Account takeover figures are spread across police complaint centres, banking trade bodies, fraud databases and breach researchers, and each counts something different. This page gathers the current numbers from the publishers' own reports: the FBI Internet Crime Complaint Center (IC3) 2025 annual report and its November 2025 account takeover alert, the Verizon 2026 Data Breach Investigations Report (DBIR), UK Finance's Annual Fraud Report 2026, Cifas Fraudscape 2026, the US Federal Trade Commission's 2024 Consumer Sentinel figures, Microsoft's Digital Defense Report and the Have I Been Pwned record of the largest credential stuffing corpus loaded to date. Every figure carries its source and data year in the same sentence or table row. It is for fraud, customer identity (CIAM) and security teams who need defensible numbers for a business case, a board paper or a control decision. Prevention methods are covered in the Account Takeover Prevention Guide; this page is the evidence. Last reviewed: November 2026.
Key takeaways
- Reported US losses are in the hundreds of millions: the IC3 2025 report records roughly 4,700 account takeover complaints with about $359.7 million in losses, and a separate IC3 alert counted more than 5,100 complaints and over $262 million for one impersonation scheme between January and November 2025.
- Stolen credentials still drive breaches even as their rank falls: the 2026 DBIR puts credential abuse as the first action in 13% of breaches, down from 22%, but finds use of stolen credentials in 36% of breaches and credential abuse at some point in 39%.
- UK bank account takeover is falling, takeover filings overall are not: UK Finance reports card account takeover losses of £37.8 million in 2025, down 10%, while Cifas recorded 78,387 account takeover cases on the National Fraud Database, up 6%.
- The supply of credentials is enormous: Have I Been Pwned loaded 1,957,476,021 unique email addresses and 1.3 billion unique passwords from one credential stuffing data set in November 2025, 625 million of them passwords it had never seen.
- Mobile channels are where UK cases grow: UK Finance counts 25,180 mobile banking fraud cases in 2025, up 21%, against falling telephone banking cases.
Headline statistics
| Statistic | Figure | Source, publisher and data year |
|---|---|---|
| US account takeover complaints to IC3 | About 4,700 | Internet Crime Report 2025, FBI IC3 (2025 data, approximate) |
| US account takeover losses reported to IC3 | About $359.7 million | Internet Crime Report 2025, FBI IC3 (2025 data, approximate) |
| ATO complaints from financial institution impersonation | More than 5,100; losses over $262 million | IC3 public service announcement I-112525-PSA, 25 November 2025 (January to November 2025) |
| Breaches where credential abuse was the initial action | 13% (22% in the prior edition) | 2026 DBIR, Verizon (incidents 1 November 2024 to 31 October 2025) |
| Breaches involving use of stolen credentials | 36% | 2026 DBIR, Verizon |
| UK card account takeover losses | £37.8 million, down 10%; 82,030 cases | Annual Fraud Report 2026, UK Finance (2025 data) |
| UK account takeover cases on the National Fraud Database | 78,387, up 6%; 18% of all filings | Fraudscape 2026, Cifas (2025 data) |
| Email addresses in the Synthient credential stuffing corpus | 1,957,476,021 unique | Have I Been Pwned, Troy Hunt, 5 November 2025 |
| Identity risk detections analysed per day | 31 million | Microsoft Digital Defense Report (2026 edition) |
| Share of all internet traffic from bad bots | 37% | 2025 Bad Bot Report, Imperva |
Statistics by theme
United States: complaints and losses
IC3 counts complaints filed by victims, so its figures are a floor rather than a market estimate. Account takeover sits in the report's cyber-enabled fraud section, with figures given as approximations, not as a row in the crime type tables. Related crime types show the routes into accounts and where the larger losses sit.
| Crime type (IC3, 2025 data) | Complaints | Losses |
|---|---|---|
| Account takeover (cyber-enabled fraud section) | About 4,700 | About $359.7 million |
| Phishing and spoofing | 191,561 | $215,843,126 |
| Personal data breach | 67,456 | $1,314,923,988 |
| Identity theft | 31,675 | $185,832,657 |
| Tech and customer support impersonation | 47,794 | $2,134,675,818 |
| Government impersonation | 32,424 | $797,943,193 |
| All complaints | 1,008,597 | $20.877 billion |
The November 2025 IC3 alert describes how most of these takeovers happened: criminals posing as bank, customer support or technical support staff obtained login credentials and one-time codes by text, call or email, sent victims to look-alike banking or payroll sites, and bought search adverts imitating real businesses so their phishing pages ranked above the genuine ones. That is account takeover through social engineering, not password guessing, and it reaches accounts protected by SMS or app codes.
The FTC's Consumer Sentinel figures for 2024, the latest full year the FTC published at the time of review, show the wider fraud picture: more than $12.5 billion in reported fraud losses, up 25%, from 2.6 million fraud reporters, with the share who lost money rising from 27% to 38%, plus more than 1.1 million identity theft reports through IdentityTheft.gov. The FTC release does not break out account takeover.
