Notifications
Clear all
Topic starter
27/06/2026 1:45 pm
TL;DR: The FBI’s 2025 IC3 report recorded $20.877 billion in cybercrime losses, with 85% tied to cyber-enabled fraud and $893 million linked to AI-related complaints, underscoring how AI is amplifying impersonation, BEC, and persistent fraud campaigns, according to Abnormal AI’s analysis of the report. Identity and access programmes now have to treat behavioural trust, not just technical compromise, as the primary control surface.
NHIMG editorial — based on content published by Abnormal AI: FBI IC3 2025 cybercrime report analysis and AI-driven fraud findings
By the numbers:
- The FBI’s 2025 IC3 report recorded $20.877B in cybercrime losses, a 26% YoY increase.
- AI cybercrime led to $893M in losses from 22,364 complaints.
- Business email compromise caused $3B in 2025 losses.
Questions worth separating out
Q: How should security teams respond when AI makes business email compromise harder to spot?
A: Teams should move beyond message inspection and verify the requester, the channel, and the business context before allowing action.
Q: Why do AI-enabled impersonation attacks create a human identity governance problem?
A: Because the attack succeeds by manipulating trust decisions made by people inside legitimate processes.
Q: What breaks when fraud detection relies only on known-bad indicators?
A: Known-bad indicators miss attacks that are newly generated, context-specific, and conversational.
Practitioner guidance
- Tighten verification on high-risk approval paths Require out-of-band verification for payment, payroll, vendor bank detail, and privileged access changes, with a verified second channel before execution.
- Baseline communication patterns by role Model normal sender, recipient, timing, and escalation patterns for executives, finance teams, and suppliers so deviations can trigger review before action is taken.
- Rework fraud controls around conversation sequences Detect multi-step interaction patterns, not just suspicious messages, because AI-assisted fraud often starts with a plausible opening and escalates through follow-up pressure.
What's in the full analysis
Abnormal AI's full analysis covers the operational detail this post intentionally leaves for the source:
- FBI IC3 loss breakdowns by fraud category, including the specific AI-related complaint totals and loss figures.
- Abnormal AI's examples of how AI changes BEC execution quality across email and voice-based impersonation.
- Behavioural detection patterns used to distinguish normal communication from AI-assisted fraud.
- The report's recommended defensive posture for organisations responding to AI-driven impersonation and social engineering.
👉 Read Abnormal AI's analysis of AI-driven cybercrime and impersonation risk →
AI-enabled fraud and impersonation: what IAM teams need to act on?
Explore further
27/06/2026 3:11 pm
AI-driven fraud is now an identity problem, not just a content problem. The report shows attackers winning by manipulating trust signals that sit around the identity layer, including tone, context, and timing. That means human identity assurance and workflow validation are now part of fraud defence, not separate disciplines. Security teams should treat behavioural trust as a governed control surface, not a soft signal.
A few things that frame the scale:
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to The State of Secrets in AppSec.
- Organisations maintain an average of 6 distinct secrets manager instances, which fragments control and complicates consistent governance across environments.
A question worth separating out:
Q: How can organisations reduce BEC risk without slowing legitimate work?
A: Use risk-based verification for high-value transactions, privileged changes, and sensitive requests rather than applying the same friction everywhere. The goal is to make high-impact actions harder to fake while keeping routine work efficient. That means stronger validation where trust has financial consequence.
👉 Read our full editorial: AI-enabled fraud is reshaping cybercrime losses and identity trust
