FBI IC3 2025 Internet Crime Report: Statistics, Losses and What the Data Means

By Ahmet Karaca · Published 20 October 2026 · Sources checked: 20 October 2026

The FBI’s 2025 IC3 Annual Report records 1,008,597 complaints and approximately $20.877 billion in reported losses, a 26% increase in losses from 2024. Investment fraud produced the largest reported loss total; phishing/spoofing led the named crime categories by complaint count. These are statistics from complaints received by the Internet Crime Complaint Center, not a census of all cybercrime or a worldwide loss estimate.

This analysis covers the complete 66-page report, including its definitions and data notes. It brings together the main figures, a downloadable crime-type table, practical guides to the main fraud patterns and the limitations that matter when reusing the numbers. The reporting year is 2025; this page was published and its sources checked on 20 October 2026.

The headline figures, with their proper scope

Source: FBI IC3 2025 Annual Report, pages 6–9, 39, 44 and 61–62. The overlapping rows must not be added together. For example, an investment complaint can also contain cryptocurrency and AI references and be filed by someone aged 60 or older.

Which crime types produced the largest reported losses?

The ranking answers a loss question, not a frequency question. Investment fraud accounted for $8,648,617,756, followed by business email compromise at $3,046,598,558 and tech/customer support at $2,134,675,818. By contrast, phishing/spoofing had the largest named complaint count, 191,561, but a lower directly classified loss total. A complaint classified as investment or business email compromise may have begun with an impersonation or phishing message.

A company planning controls should therefore consider both the entry method and the value at risk. An invoice change can involve a single large transfer; a phishing campaign can generate many reports without a recorded payment. Neither a low complaint count nor a low classified loss figure establishes that an incident is harmless.

Downloadable crime-type statistics

The following table transcribes all 26 named crime-type rows published on pages 7–8, ordered by reported loss. Counts remain whole numbers and loss amounts remain exact US-dollar integers. The table is a compilation of those pages, not an independent survey. It does not include the report’s separate descriptor rows or provide an additive reconciliation to the headline complaint count.

Download the 2025 IC3 crime-type statistics as CSV. Fields: report year, crime type, complaint count, reported loss in USD, source page for each measure and original report URL. No estimated missing values or conversions have been added.

Six distinctions that prevent misleading statistics

A complaint is not necessarily a unique victim

Appendix C says a complainant may file more than once, creating possible duplicate complaints, while losses are de-duplicated as far as possible. A complaint count must not be rewritten as an exact number of different people. The person filing can also be reporting on someone else’s behalf.

Crime types and descriptors perform different jobs

Each complaint has one primary crime type. Cryptocurrency, AI-related information and crimes against children are descriptors applied after the crime type is selected. The report defines cryptocurrency by a reference to virtual currency and AI by a reference to artificial intelligence. The $11.367 billion cryptocurrency-nexus total is not proof that every dollar moved on a blockchain; the AI total is not a measurement of loss caused exclusively by AI.

Age tables exclude missing ages

Providing an age range is optional. Age-group totals can consequently be smaller than the overall total. “Under 20” also differs from “17 or younger”, which the report treats in a separate section. A higher loss total among older complainants does not alone establish a higher probability of victimisation per resident.

Ransomware losses exclude substantial costs

The report records $32,320,105 in ransomware losses, but Appendix C excludes estimates such as lost business, time, wages, files, equipment and third-party remediation. Some entities report no amount; reports made directly to field offices are outside this IC3 measure. The figure must not be presented as the total cost of ransomware to businesses.

Location is based on supplied information

The report received complaints from more than 200 countries. Its international table lists Turkey with 944 complaints, while nearly $1.6 billion of overall losses is associated with international complaints. Those figures do not measure the nationality or location of offenders. State rankings likewise depend on reported location and, for per-capita comparisons, the population denominator specified in the report.