Breaches: how often stolen credentials are involved
The 2026 DBIR shows why counting only the first step understates credential risk. Verizon notes that part of the fall from 22% to 13% comes from adding pretexting as a tracked initial vector; without that change the figure would have been 16%.
| Measure (2026 DBIR) | Figure |
|---|---|
| Credential abuse as initial access vector | 13% (16% on the previous classification; 22% in the 2025 DBIR) |
| Credential abuse at any point in the breach | 39% |
| Use of stolen credentials among breaches with action varieties recorded | 36% (n=19,550) |
| Breaches where credentials were among the data compromised | 28% |
| Basic Web Application Attacks pattern | 3,217 incidents, 2,281 with confirmed disclosure; top action use of stolen credentials; credentials 52% of data compromised |
| Median share of accounts found with breached passwords | 4% of accounts scanned |
| Ransomware victims with a prior credential leak or infostealer event, timing | Half of those with an event had it within 95 days before the attack |
Microsoft's Digital Defense Report adds the post-login view: 52.2% of the valid account intrusions it describes involved follow-on credential theft, meaning one taken-over account was used to harvest more. The Snowflake customer account breaches in 2024 show the pattern at scale: credentials captured by infostealers, many exposed years earlier and never rotated, opened accounts without MFA across about 165 organisations.
United Kingdom: banking and fraud database figures
UK Finance reports confirmed cases and losses from its member banks and card issuers. Its "account takeover" category is narrow: a criminal taking over another person's genuine card account. Remote banking fraud covers takeover of internet, mobile and telephone banking.
| Category (UK Finance, 2025 data) | Losses | Cases |
|---|---|---|
| Card ID theft (all) | £54.0m, down 12% | 103,171, down 11% |
| Card account takeover | £37.8m, down 10% | 82,030, down 10% |
| Remote banking fraud (all) | £104.4m, down 27% | 37,646, up 11% |
| Internet banking | £52.6m, down 32% | 9,562, up 4% |
| Mobile banking | £43.9m, down 10% | 25,180, up 21% |
| Telephone banking | £7.9m, down 53% | 2,904, down 22% |
| Remote purchase (card not present) | £423.5m, up 3% | 3,196,962, up 13% |
| All unauthorised fraud | £703.4m, down 5% | 3,814,128, up 11% |
UK Finance also reports £1.68 billion of unauthorised fraud prevented in 2025, which it equates to 70p in every £1 of attempted unauthorised fraud stopped. Rising case counts with falling losses, as in remote banking, suggest more attempts caught earlier rather than fewer attempts.
Cifas counts fraud risk cases filed to the National Fraud Database by member organisations across sectors, so its account takeover figure includes telecoms, retail and other accounts. Fraudscape 2026 records 444,993 cases in 2025, a record and up 6%, of which 78,387 were account takeover (18% of filings, up 6%). Filings from the communications sector rose 38%, and in the January to June 2026 update, account takeover filings reached 39,878, up 5%, with online retail filings up 84% (an increase of 4,350) and plastic card filings up 59% (an increase of 2,188).
Credential supply and automation
- Credential corpus size: the Synthient Credential Stuffing Threat Data loaded into Have I Been Pwned on 5 November 2025 holds 1,957,476,021 unique email addresses and 1.3 billion unique passwords, 625 million new to the service. Troy Hunt describes the data as gathered from many places where criminals had published it. See Breached password checks.
- Automation: Imperva's 2025 Bad Bot Report finds automated traffic at 51% of web traffic and bad bots at 37% of all internet traffic. Credential stuffing at scale depends on this automation. See the Bot Traffic and Automated Attack Statistics Guide.
- Phishing as a credential source: Microsoft reports that 89% to 95% of the email phishing attachments it analysed led to a credential theft effort.
The 23andMe credential stuffing breach shows how far a modest number of reused passwords can reach: about 14,000 accounts accessed led to data on about 6.9 million people being exposed through a relatives-matching feature, and a £2.31 million fine from the UK ICO.
