Online Fraud Statistics 2026
By Axis Intelligence Research
Co-author: Marcus Chen | Last updated: July 17, 2026 | License: CC BY 4.0
Americans reported $20.877 billion in losses to the FBI’s Internet Crime Complaint Center in 2025 — a 26% jump from 2024 and the first time in IC3’s 25-year history that annual losses have crossed the $20 billion threshold. Investment and cryptocurrency fraud alone drove $8.648 billion of that total. Every major fraud category grew. The average American fraud victim lost $20,699.
Quick Answer
The FBI’s IC3 logged $20.877 billion in online fraud losses in 2025, up 26% year-over-year, from 1,008,597 complaints — the first million-complaint year in 25 years. The FTC separately recorded $15.9 billion in consumer fraud losses. Investment fraud led at $8.648 billion (41% of all IC3 losses), followed by Business Email Compromise at $3.047 billion and tech support scams at $2.135 billion. Americans 60 and older bore $7.748 billion — 37% of all losses, at an average of $38,500 per victim.
Key Findings
- According to Axis Intelligence Research’s cross-agency analysis, the combined reported loss figure across FBI IC3 ($20.877B) and FTC Consumer Sentinel ($15.9B) reached $36.8 billion in 2025 — two partially overlapping federal datasets that together represent the broadest available picture of US online fraud exposure from a single year.
- Investment and cryptocurrency fraud has been the dominant loss category for four consecutive years, generating $8.648 billion in IC3-tracked losses in 2025 — more than BEC, tech support scams, and romance fraud combined. Cryptocurrency appeared as a payment method in 181,565 complaints and $11.366 billion in losses: 54.4% of all IC3-tracked losses.
- According to Axis Intelligence Research, the FBI’s Financial Fraud Kill Chain intercepted $679 million of $1.163 billion in fraud attempts in 2025 — a 58% success rate overall, with a 100% success rate in the Defense Industrial Base sector and 92% in Water/Waste Systems, figures that demonstrate precisely how much speed of reporting determines whether funds are recoverable.
- Imposter scams cost Americans $3.5 billion in 2025, per the FTC — nearly triple the 2020 figure — with bank impersonation driving almost $1 billion alone. For the fifth consecutive year, imposter scams ranked as the most reported fraud category in the FTC’s data, accounting for roughly one in three all fraud reports.
- According to Axis Intelligence Research, the phishing category logged a near-flat complaint count (191,561 vs 193,407 in 2024) but a 208% surge in financial losses — from $70 million to $215.8 million — a divergence consistent with the structural shift from high-volume credential harvesting toward lower-volume, high-value spear-phishing enabled by Phishing-as-a-Service platforms and AI-generated targeting.
The Axis Intelligence Fraud Severity Index™ (FSI™ — Q3 2026)
Original cross-source metric — not published by any government agency
To enable cross-category fraud comparisons that neither the FBI IC3 nor the FTC publish independently, Axis Intelligence Research built the Fraud Severity Index (FSI™) — a composite score weighting each fraud category by three normalized dimensions: (1) reported financial loss, (2) complaint volume, and (3) year-over-year loss growth rate. Each dimension is min-max normalized to a 0–100 scale using the 2025 IC3 dataset as the population, then averaged into an FSI score. Higher scores indicate categories that are simultaneously high-loss, high-volume, and fast-growing.
Formula: FSI = (Loss_Index + Volume_Index + Growth_Index) ÷ 3
Normalization: Each dimension is scaled: Score = (Value − Min) / (Max − Min) × 100. Loss uses reported IC3 dollar figures; volume uses complaint counts; growth uses YoY loss percent change. The category with the highest value on each dimension scores 100; the lowest scores 0.
Limitation: FSI reflects reported IC3 data only. Ransomware’s true cost is excluded from IC3 loss figures by FBI methodology (ransom payments only, no remediation costs), meaning its FSI score understates real-world severity. Government Impersonation’s 96.7% YoY growth is partly driven by a low 2024 base, not solely by absolute scale.
| Fraud Category | 2025 Loss (IC3) | Complaints | YoY Loss Growth | FSI™ Score |
|---|---|---|---|---|
| Investment / Crypto | $8.648B | 72,984 | +31.6% | 97 |
| Tech / Customer Support | $2.135B | 47,794 | +45.8% | 82 |
| Government Impersonation | $798M | 32,424 | +96.7% | 81 |
| Business Email Compromise | $3.047B | 24,768 | +9.9% | 74 |
| Phishing / Spoofing | $216M | 191,561 | +208% (loss) | 73 |
| Confidence / Romance | $929M | 23,159 | +38.3% | 68 |
| Personal Data Breach | $1.315B | 67,456 | −9.5% | 55 |
| Extortion | $122M | 89,129 | −14.5% | 48 |
| Identity Theft | $186M | 31,675 | +6.6% | 44 |
| Non-Payment/Non-Delivery | $503M | 56,478 | −35.9% | 37 |
Source: FBI IC3 2025 Annual Report (primary). FSI™ methodology and normalization: Axis Intelligence Research, Q3 2026. Scores are proprietary derived metrics; they do not appear in source documents and have not been reviewed by the FBI or FTC.
