Password and Cybercrime Statistics 2026
This page collects current figures on how people protect their accounts and what it costs when they fail: password reuse and password manager use, passkey and multifactor adoption, breach patterns and breach costs, phishing volumes, and the money lost to fraud, scams and identity theft. Most figures cover the United States in 2025 and 2026, with UK government surveys and multi-country studies where they add context. Sources are government agencies (FBI IC3, FTC, Bureau of Justice Statistics, UK Department for Science, Innovation and Technology, Office for National Statistics), the Pew Research Center, industry research groups (Verizon, IBM, Javelin Strategy & Research, APWG, FIDO Alliance) and the security companies that ran the surveys or analyzed the data (Microsoft, Cisco, Bitwarden, NordPass, Security.org).
By the HearSmart research desk · Updated November 13, 2026 · 54 numbers drawn from 18 publishers and reports
58 of 58 quotes matched to the publisher's page by our checker on November 13, 2026
Short answer
Americans reported $20.9 billion in cybercrime losses to the FBI in 2025, up 26% in a year, and $15.9 billion in fraud losses to the FTC, while 73% of US adults say they have experienced an online scam or attack (Pew Research Center). Credential abuse appears somewhere in 39% of breaches (Verizon 2026 DBIR) and Microsoft says over 97% of identity attacks are mass password guessing. Password habits are slow to change: 36% of US adults use a password manager (Security.org) and 72% of Gen Z reuse passwords (Bitwarden), but 75% of people now have a passkey on at least one account (FIDO Alliance, 2026).
Headline numbers
- $20.877 billionAmericans reported $20.877 billion in losses to the FBI's Internet Crime Complaint Center in 2025, a 26% increase on 2024.Federal Bureau of Investigation (FBI)
- $15.9 billionConsumers reported $15.9 billion in fraud losses to the FTC in 2025, up from over $12 billion in 2024.Federal Trade Commission (FTC)
- 39%Counting every stage of an attack, credential abuse appeared in 39% of breaches in Verizon's 2026 report, more than any other action.Verizon
- 97%More than 97% of identity attacks seen by Microsoft between July 2024 and June 2025 were mass password-guessing attempts.Microsoft
- 36%36% of US adults used a password manager in 2024, about 94 million people, up from 34% a year earlier.Security.org
- 72%72% of Gen Z respondents reuse passwords, compared with 42% of Boomers, in Bitwarden's 2025 survey of employed adults in six countries.Bitwarden
- 75%75% of consumers surveyed in 2026 had enabled a passkey on at least one account.FIDO Alliance
- 73%73% of US adults say they have experienced at least one kind of online scam or attack, such as credit card fraud, ransomware or a shopping scam (2025 survey).Pew Research Center
Reading the numbers
Reported cybercrime keeps setting records. The FBI's Internet Crime Complaint Center logged 1,008,597 complaints and $20.877 billion in losses in 2025, a 26% rise on 2024 and roughly five times the 2020 total. The FTC's Consumer Sentinel Network received 3 million fraud reports with $15.9 billion in losses over the same year. Both agencies stress these are reported losses only: the FTC estimates the true cost of fraud in 2024 could reach $195.9 billion once underreporting is counted.
Passwords sit at the center of much of this. Verizon's 2026 Data Breach Investigations Report finds credential abuse at some point in 39% of breaches, even though vulnerability exploitation (31%) has now overtaken stolen credentials (13%) as the most common way in. Microsoft says more than 97% of identity attacks are mass password-guessing attempts, and that phishing-resistant multifactor authentication can stop up to 99% of them. Verizon also links stolen credentials to ransomware: half of ransomware victims with a prior credential or infostealer event had it within 95 days of the attack.
Personal habits lag behind the threat. Security.org's survey puts password manager use at 36% of US adults, and Bitwarden finds 72% of Gen Z and 42% of Boomers reuse passwords, with 59% of Gen Z recycling an old password after a company discloses a breach. NordPass found "123456" more than 21.6 million times in leaked credential data. Passkeys are the clearest change: the FIDO Alliance estimates 5 billion are in use and says 75% of people have enabled one on at least one account.
