Email Spam and Disposable Email Statistics for 2026

This page collects the email spam, phishing, breach and disposable email statistics we kept looking up while writing the rest of this blog. Every figure has a named source, a date and a link, so you can check it and cite it without digging through a vendor PDF.

We run an inbound-only temporary email service, so these numbers describe the world our mail servers work in. We have kept the list short on purpose. Where two reports disagreed, or where we could only find a number on a site that did not name its source, we left it out.

How much email the world sends

The Radicati Group publishes the figures most other reports quote for email users and daily volume. Its latest public edition came out in late 2024, so the 2025 and 2026 numbers below are its projections.

How much of that email is spam

Spam share depends on who is counting. Kaspersky measures it across the mail its products filter, and its definition includes scams, phishing and malware as well as plain unsolicited advertising.

Phishing and email fraud

Two sources track phishing from different angles. APWG counts unique phishing sites and campaigns reported by its members. The FBI's Internet Crime Complaint Center (IC3) counts complaints from victims in the United States, which makes it a floor: most victims never file one.

Data breaches that expose email addresses

Have I Been Pwned (HIBP) is the largest public index of breached accounts. We summed its public breach list ourselves on the date shown. The Verizon and DLA Piper figures come from their 2026 reports.

Disposable email

Nobody publishes reliable usage figures for disposable email across the industry, and we do not publish ours. What can be measured is how hard sites push back. The open-source disposable-email-domains list on GitHub is the blocklist most sign-up forms and validation libraries copy, so its size is a fair proxy.

Spam laws and fines

In the United States, the CAN-SPAM Act sets a maximum penalty for each email that breaks it. In the EU, spam and tracking fall under the GDPR and the ePrivacy rules, and fines are set case by case.

How we picked these numbers

• Primary sources first. Each figure comes from the organisation that measured it. Where we could only read the figure in press coverage of a report, the coverage had to agree across several outlets before we used it.
• The latest edition. We use the most recent report each source has published as of the update date at the top of this page. Projections are labelled as projections.
• Counts we ran ourselves are dated. The Have I Been Pwned and GitHub figures change daily. We record the date we counted them.
• Vendor telemetry measures the vendor's customers. Kaspersky's spam share describes the mail its filters see. That is a large sample but not the whole internet.
• What we left out. Figures with no named source, figures that contradicted the source's own release, and anything about PureTempMail usage. We keep no archive of mailboxes, so we have no usage history to report.

Sources

• The Radicati Group, Email Statistics Report, 2024-2028.
• Kaspersky, Kaspersky reports 15% growth in malicious email attacks in 2025, February 2026.
• APWG, Phishing Activity Trends Report, 2nd Quarter 2026.
• APWG, Phishing Activity Trends Report, 1st Quarter 2026.
• FBI Internet Crime Complaint Center, 2025 Internet Crime Report, April 2026.
• Have I Been Pwned, breach list, counted 30 October 2026.
• Verizon, 2026 Data Breach Investigations Report.
• DLA Piper, GDPR Fines and Data Breach Survey, January 2026.
• GitHub, disposable-email-domains, counted 30 October 2026.
• Federal Trade Commission, CAN-SPAM Act: A Compliance Guide for Business, and Federal Register, Adjustments to Civil Penalty Amounts, January 2025.