Reported growth is a change in recorded losses

The 26% headline increase compares losses recorded in the report with the prior year. It should not be rewritten as a 26% increase in every person’s risk or in all criminal activity. Changes in reporting, classification and the size of particular incidents can affect the series. Appendix C describes the statistics as a point-in-time assessment that can evolve.

What the 58% Financial Fraud Kill Chain figure actually means

Page 17 reports 3,900 initiated Financial Fraud Kill Chain incidents involving $1,163,919,846 in attempted theft and $679,013,183 frozen. The report calls this a 58% success rate. The relationship is approximately frozen dollars divided by attempted-theft dollars in that selected incident set.

It is not a 58% refund rate for all victims or a personal recovery forecast. A freeze, seizure, forfeiture, remission and final payment to a victim are different events. Likewise, the report’s Operation Level Up figure concerns estimated losses prevented, not money returned after a theft. Anyone evaluating a recovery proposal should ask precisely which stage and denominator the claimed result describes.

Source inconsistencies worth preserving

Two differences inside the supplied report matter for precise reuse. Page 53 prints crypto investment losses as $7.228 billion; page 55 gives $7,277,868,919 against the same 61,559 complaints. The 60+ tech-support figures also differ between the current-year tables on pages 45–46 and the three-year comparison on pages 47–48: 21,333/$1,040,730,043 versus 21,334/$1,040,879,243. The adjacent threats-of-violence figures move in the opposite direction by one complaint and $149,200.

These observations do not establish which value is correct. We retain the source references and do not silently repair the publication. The downloadable table above uses only the overall crime-type tables on pages 7–8, which are unaffected by those particular discrepancies. A future FBI correction would be a reason to update the affected figures and record the change.

Find the guide for the incident you are dealing with

The appropriate next step depends on how the incident occurred, which records exist and where money or account access can still be protected. The following guides apply the report’s findings to distinct practical problems; they do not turn aggregate statistics into promises of recovery.

• Crypto Investment Scams: Fake Profits, Withdrawal Fees and the Evidence That Matters
• Business Email Compromise: Invoice Fraud, Payment Recall and Evidence Preservation
• AI, Deepfake and Voice-Cloning Fraud: How to Verify Requests and Preserve Evidence
• Elder Fraud: Tech Support, Government Impersonation and Gold Courier Scams
• Online Job and Task Scams: Why Paying to Unlock Earnings Is a Warning Sign
• Sextortion: Responding to Threats, Preserving Evidence and Reporting Abuse
• Ransomware Response: Preserve Evidence, Record Losses and Assess Payment Risks
• Crypto ATM and QR-Code Scams: Stop the Transfer and Preserve the Payment Trail
• Crypto Recovery Scams: Fake Law Firms, Impersonated Authorities and Advance Fees
• Reporting Cyber Fraud to IC3 from Outside the United States: A Practical Guide
• Phishing and Account Takeover: Fake Bank Support, Stolen Codes and the Evidence Trail
• Romance Scams: Money Requests, Investment Pitches and Evidence of Deception
• Social Media Investment Clubs: Fake Experts, Stock Manipulation and Evidence
• Law Firm Data Theft and Extortion: Responding When Files Are Stolen Without Encryption
• NFT Airdrop and Wallet Phishing Scams: Links, Approvals and Seed-Phrase Theft

Sources, method and update policy

Primary source: FBI, 2025 IC3 Annual Report, all 66 pages, particularly pages 7–8 for the downloadable data and Appendices B–C, pages 59–62, for definitions and method. The uploaded copy was compared with the official PDF on 20 October 2026 and matched byte for byte. All amounts in the compilation are US dollars. The annual report concerns complaints and their adjusted descriptions; allegations and classifications are not individual court findings.

The practical guides use additional official FBI, IC3 and other primary guidance where needed and identify those sources on each page. The selection of incident types and the evidence frameworks are PEGA’s editorial analysis. PEGA is not affiliated with the FBI or IC3. This resource should be revisited if the FBI replaces or corrects the report or issues guidance materially changing a described response.