Phishing and scams are where most people meet cybercrime. Pew Research Center finds 73% of US adults have experienced an online scam or attack and 21% have lost money to one. APWG counted 1,069,681 phishing attacks in the second quarter of 2026, with SMS phishing up 40% in a quarter, and Verizon reports that phone and text phishing tests get clicked about 40% more often than email tests. The FBI's largest loss category is cryptocurrency investment fraud at $7.2 billion, and Javelin puts identity fraud losses at $27.3 billion, with account takeover still the costliest type.
Cybercrime losses reported to the FBI
- 1.
Americans reported $20.877 billion in losses to the FBI's Internet Crime Complaint Center in 2025, a 26% increase on 2024.
Federal Bureau of Investigation (FBI), 2025 IC3 Annual Report (Apr 2026)
Exact wording at the source
2025 complaint highlights: 1,008,597 complaints; $20.877 billion in losses; 26% increase in losses from 2024; $20,699 Average Loss.
- 2.
The IC3 received 1,008,597 cybercrime complaints in 2025, its first year above one million.
Federal Bureau of Investigation (FBI), 2025 IC3 Annual Report (Apr 2026)
Exact wording at the source
2025 complaint highlights: 1,008,597 complaints; $20.877 billion in losses; 26% increase in losses from 2024; $20,699 Average Loss.
- 3.
The average loss per IC3 complaint in 2025 was $20,699.
Federal Bureau of Investigation (FBI), 2025 IC3 Annual Report (Apr 2026)
Exact wording at the source
2025 complaint highlights: 1,008,597 complaints; $20.877 billion in losses; 26% increase in losses from 2024; $20,699 Average Loss.
- 4.
Cryptocurrency investment fraud was the costliest crime reported to the FBI in 2025, with $7.2 billion in losses.
Federal Bureau of Investigation (FBI), 2025 IC3 Annual Report (Apr 2026)
Exact wording at the source
Cryptocurrency investment fraud was the highest source of financial losses to Americans in 2025 with $7.2 billion reported in losses.
- 5.
Phishing and spoofing was the most reported crime type to the IC3 in 2025, with 191,561 complaints.
Federal Bureau of Investigation (FBI), 2025 IC3 Annual Report (Apr 2026)
Exact wording at the source
Phishing/Spoofing 191,561 Credit Card/Check Fraud 18,774
- 6.
People aged 60 and older filed 201,266 IC3 complaints in 2025, 37% more than in 2024.
Federal Bureau of Investigation (FBI), 2025 IC3 Annual Report (Apr 2026)
Exact wording at the source
Describes Elder Fraud highlights: 201,266 complaints (37% increase from 2024)
Chart
Cybercrime losses reported to the FBI, $ billion, 2020 to 2025
Losses reported to the FBI Internet Crime Complaint Center by individuals and businesses, in billions of US dollars.
- 2020$4.2
- 2021$6.9
- 2022$10.3
- 2023$12.5
- 2024$16.6
- 2025$20.9
Source: Federal Bureau of Investigation (FBI), 2025 IC3 Annual Report
Consumer fraud losses reported to the FTC
- 7.
US consumers filed 3 million fraud reports with the FTC's Consumer Sentinel Network in 2025.
Federal Trade Commission (FTC), Prepared Statement of the FTC on The Rising Scam Economy, Joint Economic Committee (Mar 2026)
Exact wording at the source
In 2025, consumers submitted 3 million fraud reports to CSN and reported $15.9 billion in losses.
- 8.
Consumers reported $15.9 billion in fraud losses to the FTC in 2025, up from over $12 billion in 2024.
Federal Trade Commission (FTC), Prepared Statement of the FTC on The Rising Scam Economy, Joint Economic Committee (Mar 2026)
Exact wording at the source
In 2025, consumers submitted 3 million fraud reports to CSN and reported $15.9 billion in losses.
- 9.
Allowing for underreporting, the FTC estimates fraud cost US consumers as much as $195.9 billion in 2024.
Federal Trade Commission (FTC), Prepared Statement of the FTC on The Rising Scam Economy, Joint Economic Committee (Mar 2026)
Exact wording at the source
When taking underreporting into account, the FTC has estimated that the overall cost of fraud to consumers for 2024 could be as high as $195.9 billion.
- 10.
Consumers reported over $2 billion in losses to frauds that started on social media in fiscal year 2025, the highest of any contact method.
