Contact Centre Fraud Statistics: Social Engineering Calls, Synthetic Voices and Account Losses

The contact centre is where an attacker with a phone and a few stolen details can talk their way past controls that would stop them online, and the numbers on how often this happens are scattered across vendor telemetry, banking industry reports and law enforcement complaint data. This page brings the traceable figures together: call level fraud rates, account takeover attempts and authentication bypass rates from the Pindrop Voice Intelligence and Security Report 2025 (vendor research based on customer call data), impersonation fraud losses from the UK Finance Annual Fraud Report 2026, and impersonation and scam call centre losses from the FBI Internet Crime Complaint Center (IC3) 2025 report and the US Federal Trade Commission (FTC). Every figure carries its publisher, edition and period in the same sentence or table row. It is for fraud, contact centre and identity teams building a business case or a risk register. Buying guidance is in the Contact Centre Fraud Prevention buyer's guide, which this page does not repeat. Last reviewed: November 2026.

Key takeaways

• Fraud attempts are frequent and rising. Pindrop's 2025 report puts the 2024 contact centre fraud rate across its customers at 1 in 599 calls, up 26% on 2023 and double the 2021 level.
• Knowledge questions do not stop fraudsters. In the same report, fraudsters passed knowledge-based authentication (KBA) 53% of the time on average across 10 financial institutions, and one time passcodes were bypassed in 22% of confirmed fraud calls at one organisation.
• Synthetic voice is growing fast from a low base. Pindrop measured non-live (synthetic or replayed) audio rising from 0.12% of calls in the first quarter of 2024 to 2.11% in the fourth quarter.
• Impersonation losses are large but not all rising. UK Finance reports £55.5 million lost to police and bank staff impersonation scams in 2025, down 18% in value, while total UK fraud losses rose 4% to £1.28 billion.
• The help desk is a corporate attack path too. Phone based help desk social engineering preceded some of the most costly recent intrusions, so contact centre statistics belong in identity risk reporting, not only in fraud reporting.

How to read contact centre fraud statistics

Two senses of "call centre" appear in these sources. Enterprise contact centres are the target in the Pindrop and UK Finance data; the FBI's call centre figures describe criminal scam call centres that phone victims. Both matter, but they should not be added together. Deepfake figures beyond the contact centre are in the Deepfake Fraud Statistics page.

Headline statistics

Fraud attempts at the contact centre

• Trend: Pindrop's 2025 report gives a fraud rate across its customers of 1 in 1,049 calls in 2020, 1 in 1,199 in 2021, 1 in 857 in 2022, 1 in 756 in 2023 and 1 in 599 in 2024, which it equates to an attempt about every 46 seconds.
• By sector (2024): banking 1 in 650 calls, credit unions 1 in 1,145, brokerage 1 in 2,233, insurance 1 in 4,359 and retail 1 in 127. The report states that average fraud exposure per insurance case is about 20 times that of banking, and that brokerage losses average more than three times retail banking.
• What fraudsters call for (2024): phishing and reconnaissance 45.1% of fraud calls, account takeover 39.2%, first-party fraud 9.7% and account opening 4.3%. In banking, 34% of account takeover calls sought to remove account restrictions or push through blocked transactions, and 19% targeted online banking access.
• Projection: based on January and February 2025 data, Pindrop projected 1 in 584 calls for 2025. Treat projections as the vendor's estimate, not a measurement.

Reconnaissance calls are the important detail for defenders. Nearly half of fraud calls in this data were gathering information, such as confirming account details or learning the verification flow, for use on a later call or online. Counting only calls that move money understates the problem.

Authentication failure

These figures show why knowledge questions and caller ID should not carry verification on their own. A caller who knows the answers is not thereby proved to be the customer, and a caller ID is a claim, not a credential. Stronger patterns, such as an in-app push to a registered device or a call back to a number on file, are covered in Caller Authentication in Contact Centres.

Synthetic voices and deepfakes

• Non-live audio: Pindrop measured non-live calls at 0.12% in the first quarter of 2024, 0.28% in the second, 0.92% in the third and 2.11% in the fourth, across 130 million calls. The report's chart splits non-live audio into replayed (0.61%) and synthetic (0.33%), so replay was about twice as common.
• By sector: the same report records synthetic voice fraud attacks up 149% in banking and 475% in insurance in 2024, and deepfake attacks at large national banks rising from 1.6 a day at the start of 2024 to 5.5 a day in the fourth quarter.
• Share of fraud: machine generated voice accounted for 0.90% of confirmed fraud in the report's data, so most contact centre fraud is still carried out by human voices.
• Law enforcement view: the FBI IC3 2025 report records 22,364 AI-related complaints with losses of $893,346,472, and victims of voice cloning distress scams reporting losses of over $5 million. These are consumer victims, not enterprise contact centres.

The defensible reading is that synthetic voice is a fast growing share of a still small slice of contact centre fraud. Controls that do not depend on recognising a voice, such as device binding and out-of-band confirmation, address both human and synthetic callers. See Voice biometrics and voiceprint authentication in the age of voice cloning.