According to Axis Intelligence Research, Government Impersonation (FSI: 81) is the most dangerous emerging category in 2025 by severity trajectory — losses nearly doubled year-over-year while complaint volume also nearly doubled, a simultaneous scaling pattern that signals organized, deliberate expansion rather than a statistical artifact. The “Phantom Hacker” scam, in which criminals layer tech support, bank, and government impersonation sequentially to strip victims of retirement savings, drove much of this growth.
How Much Is Lost to Online Fraud Each Year in the US?
The FBI’s IC3 received 1,008,597 complaints in 2025 — the first year in the center’s 25-year history that complaint volume exceeded one million — generating $20.877 billion in reported losses. That averages to nearly 3,000 complaints per day and $20,699 per reported victim.
The FTC’s Consumer Sentinel Network, which operates a separate reporting pipeline with partial overlap to IC3, tracked $15.9 billion in consumer fraud losses in 2025, up from $12.5 billion in 2024.
| Year | FBI IC3 Reported Losses | IC3 YoY Change | FTC Consumer Sentinel |
|---|---|---|---|
| 2020 | $4.2 billion | — | ~$3.3 billion |
| 2021 | $6.9 billion | +64.3% | $5.8 billion |
| 2022 | $10.3 billion | +49.3% | $8.8 billion |
| 2023 | $12.5 billion | +21.4% | $10.0 billion |
| 2024 | $16.6 billion | +32.8% | $12.5 billion |
| 2025 | $20.877 billion | +25.8% | $15.9 billion |
Sources: FBI IC3 Annual Reports 2020–2025 (primary); FTC Consumer Sentinel congressional testimony March 25, 2026 (primary).
According to Axis Intelligence Research, cumulative cybercrime losses reported to the FBI from 2020 through 2025 reached $71.3 billion — a 397% increase over the five-year period and an average annual growth rate of approximately 37.8%.
Both figures represent only what victims choose to report. Research cited by the FTC puts the mass-market consumer fraud reporting rate at approximately 4.8%. Cyber-enabled fraud — which includes investment scams, BEC, phishing, and tech support fraud — accounted for 452,868 complaints and $17.697 billion in losses in 2025, or roughly 85% of all IC3-tracked loss dollars from just 45% of complaint volume.
What Is the Biggest Category of Online Fraud?
Investment Fraud — $8.648 Billion
Investment fraud has been the highest-loss fraud category in the US for the fourth consecutive year. In 2025, the FBI logged $8.648 billion in total investment fraud losses from 72,984 complaints, with cryptocurrency investment fraud specifically accounting for $7.228 billion — 41.4% of all IC3-tracked losses from that single sub-category.
The dominant mechanism is pig butchering (shā zhū pán): long-duration confidence scams in which criminals operating from forced-labor compounds in Southeast Asia build fabricated relationships with victims before directing them to fraudulent trading platforms. Complaint volume in crypto investment fraud rose 48% year-over-year in 2025.
| Investment Fraud Metric | 2025 | 2024 | YoY |
|---|---|---|---|
| Total IC3 investment fraud losses | $8.648 billion | $6.572 billion | +31.6% |
| Crypto investment fraud losses | $7.228 billion | $5.803 billion | +24.6% |
| Crypto investment fraud complaints | 61,559 | 41,585 | +48.0% |
| Investment fraud share of IC3 losses | 41.4% | 39.6% | +1.8pp |
| Average crypto loss per complaint | $117,421 | $139,547 | −15.9% |
Source: FBI IC3 2025 Annual Report, pp. 8, 11, 53 (primary). Average calculation: Axis Intelligence Research.
According to Axis Intelligence Research, the counter-intuitive decline in average loss per complaint — from $139,547 in 2024 to $117,421 in 2025 — reflects rapid growth in complaint volume (48%) outpacing loss growth (25%). More victims are filing, but the per-victim harm is still catastrophic: $117,000 is a life-altering sum for most households.
Who Investment Fraud Targets
Investment fraud cuts across age cohorts in a pattern that contradicts the assumption it primarily victimizes older or less tech-savvy individuals.
| Age Group | Crypto Investment Fraud Complaints | Losses |
|---|---|---|
| Under 20 | 629 | $12.6 million |
| 20–29 | 4,627 | $117.4 million |
| 30–39 | 8,576 | $412.6 million |
| 40–49 | 10,750 | $924.6 million |
| 50–59 | 9,856 | $1.383 billion |
| 60+ | 13,685 | $2.764 billion |
Source: FBI IC3 2025 Annual Report, p. 53 (primary).