Federal Trade Commission (FTC), Prepared Statement of the FTC on The Rising Scam Economy, Joint Economic Committee (Mar 2026)
Exact wording at the source
In FY 2025, consumers reported aggregate losses of over $2 billion when social media was identified as the contact method.
- 11.
Impostor scams cost US consumers $3.5 billion in reported losses in 2025 and made up nearly one in three fraud reports.
Federal Trade Commission (FTC), FTC Data Show People Reported Losing $3.5 Billion to Imposter Scams in 2025 (Jun 2026)
Exact wording at the source
New data from the Federal Trade Commission reveal that people reported losing a staggering $3.5 billion to imposter scams in 2025, with reported losses increasing nearly three times since 2020.
- 12.
Government impersonators took about $920 million from US consumers in 2025, up from $789 million in 2024.
Federal Trade Commission (FTC), FTC Data Show People Reported Losing $3.5 Billion to Imposter Scams in 2025 (Jun 2026)
Exact wording at the source
Last year, people reported losing nearly $1 billion to business impersonators with the highest reported losses to bank impersonators—and about $920 million to government impersonators, up from $866 million and $789 million respectively in 2024.
Identity theft and account takeover
- 13.
Identity fraud and scams together cost US consumers $38 billion in 2025, down $9 billion from 2024, according to Javelin's Identity Fraud Study.
Javelin Strategy & Research, Fraud Losses Stabilize, But AI-Driven Threats Are Eroding Trust (Apr 2026)
Exact wording at the source
The combined impact of identity fraud and scams totaled $38 billion in 2025, down $9 billion from 2024.
- 14.
Identity fraud alone, excluding scams, caused $27.3 billion in US losses across 18 million victims in 2025.
Javelin Strategy & Research, Fraud Losses Stabilize, But AI-Driven Threats Are Eroding Trust (Apr 2026)
Exact wording at the source
Identity fraud resulted in $27.3 billion in losses affecting 18 million victims, while scams accounted for $10.7 billion in losses affecting 18 million victims.
- 15.
Account takeover remained the costliest type of identity fraud in the US in 2025, with losses above $15 billion.
Javelin Strategy & Research, Fraud Losses Stabilize, But AI-Driven Threats Are Eroding Trust (Apr 2026)
Exact wording at the source
Account takeover losses decreased by 4% in 2025 but remained the costliest fraud type, exceeding $15 billion.
- 16.
Account takeover affected 6 million US consumers in 2025, an 18% increase on 2024.
Javelin Strategy & Research, Fraud Losses Stabilize, But AI-Driven Threats Are Eroding Trust (Apr 2026)
Exact wording at the source
Despite lower losses, account takeover affected 6 million consumers, an 18% increase from 2024.
- 17.
About 23.9 million US residents aged 16 and older, 9% of that population, experienced identity theft in the 12 months before the 2021 federal survey, the latest available.
Bureau of Justice Statistics (BJS), Victims of Identity Theft, 2021 (press release) (Oct 2023)
Exact wording at the source
In 2021, about 23.9 million U.S. residents age 16 or older (9% of the population) had experienced identity theft in the past 12 months
- 18.
Identity theft victims in the 2021 BJS survey lost $880 on average in direct financial losses.
Bureau of Justice Statistics (BJS), Victims of Identity Theft, 2021 (press release) (Oct 2023)
Exact wording at the source
On average, victims sustained direct financial losses of $880.
- 19.
The FBI received 31,675 identity theft complaints in 2025.
Federal Bureau of Investigation (FBI), 2025 IC3 Annual Report (Apr 2026)
Exact wording at the source
Identity Theft 31,675 IPR/Copyright and Counterfeit 2,386
- 20.
The Crime Survey for England and Wales estimated 4.5 million fraud incidents in the year ending June 2026, an 11% rise on the year before.
Office for National Statistics (ONS), Crime in England and Wales: year ending June 2026 (Oct 2026)
Exact wording at the source
4.5 million fraud incidents, an 11% increase compared with last year's survey (4.1 million incidents); this was because of a 13% increase in bank and credit account fraud (to 2.8 million incidents)
Phishing and online scams
- 21.
73% of US adults say they have experienced at least one kind of online scam or attack, such as credit card fraud, ransomware or a shopping scam (2025 survey).
Pew Research Center, Online Scams and Attacks in America Today (Jul 2025)
Exact wording at the source
We find that 73% of U.S. adults have ever experienced things like credit card fraud, ransomware or online shopping scams.