What the numbers mean for defenders
| Finding | Implication | Control and framework reference |
|---|---|---|
| Billions of credential pairs in circulation (HIBP) | Assume any password-only account will be tried | Breached-password screening and phishing-resistant MFA; NIST SP 800-53 IA-5, IA-2; ATT&CK T1110.004 |
| Social engineering behind most IC3 ATO cases | One-time codes do not stop a relayed login; recovery and support channels are targets | Passkeys bound to origin; step-up on payee and contact changes; ATT&CK T1078 |
| Stolen credentials in 36% of breaches (DBIR) | Workforce and customer logins need the same breached-credential checks | NIST CSF 2.0 PR.AA-03; SP 800-53 AC-7 for throttling |
| Follow-on credential theft in 52.2% of valid account intrusions (Microsoft) | Contain the session and tokens, not just the password | Session revocation; ATT&CK T1539; SP 800-53 SI-4 |
| Mobile banking cases up 21% (UK Finance) | App sign-in and device binding deserve their own monitoring | NIST CSF 2.0 DE.AE-02 |
For a business case, pair one loss figure from a regulator or trade body with one prevalence figure from breach research, and state both data years. Small organisations without a fraud team gain most from turning on MFA and breached-password checks, which address the highest-volume threat in these figures. Large consumer platforms should track their own rates against the metrics below, because national figures are averages across very different account types.
Metrics to track internally
- Login failure ratio: failed to successful sign-ins per hour, by source network; spikes mark stuffing runs. See the Credential Stuffing Attack Response Playbook.
- Breached-credential hit rate: share of sign-ins or password changes matching a known breached password, compared with the DBIR's 4% median for accounts scanned.
- Confirmed ATO per 100,000 active accounts: monthly, split by channel (web, app, contact centre).
- Phishing-resistant authenticator coverage: share of active accounts with a passkey or security key.
- Time to contain: from first fraud signal to sessions revoked and attacker-added details removed.
Common failure patterns when using account takeover statistics
- Adding figures from different counters: IC3 complaints, UK Finance confirmed cases and Cifas filings measure different things in different populations. Present them side by side, never summed.
- Reading the DBIR's fall to 13% as a fall in risk: Verizon attributes part of the drop to a classification change, and stolen credentials still appear in 36% of breaches.
- Treating UK Finance "account takeover" as all takeover: it covers card accounts only; online banking takeover sits under remote banking fraud.
- Quoting complaint data as total losses: IC3 and FTC figures come from people who chose to report, so they understate true losses.
- Citing roundup pages: secondary statistics sites often drop the data year or misquote the scope. Cite the publisher's report, as this page does.
- Using credential corpus size as victim count: HIBP counts unique email addresses in a data set, not accounts taken over.
Choosing the right source
| Question you need to answer | Best source on this page | Why |
|---|---|---|
| How much do US consumers report losing to takeover? | IC3 Internet Crime Report | Only US federal source that names account takeover with a loss figure |
| How often do stolen credentials feature in breaches? | Verizon DBIR | Large multi-contributor breach data set with stated sample sizes |
| What does takeover cost UK banks and customers? | UK Finance Annual Fraud Report | Confirmed cases and losses split by channel |
| Is takeover rising across UK sectors, not just banking? | Cifas Fraudscape | Cross-sector filings including telecoms and retail |
| How many leaked credentials are available to attackers? | Have I Been Pwned | Counts unique addresses and passwords per loaded data set |
Methodology notes and caveats
- IC3: victim-reported complaints to the FBI; the account takeover figures in the 2025 report are approximations in the cyber-enabled fraud section.
- Verizon DBIR: incidents and breaches contributed by Verizon and partners for 1 November 2024 to 31 October 2025; percentages are of breaches where the relevant field was known.
- UK Finance: confirmed cases and gross losses reported by member firms for calendar year 2025.
- Cifas: fraud risk cases filed by members to the National Fraud Database; a filing is a member's assessment, not a conviction.
- Microsoft, Imperva: vendor telemetry from each company's own customers and network, attributed as such.
- FTC: Consumer Sentinel reports for 2024; account takeover is not separated from other fraud and identity theft categories.
Practitioner checklist
- Cite each figure with publisher, report name and data year in the same sentence.
- Pick sources that match your market: IC3 and FTC for the US, UK Finance and Cifas for the UK.
- Use DBIR figures for workforce and breach risk, banking figures for customer fraud loss.
- Measure your own failure ratio, breached-credential hit rate and confirmed ATO rate monthly.
- Screen passwords against breached corpora at sign-up, change and sign-in.
- Prioritise phishing-resistant authentication for accounts that can move money or change contact details.
- Treat recovery and support channels as sign-in paths in your controls and statistics.
- Recheck this page's sources each spring and summer, when IC3, Verizon and UK Finance publish.
Standards and references
- FBI IC3: Internet Crime Report 2025
- FBI IC3: Public Service Announcement I-112525-PSA on account takeover fraud
- Verizon: 2026 Data Breach Investigations Report
- UK Finance: Annual Fraud Report 2026
- Cifas: Fraudscape 2026
- FTC: New FTC Data Show a Big Jump in Reported Losses to Fraud
- Have I Been Pwned: 2 Billion Email Addresses Were Exposed
- Microsoft: Digital Defense Report
Related NHI Mgmt Group resources: Account Takeover Prevention Guide · Password Spraying and Credential Stuffing Defence Guide · Identity Fraud Statistics · Account Takeover Response Playbook