People receive up to 20 phishing emails a month, research shows, with many involving sophisticated mimics of government departments, banks and major companies.
The consumer watchdog asked 25 members to log all the scam calls, letters and emails they received in the course of a month, reaching a total of 477 with 95 per cent coming via email.
The companies most commonly mimicked were Amazon, BT, Apple iTunes, Paypal and TalkTalk, with emails often claiming a user's account had been frozen, they had ordered something they had not, or there was a security alert on their account.
The banks most commonly spoofed were Barclays, Lloyds and Santander, with scams frequently saying there has been unusual activity on a bank account or card and asking victims to verify their details.
The research also uncovered two versions of scams claiming to be from HMRC, one saying the recipient was due a tax rebate and another posing as Government Gateway - a website used to access government services, such as for tax self-assessments.
A Which? spokesman said: "Although our scam hunters were selected from a group of Which? members who said they already received some scam communications, we didn't expect them to be bombarded by an average of nearly 20 each in just four weeks."
All of the scams either asked the victim to download a document that most likely contained a virus or gave a link to a website asking for personal details, which ends up giving the scammers access to the relevant account or their bank details.
The more sophisticated versions used the relevant company logos and the researchers found that clicking through on links took them to fake websites which cleverly mimicked the genuine sites.