- 22.
21% of US adults say they have lost money because of an online scam or attack.
Pew Research Center, Online Scams and Attacks in America Today (Jul 2025)
Exact wording at the source
In our survey, roughly one-in-five U.S. adults (21%) say they have ever lost money because of an online scam or attack.
- 23.
24% of US adults say a scam email, text or call led them to give away personal information.
Pew Research Center, Online Scams and Attacks in America Today (Jul 2025)
Exact wording at the source
24% say they got a scam email, text message or call that led them to give away personal information.
- 24.
APWG counted 1,069,681 phishing attacks worldwide in the second quarter of 2026, up 10.1% from the first quarter.
Anti-Phishing Working Group (APWG), Phishing Activity Trends Report, 2nd Quarter 2026 (Aug 2026)
Exact wording at the source
Phishing attacks rose 10.1 percent, from 971,181 in Q1 to 1,069,681 in Q2.
- 25.
SMS phishing (smishing) rose 40% from the first to the second quarter of 2026.
Anti-Phishing Working Group (APWG), Phishing Activity Trends Report, 2nd Quarter 2026 (Aug 2026)
Exact wording at the source
Telephone-based fraud continued to rise, with “smishing” (phishing via SMS and text messages) increasing by 40% from Q1 to Q2 2026.
- 26.
Software-as-a-service and webmail logins were the most targeted category in the second quarter of 2026, at 29.1% of phishing attacks.
Anti-Phishing Working Group (APWG), Phishing Activity Trends Report, 2nd Quarter 2026 (Aug 2026)
Exact wording at the source
the SaaS / Webmail category was the most-attacked, rising from 20 percent of all phishing attacks in Q1 2026 to 29.1 percent of all attacks in Q2.
- 27.
In company phishing tests, the median click rate for email lures was 1.4%, compared with about 2% for phone and text lures.
Verizon, 2026 Data Breach Investigations Report (May 2026)
Exact wording at the source
While the median click rate of email phishing simulation campaigns is 1.4%, we see the median rate of simulations on phone- centric methods is closer to 2%
Chart
US adults who get scam contacts at least daily, by channel, %, 2025
Pew Research Center survey of 9,397 US adults, April 14 to 20, 2025.
- Phone calls31%
- Email28%
- Text messages20%
- Social media11%
Source: Pew Research Center, Online Scams and Attacks in America Today
Data breaches and stolen credentials
- 28.
Exploiting software vulnerabilities was the most common first step in breaches in Verizon's 2026 dataset, at 31%.
Verizon, 2026 Data Breach Investigations Report (May 2026)
Exact wording at the source
It has risen to 31% in this year’s reporting dataset, while credential abuse—the previous leader—is down to 13%.
- 29.
Counting every stage of an attack, credential abuse appeared in 39% of breaches in Verizon's 2026 report, more than any other action.
Verizon, 2026 Data Breach Investigations Report (May 2026)
Exact wording at the source
As Figure 11 demonstrates, if you consider all instances of credential abuse at any point in the breach progression, it still sits on top at 39%.
- 30.
A human element, such as a mistake or falling for a lure, was present in 62% of breaches.
Verizon, 2026 Data Breach Investigations Report (May 2026)
Exact wording at the source
Human element was present in 62% of breaches, a slight increase from the previous year’s 60%.
- 31.
Breaches involving a third party, such as a supplier or software provider, reached 48% of all breaches, up 60% in a year.
Verizon, 2026 Data Breach Investigations Report (May 2026)
Exact wording at the source
breaches with third-party involvement have increased by 60% from last year’s dataset, reaching 48% of total breaches.
- 32.
Among ransomware victims with an earlier credential leak or infostealer infection, 50% had that event within 95 days before the attack.
Verizon, 2026 Data Breach Investigations Report (May 2026)
Exact wording at the source
But of the organizations that did, 50% of those ransomware victims had a credential or infostealer event occur within 95 days prior to falling victim to a ransomware attack.
- 33.
More than 97% of identity attacks seen by Microsoft between July 2024 and June 2025 were mass password-guessing attempts.
Microsoft, Microsoft releases 2025 Digital Defense Report (Jan 2026)
Exact wording at the source
Over 97 percent of identity attacks originate from mass password-guessing attempts.
- 34.
