TL;DR: Consumer scam losses vary sharply by country because some regimes pair reporting with controls, disruption and recovery, while others mostly publish losses, according to Netcraft research; Singapore and Australia illustrate the difference, and the United States still trails on enforceable scam governance. Loss reporting without intervention leaves banks, telcos and platforms exposed to preventable fraud.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Netcraft's blog post: Consumer scam losses track the maturity of controls, with Singapore and Australia pairing reporting with interventions while the United States remains more statistics-heavy than control-heavy.
Why it matters: IAM, fraud and trust teams should read this as evidence that scam reduction depends on governance, friction and cross-sector enforcement, not reporting alone.
By the numbers:
- Singapore's reported consumer scam losses fell to S$913 million in 2025, down 18% from 2024.
- Australia's reported consumer scam losses rose to A$2.18 billion in 2025, up 7.8% from 2024.
- The FBI's IC3 reported $20.9 billion in US consumer scam losses in 2025, up 26% from 2024.
- Investment scams made up 36% to 41% of total scam losses across the three countries Netcraft compared.
Context
Consumer scam loss reporting is only useful when it is paired with intervention, because published figures usually capture just a fraction of the real harm. Netcraft contrasts countries that treat scam loss data as a control signal with countries that mainly use it as a retrospective tally, and that difference is central to how fraud governance matures.
In this comparison, scam governance is not just a finance or consumer-protection issue. It also intersects with identity verification, account controls, telco verification and platform abuse, which means banks, platforms and regulators all influence whether scams are interrupted before funds move.
Key questions
Q: How should banks and telcos stop consumer scams before money moves?
A: Banks and telcos stop consumer scams before money moves by combining verification, friction and rapid intervention at the point of payment or message delivery. That means step-up identity checks, confirmation of payee or sender, out-of-band challenge, transaction holds, and fast account freeze or recall controls when a scam pattern is detected.
Q: Why do scam losses stay high even when reporting improves?
A: Scam losses stay high because reporting happens after a transfer, while fraudsters exploit speed, mule accounts and cross-channel coordination to move funds before controls react. Strong freeze authority, sender validation, confirmation workflows and shared intelligence reduce exposure, but late reporting alone does not stop the initial payment.
Q: What is the difference between scam reporting and scam disruption?
A: Scam reporting records and shares suspected fraud, while scam disruption actively stops or reverses the activity through payment holds, account freezes, number blocking, takedown requests and customer intervention. Reporting is informational. Disruption is operational control applied in real time or near real time to prevent further loss.
Q: How do identity checks reduce impersonation scams?
A: Identity checks reduce impersonation scams by verifying who is really sending a message, calling, or authorising a payment before trust is granted. Controls such as document proofing, callback verification, known-contact confirmation, sender ID validation and step-up authentication make it harder for deceptive sender IDs to pass as legitimate.
Technical breakdown
Why scam loss reporting understates real fraud exposure
Reported scam losses are a lagging indicator because many victims never file a complaint, and many fraud pathways leave weak evidence in the financial system itself. That means annual reports can measure awareness and reporting behaviour as much as actual harm. When governments and firms rely on loss totals alone, they miss the operational controls that interrupt scams before transfer, and they also miss the role of identity proofing in preventing access to victim channels.
Practical implication: Treat scam-loss data as one input to control design, not as proof that the problem is contained.
How intervention controls change scam outcomes
Scam disruption works when the control layer reaches the point where money movement, account access or contact channels can still be interrupted. That can include account freezes, sender-ID controls, call blocking, verification requirements, and takedown workflows for websites and mobile numbers. The mechanism is not detection alone, but detection plus immediate authority to slow, block or reverse the transaction path before the attacker cashes out.
Practical implication: Build response paths that can halt suspicious transfers and contact channels in near real time.
Why identity and telco verification sit inside scam prevention
Many consumer scams succeed because the attacker can impersonate a trusted brand, a bank, or a government body through phone numbers, ads, messages or fake services. Verification controls reduce that trust abuse by making it harder to impersonate legitimate senders or register deceptive identities at scale. This is where fraud prevention intersects with [[L4|conditional access and identity verification]] style governance, even when the primary channel is not a traditional login. See the Conditional Access Guide.
Practical implication: Tie sender identity, customer verification and channel governance together instead of treating them as separate controls.
NHI Mgmt Group analysis
Loss reporting is not a control strategy: scam statistics only become useful when they drive intervention, not when they sit in annual summaries. Netcraft's comparison shows that the strongest jurisdictions pair measurement with authority to freeze accounts, disrupt contact channels and remove scam infrastructure. That is a governance model, not a metrics exercise. Practitioners should treat scam data as an operational trigger, not a retrospective dashboard.
Consumer scam prevention is now a multi-party identity problem: banks, telcos, ad platforms and regulators all shape whether a scam can present itself as trusted. The key failure is not just weak awareness, but weak validation of senders, callers and advertisers before they reach consumers. That means fraud governance must include phone identity, ad verification and customer friction, not only bank-side detection. Practitioners should align control ownership across the whole contact chain.