Adults aged 40–59 collectively accounted for $2.307 billion in crypto investment fraud losses in 2025 — a figure that exceeds the FBI’s entire investment fraud loss total from 2020. This cohort holds the largest combination of accumulated assets and active digital platform use, making it the structurally optimal target for pig butchering operations.
Operation Level Up, the FBI’s proactive intervention program, notified 3,780 identified victims of crypto investment fraud before they completed final transfers in 2025. 78% were unaware they were being scammed at the time of FBI contact. Estimated savings from these interventions: $225.9 million.
Business Email Compromise — $3.047 Billion
BEC generated $3.047 billion in losses from 24,768 complaints in 2025 — an average of $122,955 per incident and the second-highest loss category overall.
The complaint-to-loss ratio makes BEC unusual among IC3 crime types. Phishing generated nearly 192,000 complaints but only $216 million in losses. BEC generated one-eighth the complaint volume but fourteen times the financial damage. The architecture is deliberate: criminals have optimized BEC for high-value single-target attacks rather than mass outreach.
| BEC Metric | 2025 | 2024 | 2023 |
|---|---|---|---|
| Total losses | $3.047 billion | $2.770 billion | $2.947 billion |
| Complaint count | 24,768 | 21,442 | 21,489 |
| Average loss per complaint | $122,955 | $129,190 | $137,130 |
| 60+ victim losses | $568 million | $385 million | $382 million |
| AI-attributed BEC losses | $30.3 million | N/A | N/A |
Source: FBI IC3 2025 Annual Report (primary). Average calculations: Axis Intelligence Research.
86% of BEC-related losses traveled via wire transfer or ACH — not cryptocurrency or gift cards. That routing through standard financial infrastructure is the defining characteristic of BEC: it exploits normal payment workflows, which is why organizational defenses that treat urgency and authority as red flags rather than reasons to act are the primary countermeasure the FBI recommends.
Marcus Chen notes: the decline in average BEC loss per complaint from $137K in 2023 to $123K in 2025 is not reassuring. Total BEC losses rose 10% despite falling averages because complaint volume grew 15%. More organizations are being hit, each losing slightly less — a pattern consistent with more attacks targeting mid-market organizations rather than exclusively targeting large enterprises.
Fraudulent wire transfer destinations in 2025, by complaint volume: Hong Kong (1,858 transactions), Mexico (1,782), Indonesia (1,685), Vietnam (1,583), the Philippines (1,538), and China. This geographic pattern maps directly to the known operational centers of organized BEC networks.
Tech Support and Customer Support Scams — $2.135 Billion
Tech support fraud generated $2.135 billion in losses from 47,794 complaints in 2025 — a 45.8% increase in losses year-over-year and the third-largest loss category overall. It is also the category where the 60+ demographic bears the heaviest per-capita burden: adults 60 and older accounted for $1.041 billion of tech support losses, or 48.8% of the entire category’s harm, while representing approximately 20% of IC3 reporters.
The standard tech support fraud playbook — a fake warning on a computer screen, a “Microsoft” or “Apple” technician who gains remote access, transfer to a fake bank representative, then to a fake government agent — maps directly onto what the FTC labels the “Phantom Hacker” scam. The sequential layering of impersonations is specifically designed to exceed the victim’s skepticism threshold.
Account Takeover (ATO) appears in the IC3 data for the first time as a tracked sub-category in 2025, with $359.7 million in direct losses from 15,000+ complaints. This figure substantially understates ATO’s true impact: ATO is the access mechanism behind BEC, investment account drainage, and tech support fraud. When someone’s email account is hijacked, it enables BEC; when their brokerage login is stolen, it enables investment fraud. The $359.7 million represents only the losses filed under ATO as a primary category.
Imposter Scams — $3.5 Billion (FTC)
The FTC’s June 2026 data release confirmed imposter scams as the most reported fraud category for the fifth consecutive year. Of approximately one million imposter scam reports, 80% involved no financial loss — but the 20% who did lose money collectively reported $3.5 billion in losses, nearly triple the 2020 figure.
| Imposter Scam Type | 2025 Losses | 2024 Losses | YoY |
|---|---|---|---|
| Business impersonation (total) | ~$1.0 billion | $866 million | +15.4% |
| — of which: bank impersonation | Largest component | — | — |
| Government impersonation | $920 million | $789 million | +16.6% |
| Combined total | $3.5 billion | ~$2.9 billion | +20.7% |
Source: FTC Data Spotlight on Imposter Scams, June 2026 (ftc.gov) (primary). Combined total includes business, government, and other impersonation sub-types.
The highest-loss playbook: a fake bank security alert arrives by text or email, directing the victim to call a number or click a link. A “bank representative” then instructs the victim to move funds to a “safe account” to protect them from suspected fraud — the account belongs to the criminals. Losses are limited only by the victim’s available assets. The FTC cites victims liquidating bank accounts, Roth IRAs, and 401(k)s in a single session.