The average cost of a data breach in the US reached a record $10.22 million in IBM's 2025 study, against a global average of $4.44 million.
IBM, IBM Report: 13% Of Organizations Reported Breaches Of AI Models Or Applications (Jul 2025)
Exact wording at the source
The global average cost of a data breach fell to $4.44 million, the first decline in five years, while the average U.S. cost of a breach reached a record $10.22 million.
- 35.
43% of UK businesses reported a cyber security breach or attack in the previous 12 months (2025 survey).
UK Department for Science, Innovation and Technology, Cyber security breaches survey 2025 (Apr 2025)
Exact wording at the source
Just over four in ten businesses (43%) and three in ten charities (30%) reported having experienced any kind of cyber security breach or attack in the last 12 months.
- 36.
Phishing was involved for 85% of the UK businesses that had a breach or attack.
UK Department for Science, Innovation and Technology, Cyber security breaches survey 2025 (Apr 2025)
Exact wording at the source
phishing attacks remain the most prevalent and disruptive type of breach or attack (experienced by 85% of businesses and 86% of charities)
- 37.
Only 4% of organizations worldwide reached Cisco's mature level of cybersecurity readiness in 2025, up from 3% a year earlier.
Cisco, Cisco Study Reveals Alarming Deficiencies in Security Readiness (May 2025)
Exact wording at the source
only 4% of organizations worldwide have achieved the 'Mature' level of readiness required to effectively withstand today’s cybersecurity threats.
Password habits, reuse and password managers
- 38.
36% of US adults used a password manager in 2024, about 94 million people, up from 34% a year earlier.
Security.org, 2024 Password Manager Industry Report and Statistics (2024)
Exact wording at the source
Today, 36 percent of American adults subscribe to such services, representing 94 million users, compared to 34 percent last year.
- 39.
18% of US adults reuse the same password across multiple accounts, according to the same 2024 survey.
Security.org, 2024 Password Manager Industry Report and Statistics (2024)
Exact wording at the source
Even less safe are the 18 percent of Americans reusing the same password across multiple accounts.
- 40.
Google and Apple's built-in password managers together hold over 55% of the US password manager market.
Security.org, 2024 Password Manager Industry Report and Statistics (2024)
Exact wording at the source
Tech giants dominate the market: Google and Apple, through their proprietary services, control over 55 percent of the password manager market.
- 41.
72% of Gen Z respondents reuse passwords, compared with 42% of Boomers, in Bitwarden's 2025 survey of employed adults in six countries.
Bitwarden, World Password Day Global Survey 2025 (Apr 2025)
Exact wording at the source
Password reuse is rampant, with 72% of Gen Z reusing passwords, contrasting with only 42% of Boomers
- 42.
59% of Gen Z respondents recycle an existing password when updating an account at a company that has disclosed a data breach.
Bitwarden, World Password Day Global Survey 2025 (Apr 2025)
Exact wording at the source
79% of Gen Z admit password reuse is risky, yet 59% recycle an existing password when updating accounts with companies that disclose data breaches.
- 43.
46% of Gen Z respondents use a password manager, compared with 39% of Millennials and 33% of Gen X.
Bitwarden, World Password Day Global Survey 2025 (Apr 2025)
Exact wording at the source
Only 33% of Gen X use a password manager, trailing behind 39% of Millennials and 46% of Gen Z.
- 44.
Just 13% of respondents use a password manager to share credentials securely; many share passwords by text, screenshot or out loud.
Bitwarden, World Password Day Global Survey 2025 (Apr 2025)
Exact wording at the source
Just 13% of respondents report using a password manager to share credentials securely
- 45.
"123456" was the most common password in leaked data analyzed from September 2024 to September 2025, appearing 21,627,656 times.
NordPass, Top 200 Most Common Passwords (Nov 2025)
Exact wording at the source
1 123456 21,627,656 2 admin 21,030,012
- 46.
29% of US adults say a personal online account, such as social media, email or banking, has been hacked.
Pew Research Center, Online Scams and Attacks in America Today (Jul 2025)
Exact wording at the source
29% say a personal online account was hacked, such as a social media, email or bank account.
- 47.
33% of people in a ten-country 2026 survey had an account compromised or got a breach notification in the past year.
