FBI IC3 Internet Crime Report: How to Read the Annual Loss Figures Correctly

The FBI's annual Internet Crime Report is the most quoted cybercrime loss figure in the world, and it is also one of the most misread. Its headline number, $20.877 billion in reported losses for 2025, is a count of what victims chose to report to one US complaint portal, not a measure of all cybercrime. This guide walks through the 2025 report by theme (totals, investment and crypto fraud, business email compromise, older victims, ransomware, fund recovery and AI), sets each figure beside the 2024 report, and explains the limits of complaint-based data so the numbers are used correctly in board papers, risk models and awareness programmes. It is written for fraud, security and risk leads who cite IC3 figures. Every figure below comes from the FBI's own published reports. Last reviewed: November 2026.

Key takeaways

• Reported losses passed $20 billion. The IC3 Internet Crime Report 2025 records 1,008,597 complaints and $20.877 billion in losses, up 26% on 2024 according to the FBI.
• Investment fraud dominates the money. Investment fraud caused $8,648,617,756 of reported 2025 losses, about 41% of the total (calculated), most of it with a cryptocurrency nexus.
• Volume and value are different stories. Phishing and spoofing tops the complaint count (191,561) but not the loss table, while BEC has far fewer complaints (24,768) and the second largest losses ($3.05 billion).
• Older victims lose the most per case. People aged 60 and over filed 201,266 complaints with $7.748 billion in losses and an average loss of $38,500 in 2025.
• Treat it as a floor, not a census. IC3 counts complaints, not victims, depends on voluntary reporting, and excludes many costs such as ransomware downtime and remediation, so the real figures are higher.

What the IC3 report is and how it is built

The Internet Crime Complaint Center (IC3) is run by the FBI and describes itself as "the central hub for reporting cyber-enabled crime". Anyone affected by a scam, fraud or cybercrime can file, and the FBI says complaints may be referred to federal, state, local or international law enforcement. The site also states that IC3 cannot respond directly to every submission, which matters when advising victims on what to expect.

Each spring the FBI publishes an annual report built from the previous calendar year's complaints, plus state reports and separate state breakdowns for cryptocurrency, elder fraud and (from 2025) complainants aged 17 or younger. The 2025 report notes that IC3 has received over 10 million complaints since it began and almost 3,000 a day in 2025.

Headline totals and the trend

The report's loss chart shows reported losses rising every year across the last five reports. The values below are the annual totals from the FBI's 2024 and 2025 reports; earlier years are read from the 2025 report's five-year chart.

The 2025 report gives an average loss of $20,699 per complaint. Its five-year loss chart labels $6.9 billion, $10.3 billion, $12.5 billion, $16.6 billion and $20.877 billion, in year order ending with 2025, so reported losses have roughly tripled over five reports. Complaints grew far more slowly than losses, which tells you the average reported case is getting larger, driven by investment and crypto fraud rather than by a flood of small scams.

Complaints came from more than 200 countries, accounting for almost $1.6 billion of 2025 losses. Outside the US, Canada (7,479), India (5,879), Japan (5,764) and the United Kingdom (4,106) filed the most complaints in 2025. Those numbers are tiny next to national reporting bodies, so IC3 is not a useful source for non-US prevalence.

Crime types: volume against value

The two top-five tables in the IC3 Internet Crime Report 2025 barely overlap, and that gap is the most useful thing in the report for defenders.

• Phishing is the entry point, not the loss category: phishing complaints were 193,407 in 2024 and 191,561 in 2025, roughly flat. Many phishing victims later file under BEC, investment or data breach when money moves, which is why it ranks low by loss.
• Tech support and impersonation: tech and customer support scams produced 47,794 complaints and $2,134,675,818 in losses in 2025. The FBI adds that together with government impersonation these scams exceeded 80,000 complaints and $2.9 billion. See the Recognising Tech Support Scams Guide.
• Personal data breach appears in both tables: 67,456 complaints and $1,314,923,988 in losses, a reminder that individuals report data exposure as a crime, not only organisations.

Investment fraud and cryptocurrency

Investment fraud is the single biggest reason the headline keeps climbing. Reported investment losses were $6,570,639,864 in the IC3 Internet Crime Report 2024 and $8,648,617,756 in 2025, an increase of 31.6% (calculated), from 72,984 complaints in 2025.

Cryptocurrency is the payment rail behind most of it. The 2025 report records 181,565 complaints with a cryptocurrency nexus and $11,366,669,732 in losses, against $9,322,335,911 in crypto-related losses in 2024. Crypto investment fraud alone accounted for 61,559 complaints and about $7.2 billion in 2025 (the report gives $7.228 billion in its narrative and $7,277,868,919 in its table, so quote the figure with its table reference).

• Do not add crypto and investment together: the categories overlap. Crypto is a nexus attribute recorded across many crime types, so crypto losses ($11.37 billion) and investment losses ($8.65 billion) share most of the same dollars.
• AI overlap: the FBI states that investment complaints with an AI nexus exceeded $632 million in losses in 2025.

For prevention controls see the Investment Fraud Prevention for Banks and Platforms Guide, and for wider blockchain crime data the Crypto Crime Statistics Guide.

Business email compromise

BEC is the category most relevant to corporate finance and identity teams. The IC3 Internet Crime Report 2025 recorded 24,768 BEC complaints and $3,046,598,558 in losses, against 21,442 complaints and $2,770,151,146 in 2024 (complaints +15.5%, losses +10.0%, calculated). The average reported BEC loss in 2025 was roughly $123,000 (calculated), around six times the overall average of $20,699.