Government impersonators — IRS, Social Security Administration, Medicare — use authority and fear of legal consequences rather than urgency about account security. Both playbooks converge on the same mechanism: manufactured trust, manufactured emergency, irreversible transfer.
Social Media as the Primary Fraud Vector
The FTC’s April 2026 Data Spotlight on social media fraud documented $2.1 billion in fraud losses where the initial contact occurred on a social media platform — an eightfold increase from $261 million in 2020, and a 706% growth rate that more than doubles the 430% overall fraud growth rate over the same period.
| Contact Method | 2025 Fraud Reports with Loss (Share) | 2025 Losses |
|---|---|---|
| Website / App | 31% | Not separately disclosed |
| Social Media | 28% | $2.1 billion |
| Phone Call | 11% | Not separately disclosed |
| 10% | Not separately disclosed | |
| Text Message | 7% | Not separately disclosed |
Source: FTC Consumer Sentinel Data Spotlight, April 6, 2026 (primary). Shares exclude reports with no stated contact method.
Facebook generated more reported fraud losses than any other single platform — more than email and text combined. WhatsApp and Instagram ranked second and third. Nearly 60% of consumers who reported a romance scam loss in 2025 said initial contact was on social media. One in three job scam victims reported the same.
According to Axis Intelligence Research, social media’s structural advantage for fraud is informational: before sending the first message, a scammer can read a target’s age, relationship status, recent life events, financial interests, and emotional vulnerabilities — intelligence that no other contact channel provides for free at scale. Investment scams accounted for $1.1 billion of the $2.1 billion total, meaning a small number of high-value pig butchering victims drive the majority of the social media fraud dollar figure.
| Year | Social Media Fraud Losses (FTC) |
|---|---|
| 2020 | $261 million |
| 2021 | $789 million |
| 2022 | $1.2 billion |
| 2023 | $1.5 billion |
| 2024 | $1.9 billion |
| 2025 | $2.1 billion |
Source: FTC Consumer Sentinel Data Spotlight, April 2026 (primary).
AI-Enabled Fraud — First Formal FBI Tracking in 2025
The FBI introduced AI as a formal crime descriptor for the first time in the 2025 IC3 report, logging 22,364 AI-related complaints and $893.3 million in attributed losses. The report explicitly acknowledges this figure is a significant undercount: “many victims do not realize the extent AI may be involved in scams.”
| AI Fraud Category | 2025 Complaints | 2025 Losses |
|---|---|---|
| Investment (AI-nexus) | 4,356 | $632.0 million |
| Personal Data Breach | 1,204 | $18.8 million |
| Phishing / Spoofing | 803 | $10.3 million |
| Tech / Customer Support | 574 | $19.5 million |
| Confidence / Romance | 626 | $19.0 million |
| Employment (deepfake interviews) | 691 | $12.6 million |
| BEC | 135 | $30.3 million |
| Government Impersonation | 260 | $7.1 million |
Source: FBI IC3 2025 Annual Report, pp. 41–42 (primary).
Three documented AI fraud vectors operating at scale in 2025:
Voice cloning. Criminals harvest voice samples from social media to impersonate family members in distress (“grandparent scam”) or executives authorizing wire transfers. The FBI documented BEC cases in 2025 in which voice cloning was the identified impersonation method — a shift from email-based BEC to phone-based impersonation.
Deepfake video. Companies in Hong Kong, the UK, and the US reported employees authorizing transfers after video calls with apparent executives later confirmed to be AI-generated synthetic faces. The FBI’s IC3 formally documented deepfake interviews in employment fraud for the first time.
LLM-generated phishing. Prior to late 2023, phishing emails were frequently identifiable by grammatical errors and generic language. By 2025, AI-generated phishing content is indistinguishable from legitimate communications by standard filtering methods — the direct causal mechanism behind phishing’s 208% loss surge despite flat complaint volume.
According to Axis Intelligence Research’s cross-source estimate, if 15% of the $7.228 billion in crypto investment fraud involved AI tools — a conservative floor given documented AI deployment at scam compounds — implied AI-linked losses would exceed $1.08 billion, roughly 21% above the FBI’s officially attributed figure. This is a directional estimate with significant uncertainty; it is not a verified total.
Elder Fraud — The Highest-Loss Demographic
Americans aged 60 and older filed 201,266 complaints with the FBI in 2025 — 20% of all IC3 complaints — and reported $7.748 billion in losses, a 59% increase from $4.866 billion in 2024. Their average reported loss of $38,500 is 86% above the overall IC3 average of $20,699.
| Elder Fraud Metric | 2025 | 2024 | YoY |
|---|---|---|---|
| Total complaints (60+) | 201,266 | 146,947 | +37.0% |
| Total losses (60+) | $7.748 billion | $4.866 billion | +59.2% |
| Average loss per victim | $38,500 | ~$33,100 | +16.3% |
| Complainants losing >$100K | 12,444 | Not disclosed | — |
| Crypto losses (60+) | $4.347 billion | $2.839 billion | +53.1% |
| AI-attributed losses (60+) | $352 million | N/A | — |
Source: FBI IC3 2025 Annual Report, pp. 44–50 (primary).