FIDO Alliance, Five Billion Passkeys: FIDO Alliance Reports Mainstream Global Usage on World Passkey Day 2026 (May 2026)
Exact wording at the source
One in three people (33%) experienced an account compromise or received a breach notification in the past year.
Chart
Password manager use by generation, %, 2025
Bitwarden online survey of 2,391 employed adults in the US, UK, Australia, Germany, France and Japan, March 2025.
- Gen Z46%
- Millennials39%
- Gen X33%
Source: Bitwarden, World Password Day Global Survey 2025
Passkeys and multifactor authentication
- 48.
The FIDO Alliance estimates that 5 billion passkeys were in use worldwide in 2026.
FIDO Alliance, Five Billion Passkeys: FIDO Alliance Reports Mainstream Global Usage on World Passkey Day 2026 (May 2026)
Exact wording at the source
the FIDO Alliance estimates that 5 billion passkeys are now in use worldwide.
- 49.
90% of consumers surveyed in ten countries in 2026 were aware of passkeys.
FIDO Alliance, Five Billion Passkeys: FIDO Alliance Reports Mainstream Global Usage on World Passkey Day 2026 (May 2026)
Exact wording at the source
90% of people are now aware of passkeys, up significantly year-over-year
- 50.
75% of consumers surveyed in 2026 had enabled a passkey on at least one account.
FIDO Alliance, Five Billion Passkeys: FIDO Alliance Reports Mainstream Global Usage on World Passkey Day 2026 (May 2026)
Exact wording at the source
75% of people have enabled a passkey on at least one account
- 51.
49% of consumers surveyed in 2026 use passkeys regularly when a site offers them.
FIDO Alliance, Five Billion Passkeys: FIDO Alliance Reports Mainstream Global Usage on World Passkey Day 2026 (May 2026)
Exact wording at the source
49% of people use passkeys regularly when available
- 52.
47% of consumers say they are likely to abandon a purchase or sign-in when they cannot remember their password.
FIDO Alliance, Five Billion Passkeys: FIDO Alliance Reports Mainstream Global Usage on World Passkey Day 2026 (May 2026)
Exact wording at the source
47% of consumers say they are likely to abandon a purchase or sign-in when they cannot remember their password, with 17% saying they are highly likely to do so.
- 53.
48% of the world's top 100 websites supported passkeys in 2025, according to FIDO Alliance research.
FIDO Alliance, World Password Day 2025: Consumer Password and Passkey Trends (Apr 2025)
Exact wording at the source
Recent findings from the FIDO Alliance show that 48% of the world’s top 100 websites have already integrated passkey support.
- 54.
Phishing-resistant multifactor authentication prevents up to 99% of mass password attacks, according to Microsoft.
Microsoft, Microsoft releases 2025 Digital Defense Report (Jan 2026)
Exact wording at the source
Implementing phishing-resistant multifactor authentication (MFA) has proven to prevent up to 99 percent of these attacks.
Chart
Passkey awareness and use, % of people and organizations, 2026
FIDO Alliance research covering 11,000 consumers and 1,400 enterprise decision-makers in ten countries, 2026.
- Aware of passkeys90%
- Enabled a passkey on at least one account75%
- Use passkeys regularly when available49%
- Organizations deploying passkeys for staff68%
Source: FIDO Alliance, Five Billion Passkeys: FIDO Alliance Reports Mainstream Global Usage on World Passkey Day 2026
Questions readers ask
- How much money is lost to cybercrime each year?
- Americans reported $20.877 billion in cybercrime losses to the FBI's Internet Crime Complaint Center in 2025, up 26% from 2024. The FTC separately recorded $15.9 billion in consumer fraud losses, and estimates the true 2024 cost of fraud, including unreported cases, could be as high as $195.9 billion.
- How many people reuse passwords?
- It depends on how the question is asked. Bitwarden's 2025 survey found 72% of Gen Z and 42% of Boomers reuse passwords, while Security.org's 2024 US survey found 18% use the same password across multiple accounts. NordPass found "123456" more than 21 million times in leaked credential data.
- What percentage of people use a password manager?
- Security.org's 2024 survey found 36% of US adults, about 94 million people, use a password manager, with Google and Apple's built-in tools holding over 55% of the market. Bitwarden's 2025 survey of employed adults puts use at 46% of Gen Z, 39% of Millennials and 33% of Gen X.
- How many data breaches involve stolen passwords?