Account and payment losses

• UK totals: UK Finance's Annual Fraud Report 2026 (published 15 June 2026) reports £1,279.8 million lost to fraud in 2025, up 4%: £703.4 million unauthorised fraud (3,814,128 cases) and £576.4 million authorised push payment (APP) fraud (248,070 cases, up 7%).
• Impersonation: police and bank staff impersonation APP scams cost £55.5 million across 6,016 cases, down 18% in value and 23% in cases; other impersonation cost £36.9 million across 18,435 cases. The report states that impersonation scams often begin with a phone call or text message.
• Channel: UK Finance attributes 17% of APP cases but 28% of APP value to telecommunications, against 66% of cases and 32% of value online, and notes the figures are not definitive. Phone enabled cases are fewer but larger.
• Prevention: UK Finance reports £1.68 billion of unauthorised fraud prevented in 2025, equivalent to 70p in every £1 attempted.
• US consumer losses: the FTC reported more than $12.5 billion in fraud losses for 2024, impostor scams at $2.95 billion and government impersonation at $789 million, with phone calls the second most reported contact method after email. The FBI IC3 2025 report counts 47,794 tech support complaints ($2,134,675,818) and 32,424 government impersonation complaints ($797,943,193), and describes these as largely driven by scam call centres.

Help desk social engineering and insiders

Contact centre risk is not only customer fraud. The same verification weaknesses apply when a caller asks an IT service desk to reset a password or enrol a new MFA device.

• Corporate help desk: in the MGM Resorts breach, the attackers' own account was that a call to the IT help desk impersonating an employee gave them their foothold; MGM estimated about $100 million of impact on adjusted property EBITDAR in its October 2023 filing.
• Support agent insiders: in the Coinbase insider breach, bribed overseas support agents copied data on 69,461 customers using access they legitimately held, and Coinbase's SEC filing estimated costs of $180 million to $400 million. Strong caller authentication does not help when the agent is the threat; scoping agent access to active cases does.

Awareness material for agents is in the Vishing and Help Desk Social Engineering Awareness Guide.

Where AI agents and identity fit

Contact centres are adding AI voice and chat agents that can look up accounts and take actions. Each one is a non-human identity with access to customer records, and it faces the same social engineering as a human agent with less judgement. None of the sources above yet publishes a fraud rate for calls handled by AI agents, so treat vendor claims either way with caution. Practical controls (narrow tool permissions, no account changes without out-of-band confirmation, logging of every lookup) are in the Voice AI Agent Security and Fraud Guide.

What the numbers mean for defenders

1. Retire KBA as a primary check: with fraudsters passing it about half the time in the Pindrop data, use it only as a weak signal.
2. Do not trust caller ID: about one in six fraud calls involved caller ID manipulation in the same data; verify through the registered device or a call back.
3. Track reconnaissance, not only losses: flag repeated calls probing one account and link them to later online activity.
4. Gate high risk requests: MFA resets, contact detail changes and restriction removals should need out-of-band confirmation, whoever (or whatever) takes the call.
5. Measure: fraud calls per thousand, KBA reliance rate, share of high risk changes with out-of-band confirmation, repeat call rate per account, and agent record lookups outside an active case.

Framework mapping

Common mistakes when using contact centre statistics

• Presenting vendor telemetry as an industry census: the Pindrop rates come from its customers, mostly US financial services; say so.
• Mixing up scam call centres and enterprise contact centres: the FBI's $2.9 billion describes criminal call centres phoning victims.
• Quoting deepfake growth without the base: a 475% rise from a small base is still a small share; give the share alongside the growth.
• Quoting projections as outcomes: label any forecast with who made it and when.
• Ignoring falling categories: UK police and bank impersonation losses fell in 2025; a case built only on rising numbers is easy to challenge.

Practitioner checklist

• Cite each figure with publisher, edition, data period and, for vendor research, the data basis.
• Report your own fraud call rate per thousand calls and compare it with a stated external benchmark.
• Track KBA reliance and set a date to remove it as a sole check.
• Treat caller ID as unverified and use registered device or call back verification.
• Require out-of-band confirmation for MFA resets, contact changes and restriction removals.
• Scope agent and AI agent access to active cases and monitor bulk lookups.
• Include help desk social engineering in identity incident reporting.
• Refresh figures each June (UK Finance) and spring (IC3, FTC) when new editions appear.

Standards and references

• UK Finance: Annual Fraud Report 2026
• FBI IC3: Internet Crime Report 2025
• Pindrop: Voice Intelligence and Security Report 2025
• FTC: Consumer Sentinel fraud data release, March 2025
• NIST: Cybersecurity Framework 2.0
• MITRE ATT&CK: T1566.004 Spearphishing Voice

Related NHI Mgmt Group resources: Contact Centre Fraud Prevention · Caller Authentication in Contact Centres · Contact Centre Platform Security Guide · Deepfake Fraud Statistics