Singapore's model shows what whole-of-ecosystem governance looks like: the combination of platform verification, account restrictions, sender controls and rapid disruption creates a layered defence that reduces the scam window. Netcraft's comparison suggests that countries which rely mainly on reporting will keep absorbing avoidable losses. The practical lesson is that scam loss reduction depends on enforceable control points across the ecosystem, not on public awareness alone.
Australia and the United States expose different maturity levels in scam governance: Australia is moving toward more coordinated controls, while the US remains more focused on reporting than on enforceable prevention. That gap matters because scammers arbitrage the weakest jurisdictional controls. The field should expect more pressure on telco, platform and payment governance as scam losses keep rising. Practitioners should plan for multi-jurisdictional friction rather than assuming one control layer will suffice.
What this signals
Scam control maturity will increasingly be judged by interruption speed: practitioners should expect boards and regulators to ask how quickly a suspicious transfer can be paused, a sender identity suspended or a fake site removed. In consumer fraud, the decisive metric is shifting from report volume to time-to-intervention, because attackers profit from delay.
Identity validation is becoming part of fraud operations: scam prevention now depends on verifying who can send, advertise, message and receive funds at scale. That pushes fraud teams to work more closely with IAM, telco governance and platform trust controls, especially where impersonation is the primary attack path.
For practitioners
- Strengthen scam reporting with response authority Tie loss reporting to account freezes, sender blocking, website takedown workflows and fraud escalation paths so statistics trigger action instead of post-incident review.
- Verify sender identity before consumer reach Use sender registration, verified advertiser identity and telco filtering to make impersonation harder across SMS, calls, ads and social platforms.
- Create joint playbooks across banks and telcos Define who can stop a transfer, suspend a sender identity, or remove scam infrastructure, and set response times that match fast-moving fraud.
- Measure losses against control outcomes Track whether interventions reduce successful transfers, account takeovers and scam duration, not just how many reports are filed.
Key takeaways
- Consumer scam loss reporting is most valuable when it is tied to controls that can interrupt impersonation, account abuse and fast cash-out.
- The three-country comparison shows that jurisdictions with coordinated disruption and recovery can reduce losses more effectively than those that mainly publish figures.
- Fraud teams should measure success by intervention speed, sender verification and reversal capability, not only by annual loss totals.
Related NHI Mgmt Group resources: Conditional Access Guide · Singapore Shared Responsibility Framework Guide · Consumer Reporting Routes Map
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack surface, NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, and GDPR defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Scam disruption depends on limiting which accounts, senders and channels can move value. |
| Recommendation — Apply PR.AA-05 to restrict transfer and sender privileges for high-risk consumer channels. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account and sender governance sits at the centre of scam freeze and recovery operations. |
| Recommendation — Use CIS-5 to govern high-risk accounts and revoke suspicious access paths quickly. | ||
| NIST SP 800-53 Rev 5 | IA-8 — Identification and Authentication (Non-Organizational Users) | Consumer onboarding, sender verification and impersonation controls map to external-user authentication. |
| Recommendation — Use IA-8 to strengthen verification for external users and trusted service channels. | ||
| MITRE ATT&CK | TA0001;TA0009;TA0010 — Initial Access; Collection; Exfiltration | Consumer scam campaigns rely on initial trust abuse, collection of credentials or approval, and value extraction. |
| Recommendation — Map scam workflows to TA0001, TA0009 and TA0010 to prioritise detection and interruption points. | ||
| GDPR | Art.32 — Security of Processing | Where scam controls process personal data, security of processing and validation safeguards are relevant. |
| Recommendation — Apply Art.32-style safeguards to protect consumer data used in scam detection and verification. | ||
Key terms
- Consumer Scam: A consumer scam is a fraud scheme designed to persuade an individual to send money, reveal credentials or approve a transfer under false pretences. In practice, it often uses impersonation, urgency and trusted channels such as phone, text, email or social media to convert attention into financial loss.
- Business email compromise: A form of social engineering where an attacker impersonates a trusted person or domain to manipulate payment, change banking details, or extract sensitive information. It often succeeds without malware because the attacker targets process trust and human judgement instead of technical controls.
- Money mule: A money mule is an account holder or intermediary used to receive and move fraudulent funds on behalf of a criminal. Mule activity is part of the execution layer of many scams because it helps obscure the final destination and complicates recovery, tracing, and reversal.
- Sender ID Spoofing: Sender ID spoofing is the falsification of the originator name or number shown on a text message. Attackers alter the visible sender field to impersonate a trusted business, which can support phishing, fraud and social engineering. Message verification and filtered messaging gateways help reduce abuse.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity and secrets management. It helps security practitioners connect identity controls to the broader risk patterns that shape modern fraud and access abuse.
Published by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org