BEC succeeds by abusing trusted identities: a compromised mailbox, a lookalike supplier domain or an impersonated executive. The controls that matter are identity controls, such as phishing-resistant MFA on mailboxes, monitoring for malicious inbox rules and OAuth grants, and out-of-band verification of any change to payment details. Detailed BEC data from IC3 and other sources is in the Business Email Compromise and Fraud Statistics Guide, which this page does not repeat.

Older victims and elder fraud

The FBI tracks complaints from people aged 60 and over separately. In the IC3 Internet Crime Report 2025 they filed 201,266 complaints (up 37%) with $7.748 billion in losses (up 59%) and an average loss of $38,500. The 2024 report recorded 147,127 complaints and $4.885 billion. In 2025, 12,444 older complainants each lost more than $100,000.

Two cautions apply. Age is optional on the complaint form, so the 60+ totals cover only complainants who gave an age, and some later reports may be filed by relatives. Even so, older people account for about one in five complaints and over a third of reported losses (calculated from the 2025 figures). See the Elder Financial Abuse and Scam Prevention for Banks and Care Providers Guide.

Ransomware and critical infrastructure

Ransomware is where IC3 data most understates the problem. The 2025 report records 3,611 ransomware complaints (3,156 in 2024) and $32,320,105 in reported losses. That loss figure is small because, in the FBI's own words, it excludes lost business, time, wages and remediation costs, some entities report no loss amount at all, and the data does not include incidents reported directly to FBI field offices.

• Variants: the most reported variants in 2025 were Akira, Qilin, INC./Lynx/Sinobi, BianLian and Play, with 63 new variants identified during the year.
• Sectors: critical manufacturing, healthcare and public health, and government facilities were the most affected critical infrastructure sectors, and more than 1,400 ransomware complaints came from non-critical sectors.

Use IC3 for variant and sector trends, never for the cost of an attack. Cost and frequency data from other primary sources is in the Ransomware Statistics Guide.

Fund recovery and AI-enabled fraud

The report's most actionable section for finance teams is the Recovery Asset Team (RAT) and its Financial Fraud Kill Chain (FFKC), which works with banks to freeze fraudulent transfers.

The kill chain only works while funds are still in the receiving bank, so speed of reporting decides the outcome. Build "report to the bank and IC3 the same day" into payment incident runbooks.

The 2025 report also counts complaints with an AI nexus: 22,364 complaints and $893,346,472 in losses, including over $30 million in BEC losses involving AI and 3,143 complaints from people aged 60+ with $352,496,231 in losses. AI-nexus losses are about 4% of the total (calculated), so most reported fraud still runs on ordinary impersonation. See the Deepfake Fraud Statistics page for other sources.

Limits of complaint-based data

The FBI is candid about the limits, and any citation should respect them.

• Complaints, not victims: counts are complaints, not individuals, and some duplicates may exist; losses are de-duplicated "as much as possible".
• Voluntary and US-centred: only people who know about IC3 and choose to file are counted. Most victims never report, so totals are a floor.
• Point in time: the report says statistics are an assessment taken at a point in time and may change, so do not mix figures from different editions without saying so.
• Optional fields: age and state are not mandatory, so age and state breakdowns cover only complaints that included them.
• Overlapping categories: crypto and AI are nexus tags across crime types. Summing them with crime type totals double counts.
• Inconsistencies: the 2025 report gives slightly different values for the same item in different tables (for example crypto investment losses and 60+ tech support figures). Quote the table you used.

What the numbers mean for defenders

• Prioritise by loss, not by noise: phishing volume is high, but money is lost in investment fraud, BEC and support scams. Weight controls and awareness toward payment verification and impersonation.
• Payment change controls are identity controls: BEC losses of $3.05 billion trace back to compromised or impersonated accounts. Phishing-resistant MFA and mailbox monitoring reduce them. See the Authorised Push Payment (APP) Fraud Guide.
• Speed recovers money: the FFKC froze $679 million in 2025. A same-day reporting rule is cheap and measurable.
• Protect older customers deliberately: the 60+ average loss of $38,500 justifies extra friction such as cooling-off periods and trusted contact options.
• Do not price ransomware from IC3: its loss figure leaves out downtime and recovery, which are the bulk of the real cost.

Practitioner checklist

• Cite every IC3 figure with the report edition, the table and the year, and link the FBI PDF directly.
• Describe IC3 totals as "losses reported to the FBI", never as "the cost of cybercrime".
• Never add crypto-nexus or AI-nexus losses to crime type losses; they overlap.
• Rank fraud risks by reported loss and average loss, then by complaint volume.
• Add same-day bank and IC3 reporting to payment fraud and BEC runbooks.
• Require out-of-band verification for every change of beneficiary or bank details.
• Run targeted controls for customers aged 60+ and track loss per case in that group.
• Refresh this analysis each spring when the FBI publishes the next annual report, and note any restated figures.

Standards and references

• FBI IC3: Internet Crime Report 2025
• FBI IC3: Internet Crime Report 2024
• FBI IC3: Annual reports and state reports index
• FBI IC3: 2025 Elder Fraud State Reports
• FBI IC3: 2025 Cryptocurrency State Reports
• FBI IC3: Internet Crime Complaint Center

Related NHI Mgmt Group resources: Business Email Compromise and Fraud Statistics Guide · Crypto Crime Statistics Guide · Cybersecurity Statistics Guide · What to Do If You Have Been Scammed Guide