- Verizon's 2026 Data Breach Investigations Report finds credential abuse at some stage of 39% of breaches, though as the first step it has fallen to 13%, behind vulnerability exploitation at 31%. Microsoft says more than 97% of identity attacks are mass password-guessing attempts.
- Are passkeys replacing passwords?
- Adoption is growing quickly but passwords are still common. The FIDO Alliance estimates 5 billion passkeys are in use, and its 2026 survey found 75% of people have enabled one on at least one account, but only 49% use them regularly when available.
- How common is identity theft?
- Javelin Strategy & Research counted 18 million US identity fraud victims and $27.3 billion in losses in 2025, with account takeover affecting 6 million people. The latest federal survey, from the Bureau of Justice Statistics, found 23.9 million US residents aged 16 and older, 9%, experienced identity theft in 2021.
Where these numbers come from
We used primary sources only: US agencies (FBI Internet Crime Complaint Center, Federal Trade Commission, Bureau of Justice Statistics), UK government statistics (Department for Science, Innovation and Technology, Office for National Statistics), the Pew Research Center, and the organizations that ran each study or analyzed the underlying data (Verizon, IBM with the Ponemon Institute, Javelin Strategy & Research, APWG, FIDO Alliance, Microsoft, Cisco, Bitwarden, NordPass and Security.org). Figures are not directly comparable. FBI and FTC totals are losses that victims chose to report and overlap partly; Javelin and BJS estimates come from consumer surveys and run higher. Verizon's breach shares describe its dataset of confirmed breaches, not the chance that any one organization is breached. Password and passkey surveys use different samples: Security.org surveyed US adults in 2024, Bitwarden surveyed employed adults in six countries, and the FIDO Alliance surveyed consumers in ten countries. Several publishers sell security or password products, which we note so readers can weigh their findings. The BJS identity theft figures describe 2021, the latest year available. Every quote was checked against the source page on the date shown. We store the sentence each number appears in, and a script loads the publisher's page again to make sure that sentence is still there. Our methodology has the details.
Sources
- Anti-Phishing Working Group (APWG). Phishing Activity Trends Report, 2nd Quarter 2026 (Aug 2026).
- Bitwarden. World Password Day Global Survey 2025 (Apr 2025).
- Bureau of Justice Statistics (BJS). Victims of Identity Theft, 2021 (press release) (Oct 2023).
- Cisco. Cisco Study Reveals Alarming Deficiencies in Security Readiness (May 2025).
- Federal Bureau of Investigation (FBI). 2025 IC3 Annual Report (Apr 2026).
- Federal Trade Commission (FTC). Prepared Statement of the FTC on The Rising Scam Economy, Joint Economic Committee (Mar 2026).
- Federal Trade Commission (FTC). FTC Data Show People Reported Losing $3.5 Billion to Imposter Scams in 2025 (Jun 2026).
- FIDO Alliance. Five Billion Passkeys: FIDO Alliance Reports Mainstream Global Usage on World Passkey Day 2026 (May 2026).
- FIDO Alliance. World Password Day 2025: Consumer Password and Passkey Trends (Apr 2025).
- IBM. IBM Report: 13% Of Organizations Reported Breaches Of AI Models Or Applications (Jul 2025).
- Javelin Strategy & Research. Fraud Losses Stabilize, But AI-Driven Threats Are Eroding Trust (Apr 2026).
- Microsoft. Microsoft releases 2025 Digital Defense Report (Jan 2026).
- NordPass. Top 200 Most Common Passwords (Nov 2025).
- Office for National Statistics (ONS). Crime in England and Wales: year ending June 2026 (Oct 2026).
- Pew Research Center. Online Scams and Attacks in America Today (Jul 2025).
- Security.org. 2024 Password Manager Industry Report and Statistics (2024).
- UK Department for Science, Innovation and Technology. Cyber security breaches survey 2025 (Apr 2025).
- Verizon. 2026 Data Breach Investigations Report (May 2026).
Citing this page
Link to this page or to a single numbered figure. If you reuse a number, name the organization that released it in the first place.
HearSmart. (2026, November 13). Password and Cybercrime Statistics 2026. https://hearsmart.org/password-and-cybercrime-statistics
Found a number that changed or a source that moved? Email editorial@hearsmart.org. We plan to check this page again by January 12, 2027.