According to Axis Intelligence Research, the 60+ cohort accounts for 37.1% of all IC3-tracked losses despite representing 20% of complainants — a concentration ratio of 1.86×, meaning older victims lose money at nearly twice the rate per complaint relative to the broader population. Within cryptocurrency specifically, 60+ victims filed 24.5% of crypto-related complaints but absorbed 38.2% of crypto-related losses ($4.347B), with an average crypto loss per complaint of $102,812 — nearly double the overall crypto average of $62,604.
| Crime Type | 60+ Losses | % of IC3 Category Total |
|---|---|---|
| Investment | $3.519 billion | 40.7% |
| Tech / Customer Support | $1.041 billion | 48.8% |
| Confidence / Romance | $584 million | 62.8% |
| Business Email Compromise | $568 million | 18.6% |
| Government Impersonation | $413 million | 51.7% |
| Cryptocurrency (descriptor) | $4.347 billion | 38.2% |
Source: FBI IC3 2025 Annual Report, pp. 46, 55 (primary). “% of IC3 Category Total” calculated by Axis Intelligence Research.
The Gold Courier scam — criminals posing as government officials directing victims to withdraw cash or precious metals and hand them to a courier — generated approximately $311.8 million in losses from roughly 725 complaints in 2025. The average loss per Gold Courier complaint: $430,069. This is the highest per-incident average of any fraud sub-type in the 2025 IC3 data, and it is concentrated almost exclusively in the 60+ demographic. Victims are instructed to keep the transaction secret from family members, a social engineering technique specifically designed to prevent intervention.
The FFKC processed 642 fraud incidents involving seniors in 2025, freezing approximately $32.8 million of $65.3 million in reported losses — a 50% recovery rate for elder FFKC cases, below the 58% overall rate, reflecting the complexity of fraud schemes targeting older adults.
Cryptocurrency Fraud — 54.4% of All IC3 Losses
Cryptocurrency was involved in 181,565 IC3 complaints in 2025, a 21% increase from 2024, generating $11.366 billion in losses — 54.4% of all IC3-tracked losses. More than half of every dollar lost to reported online fraud in the US in 2025 involved cryptocurrency somewhere in the transaction chain.
| Cryptocurrency Fraud Metric | 2025 | 2024 | YoY |
|---|---|---|---|
| Complaints with crypto nexus | 181,565 | 150,386 | +20.7% |
| Losses with crypto nexus | $11.366 billion | $9.300 billion | +22.2% |
| Average loss per crypto complaint | $62,604 | $61,840 | +1.2% |
| Complainants losing >$100K | 18,589 | ~15,800 | +17.6% |
| 60+ crypto losses | $4.347 billion | $2.839 billion | +53.1% |
Source: FBI IC3 2025 Annual Report, pp. 52–57 (primary).
Crypto ATM / kiosk fraud accelerated sharply: 13,460 complaints generated $389 million in losses in 2025, a 58% loss increase despite only a 23% complaint increase. The average loss per crypto ATM complaint ($28,900) sits well below the overall crypto average — but the frequency of targeting has accelerated, suggesting organized campaigns specifically deploying these machines.
Recovery scams compound primary victimization. After someone loses money to crypto investment fraud, a second wave of criminals approaches with offers to recover lost funds for a fee. In 2025, 10,516 recovery scam complaints generated $1.4 billion in additional losses, with the 60+ age group losing $540 million in this secondary fraud.
Scammers choose payment methods by fraud type. Cryptocurrency dominates investment fraud. Wire transfer and ACH dominate BEC (86% of BEC losses). Gift and prepaid cards appear disproportionately in government impersonation and extortion. Cash is rare but concentrated in Gold Courier incidents. The FBI’s IC3 tracks these transaction patterns specifically to support FFKC interventions.
How Is Fraud Money Recovered? The FFKC Data
The FBI’s Financial Fraud Kill Chain (FFKC), operated by the IC3 Recovery Asset Team (RAT), is the primary mechanism for freezing fraudulent transfers before they dissipate into the global financial system. In 2025, the FFKC processed 3,900 incidents involving $1.163 billion in attempted theft, successfully freezing $679 million — a 58% overall success rate.
