2 2025.
| Quarter | Phishing attacks |
|---|---|
| Q4 2024 | 989,123 |
| Q1 2025 | 1,003,924 |
| Q2 2025 | 1,130,393 |
| Q3 2025 | 892,494 |
| Q4 2025 | 853,244 |
In Q4 2025, social media and SaaS/webmail were the most targeted sectors (20.3% each), and the average BEC wire request was $50,297 (APWG Q4 2025). Phishing/spoofing generated the most complaints to the FBI in 2025, 191,561 (IC3), and was the most reported scam in Australia (ACCC).
Brazil leads Latin America
Kaspersky blocked 553 million phishing attempts in Brazil from July 2024 to July 2025, about 1.5 million a day and 42.8% of the regional total of 1.29 billion (+85%) (InfoMoney). Malicious email was the root cause of 37% of ransomware cases in Brazil, the highest of any country in the Sophos study.
Deepfakes: from $335 million to $2.5 billion
Deepfake-enabled fraud losses rose from $83 million (2020–23 combined) to $335 million in 2024 and $2.5 billion in 2025, plus $764 million in H1 2026, according to Surfshark Research. Social media was the top channel ($1.73 billion, 47%). The FBI logged 22,364 AI-related complaints with $893.3 million in losses in 2025. Check Point found 1 in 27 generative AI prompts posed a high data-leak risk (IT Edge News).
How to spot them
- Urgency and threats (blocked account, fine, held parcel) are red flags.
- Check the real sender domain; type official addresses instead of clicking.
- No legitimate company asks for passwords or codes by message.
- Confirm video or voice money requests through another channel; agree on a family code word.
- Watch for lip-sync errors, odd blinking and blurred edges in videos.
- Businesses: require dual approval for payment changes, run phishing simulations and adopt phishing-resistant MFA such as passkeys.
来源
- APWG: Phishing Activity Trends Report Q4 2025
- APWG: Phishing Activity Trends Report Q1 2025
- Newswire: APWG Year in Review
- InfoMoney / Kaspersky: Panorama de Ameaças 2025
- Surfshark Research: deepfake fraud statistics
- FBI IC3, 2025 Internet Crime Report (cópia do PDF)
- Sophos: State of Ransomware in Brazil 2026
- ACCC: annual scam losses exceed $2 billion
- Diario de Pernambuco / Febraban: golpes mais relatados no 1º semestre de 2025
- IT Edge News / Check Point: dezembro de 2025