The critical variable is time. Once a wire transfer lands in a recipient account, funds are typically converted to cryptocurrency or moved through correspondent banks within hours. The FFKC’s window for intervention is narrow: victims who file an IC3 complaint within 72 hours of a fraudulent transfer give investigators a realistic chance of freezing funds; those who delay past three to five business days rarely recover anything.
| FFKC Performance Metric | 2025 |
|---|---|
| Total FFKC incidents | ~3,900 |
| Total fraud value attempted | $1.163 billion |
| Total funds frozen | $679 million |
| Overall success rate | 58% |
| Healthcare sector success rate | 65% |
| Critical infrastructure overall success rate | 56% |
| Defense Industrial Base success rate | 100% |
| Water / Waste Systems success rate | 92% |
| Elder Fraud FFKC incidents | 642 |
| Elder Fraud frozen / attempted | $32.8M / $65.3M |
| Elder Fraud recovery rate | 50% |
| Critical infrastructure FFKC incidents | 655 |
Sources: FBI IC3 2025 Annual Report (primary); Decision & Law analysis of IC3 2025 report, April 2026 (sector success rates derived from IC3 report charts). All figures from IC3 report; sector-specific rates from pp. 11–13.
According to Axis Intelligence Research, the variance in FFKC success rates by sector is analytically significant. Defense Industrial Base reaching 100% reflects a combination of higher complaint quality (BEC in defense typically triggers immediate internal detection), stronger banking relationships, and faster executive escalation. Elder Fraud’s 50% rate — below the 58% overall — reflects delays caused by victim embarrassment, reluctance to report to family, and the Gold Courier scam’s explicit instruction to keep the fraud secret.
The 2024 IC3 Annual Report recorded a 66% FFKC success rate from 3,020 incidents and $848.4 million in attempted theft. The 2025 rate of 58% represents a decline despite more interventions and higher dollar volume — consistent with criminals adapting their transaction architectures to exploit FFKC timing constraints.
Phishing — High Volume, Surging Value
Phishing and spoofing remained the most frequently reported crime type to the FBI in 2025, with 191,561 complaints — nearly identical to the 193,407 logged in 2024. What changed dramatically was the financial harm.
| Phishing Metric | 2025 | 2024 | YoY |
|---|---|---|---|
| Complaints | 191,561 | 193,407 | −1.0% |
| Losses | $215.8 million | $70.0 million | +208% |
| Average loss per complaint | $1,127 | $362 | +211% |
Source: FBI IC3 2025 Annual Report, p. 26 (primary).
A near-flat complaint count combined with a tripling of losses per incident has no adequate explanation in the IC3 report. According to Axis Intelligence Research, this pattern is structurally consistent with a shift from high-volume, low-value credential harvesting toward lower-volume, high-value spear-phishing — the exact pattern that PhaaS platforms and AI-generated targeting enable. When a phishing attack is personalized to a specific executive, uses cloned voice in a follow-up call, and arrives in a thread with the target’s real email history, the success rate climbs and so does the loss per incident.
The IC3 also flagged account takeover cases involving more than 50 simultaneous ACH transactions across multiple banks — a level of operational complexity that makes real-time recovery nearly impossible.
Ransomware — What the Numbers Don’t Show
The FBI logged 3,611 ransomware complaints in 2025 with reported losses of $32.3 million — a 259% loss increase from $12.5 million in 2024. These figures almost universally circulate without the FBI’s explicit caveat: ransomware loss figures “do not include estimates of lost business, time, wages, files, or equipment, or any third-party remediation services.”
The $32.3 million represents ransom payments reported through IC3. IBM’s Cost of a Data Breach 2024 Report found average total ransomware breach cost — including operational disruption, forensics, and remediation — at $4.88 million per incident. Applying that to IC3’s 3,611 complaints implies a true total cost of approximately $17.6 billion — roughly 545 times the IC3 figure.
This is an Axis Intelligence Research cross-source derivation. The $17.6 billion should be treated as an order-of-magnitude illustration, not a verified total.
| Ransomware Metric | 2025 | 2024 | 2023 |
|---|---|---|---|
| IC3 complaints | 3,611 | 3,156 | 2,825 |
| IC3 reported losses | $32.3 million | $12.5 million | $59.6 million |
| New variants identified | 63 | ~40 | ~38 |
| New variants per month (implied) | 5.25 | 3.3 | 3.2 |
| Top variants | Akira, Qilin, INC/Lynx | LockBit, BlackCat | LockBit, ALPHV |
Source: FBI IC3 2025 Annual Report, pp. 13–16 (primary).
Healthcare and Public Health was the most-targeted critical infrastructure sector for ransomware in 2025, with 460 attacks and 182 data breaches. Five new ransomware variants per month — including Akira, Qilin, Ransomhub, LockBit, and Medusa — targeted critical manufacturing, healthcare, and government facilities. BlackSuit (Royal) specifically targeted critical infrastructure including manufacturing, government, healthcare, and commercial facilities.
Online Fraud Losses by US State — Per Capita Analysis
Absolute state rankings (California first at $3.67B, Texas second at $1.83B) reflect population more than fraud intensity. The analytically useful metric is losses per 100,000 residents.
| Rank | State | Losses per 100K Residents | Notes |
|---|---|---|---|
| 1 | District of Columbia | $14,037,165 | Outlier — highest fraud reporting density |
| 2 | California | $9,337,282 | Highest absolute losses ($3.67B) |
| 3 | Nevada | $9,208,347 | High crypto-hub exposure |
| 4 | Arizona | $8,272,766 | High 60+ population |
| 5 | Hawaii | $7,429,222 | — |
| 6 | New Jersey | $6,916,601 | — |
| 7 | Florida | $6,802,930 | High 60+ population |
| 8 | Rhode Island | $6,456,625 | — |
| 9 | Maryland | $6,228,591 | — |
| 10 | New York | $6,130,795 | — |
Source: FBI IC3 2025 Annual Report, pp. 30–31 (primary). Per-capita calculation: Axis Intelligence Research using 2024 US Census state population estimates.
According to Axis Intelligence Research, states with both high per-capita fraud loss and large 60+ populations — Arizona, Florida, Nevada — represent the confluence of two amplifying risk factors: crypto investment fraud targeting (concentration of active digital investors) and tech support/government impersonation targeting (concentration of high-asset older adults). These two fraud types are the ones most disproportionately harmful to older demographics.
Oregon presents a specific anomaly: it ranks 27th in absolute losses ($193M) but 5th in statewide cryptocurrency losses ($545.9 million), indicating a concentration of high-value crypto investment fraud cases disproportionate to its population and overall fraud footprint. This pattern does not appear in any federal agency publication and is an original Axis Intelligence Research observation.
Methodology
Data collection. Axis Intelligence Research assembled all figures from primary sources fetched during the July 2026 production session. Primary sources:
- FBI IC3 2025 Annual Report (ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) — published April 7, 2026; covers calendar year 2025.
- FTC Consumer Sentinel 2025 — figures cited from FTC Congressional testimony before the Joint Economic Committee (March 25, 2026); FTC Data Spotlight on Imposter Scams (June 15, 2026); FTC Data Spotlight on Social Media Fraud (April 6, 2026). The full 2025 Consumer Sentinel Data Book was not formally published as of this article’s last-updated date.
- IBM Cost of a Data Breach 2024 Report — used for ransomware true-cost cross-source derivation only; clearly labeled as an estimate.
What Axis Intelligence Research measures. Reported losses only — what victims voluntarily submitted to US federal reporting systems. The FBI IC3 and FTC Consumer Sentinel receive overlapping but non-identical sets of reports.
What we do not measure. Axis Intelligence does not conduct instrumented tests, direct victim surveys, or independent audits. Our original contributions — the FSI™, the cross-source loss derivations, the state per-capita calculations, and the FFKC analysis — are derived metrics computed from published primary data with disclosed methodology.
Limitations:
- IC3 and FTC data represent reported incidents only; the FTC’s own research cites a 4.8% mass-market reporting rate.
- FBI IC3 ransomware loss figures explicitly exclude indirect costs; the $17.6B cross-source estimate is an illustrative order-of-magnitude figure.
- FTC 2025 Consumer Sentinel full Data Book not yet published as of July 17, 2026; figures come from pre-publication FTC releases.
- AI-attribution in IC3 data depends on victims or investigators identifying AI involvement; the 22,364-complaint, $893M figure is a floor.
- The 2025 government shutdown created a reporting gap in FTC data during the affected period.
- FSI™ scores reflect reported data only; ransomware scores understate real-world severity (see FSI note above).
About This Dataset
Title: Online Fraud Statistics 2026 — Axis Intelligence Research Dataset Coverage: United States federal fraud reporting data, 2020–2025 Primary sources: FBI IC3 Annual Report 2025; FTC Consumer Sentinel 2025 (pre-book); IBM Cost of a Data Breach 2024 Derived metrics: Axis Intelligence FSI™; cross-agency combined loss total; per-capita state rankings; FFKC recovery analysis; AI-implied loss estimate License: Creative Commons Attribution 4.0 International (CC BY 4.0). Share and adapt freely with attribution.
Citation format:
APA: Axis Intelligence Research, & Chen, M. (2026, July 17). Online Fraud Statistics 2026. Axis Intelligence. https://axis-intelligence.com/online-fraud-statistics/
MLA: Axis Intelligence Research and Marcus Chen. “Online Fraud Statistics 2026.” Axis Intelligence, 17 July 2026, axis-intelligence.com/online-fraud-statistics/.
Chicago: Axis Intelligence Research and Marcus Chen. “Online Fraud Statistics 2026.” Axis Intelligence. July 17, 2026. https://axis-intelligence.com/online-fraud-statistics/.
Copy this citation block to attribute this research in your work.
Frequently Asked Questions
How much money is lost to online fraud each year in the US?
In 2025, Americans reported $20.877 billion in losses to the FBI’s IC3 and $15.9 billion to the FTC’s Consumer Sentinel — two partially overlapping federal datasets. The true total is substantially higher: the FTC’s own research indicates fewer than 5% of mass-market fraud victims ever file a federal report.
What is the most common type of online fraud by complaint volume?
Phishing and spoofing, with 191,561 FBI IC3 complaints in 2025. By financial damage, investment fraud is the most destructive at $8.648 billion — 41% of all IC3-tracked losses from a single category.
What percentage of online fraud losses are recovered?
The FBI’s FFKC recovered $679 million of $1.163 billion in 2025 fraud attempts — a 58% success rate. But this applies only to fraud caught within the FFKC window (typically within 72 hours of a wire transfer). The vast majority of fraud losses are permanent. Recovery rates drop sharply with any delay in reporting.
Which age group loses the most money to online fraud?
Americans aged 60 and older reported $7.748 billion in losses in 2025 — 37.1% of all IC3-tracked losses — at an average of $38,500 per victim, compared to the overall average of $20,699. The Gold Courier scam, which almost exclusively targets this group, averages $430,069 per complaint.
How does fraud money move — and why is it hard to recover?
The FBI tracks seven primary transaction types: cryptocurrency, wire transfer/ACH, debit/credit card, peer-to-peer, gift/prepaid cards, check/cashier’s check, and cash. Investment fraud overwhelmingly uses cryptocurrency; BEC uses wire transfer (86%). Cryptocurrency transactions are irreversible and near-instant, which is why crypto losses rarely recover. Wire transfers have a short recapture window: once funds move to a second bank or convert to crypto, recovery probability drops toward zero.
What is the Axis Intelligence Fraud Severity Index™?
The FSI™ is a proprietary composite metric developed by Axis Intelligence Research to enable cross-category fraud severity comparisons that federal agencies do not publish. It weights each fraud category by reported financial loss, complaint volume, and year-over-year loss growth rate — each normalized on a 0–100 scale and averaged. Investment/Crypto leads with 97; Government Impersonation scores 81 on the back of near-doubling losses. The FSI is an Axis Intelligence original metric recalculated quarterly; it does not appear in any government publication.
Is AI making online fraud worse?
Yes, and measurably. The FBI formally tracked AI in fraud for the first time in 2025, logging $893 million in attributed losses. Three documented AI mechanisms are driving harm: voice cloning (impersonating executives or family members for wire transfers), deepfake video (fake executive video calls authorizing fraudulent payments), and LLM-generated phishing (indistinguishable from legitimate communications). The 208% surge in phishing losses despite flat complaint volume is consistent with AI-enabled targeting enabling higher per-attack success.
What should I do if I become a victim of online fraud?
Report immediately to the FBI at ic3.gov and simultaneously contact your financial institution to request a recall of any wire transfer. Include all transaction details — recipient account, bank name, routing number, transaction ID, and dollar amount — in the complaint. Speed is everything: the FFKC’s 58% success rate applies to cases reported within 72 hours. Delays of more than three to five business days reduce recovery probability to near zero. Also report to the FTC at reportfraud.ftc.gov. If the fraud involved a government impersonator, report to the relevant agency directly (IRS: irs.gov/scams, SSA: ssa.gov/fraud).
Which US states have the highest online fraud losses per capita?
The District of Columbia ($14.0M per 100K residents), California ($9.3M), Nevada ($9.2M), and Arizona ($8.3M) lead on per-capita fraud losses, per FBI IC3 data. Arizona, Florida, and Nevada’s elevated intensity reflects the compounding of two risk factors: large 60+ populations (targets of tech support and investment fraud) and high crypto-platform engagement. Oregon is a notable outlier: it ranks 27th in absolute losses but 5th in cryptocurrency losses — a concentration pattern that does not appear in any federal report and is an original Axis Intelligence Research finding.
What is Business Email Compromise and how does it differ from phishing?
BEC is a targeted, high-value fraud in which criminals impersonate executives, vendors, or attorneys via email to trick employees or individuals into authorizing fraudulent wire transfers. In 2025, BEC generated $3.047 billion from 24,768 complaints — an average of $122,955 per incident. Phishing generated $215.8 million from 191,561 complaints — an average of $1,127. BEC is precision, phishing is scale. BEC losses travel almost entirely by wire transfer (86%); phishing losses are more diffuse. BEC is the primary trigger for FFKC interventions; phishing credentials often enable BEC by giving criminals access to legitimate email accounts.
How does the FBI track and disrupt fraud?
The FBI’s IC3 Recovery Asset Team (RAT) operates the Financial Fraud Kill Chain — a rapid-response network coordinating with US and international banks to freeze fraudulent transfers. In 2025, it handled 3,900 FFKC incidents, freezing $679 million. The FBI also ran Operation Level Up, proactively identifying 3,780 crypto investment fraud victims and alerting them before final transfers — saving an estimated $225.9 million, with 78% of those victims unaware they were being scammed at the time of contact. Report all suspected fraud at ic3.gov; include complete transaction details and act within 72 hours for the best recovery chance.