The FBI Says Americans Lost $17.6 Billion to Cyber Fraud Last Year—Business Email Scams Were the Second Biggest Driver

Record Breaking Losses Across the Board

The FBI's Internet Crime Complaint Center received 1,008,597 complaints in 2025, with reported losses reaching $17.6 billion. That is a significant jump from the $16.6 billion reported in 2024, continuing a trend that has seen cybercrime losses climb every year for the past decade.

Cyber enabled fraud accounted for 85% of all reported losses and 45% of total complaints. Investment fraud led the pack at $8.6 billion, but the second largest category tells a story that should concern every organization with an email inbox.

Business Email Compromise: $3 Billion and Climbing

Business email compromise scams accounted for over $3 billion in losses during 2025. These attacks target organizations by impersonating executives, vendors, or partners through compromised or spoofed email accounts, then directing employees to wire funds or share sensitive data.

The FBI's numbers confirm what security researchers have been warning about: BEC attacks are becoming more sophisticated. Threat actors now use AI generated phishing emails to draft highly credible messages at a scale and speed previously unachievable by humans. According to the 2025 Association for Financial Professionals survey, 63% of treasury practitioners cited BEC as the number one avenue for payment fraud attempts.

These are not crude Nigerian prince emails. Modern BEC attacks involve extensive reconnaissance, careful timing around financial transactions, and messages that are nearly indistinguishable from legitimate business communications.

AI Powered Fraud Enters the Data

For the first time, the IC3 report tracked AI related complaints as a distinct category. The numbers are already alarming: approximately 22,000 complaints involving AI were filed in 2025, totaling $893 million in losses.

AI tools allow attackers to efficiently scour the internet for personal information relevant to a target, generate convincing voice clones for phone scams, and craft phishing emails with technically perfect prose. The barrier to entry for sophisticated fraud has dropped dramatically.

Ransomware: Fewer Attacks, Higher Stakes

The IC3 identified 63 new ransomware variants in 2025 and received 3,611 ransomware complaints tied to more than $32 million in reported losses. That is up from 3,156 complaints and $12 million in 2024, nearly tripling the dollar amount in a single year.

The FBI is actively investigating more than 200 ransomware variants, actors, and enablers. Fourteen of 16 U.S. critical infrastructure sectors experienced ransomware attacks in 2025, including hospitals, emergency responders, schools, and city governments.

FBI Cyber Division Section Chief Taushiana Bright put it bluntly: "Cybercriminals have indiscriminately attacked hospitals, emergency responders, schools and entire city governments."

Seniors Bear the Heaviest Burden

Americans over 60 filed 201,266 complaints linked to $7.7 billion in losses, making them the most financially impacted age group by a wide margin. That single demographic accounts for nearly 44% of all reported losses.

Tech support fraud, which cost victims $2.1 billion overall, disproportionately targets older adults through fake virus warnings, phishing emails, and fraudulent customer service calls. These scams exploit trust and unfamiliarity with technology to convince victims they need immediate help that requires payment or remote access to their computers.

Cryptocurrency as a Vehicle for Theft

Cryptocurrency was cited in losses totaling more than $11.3 billion across multiple crime categories. The decentralized and often irreversible nature of crypto transactions makes it the preferred vehicle for investment fraud, ransomware payments, and money laundering.

Texas led all states with 97,912 complaints, followed by California and Florida. The geographic concentration suggests that population density and the prevalence of online financial activity are key factors in victimization rates.

What You Can Do

The IC3 report is a reminder that cybercrime is not a niche problem. It is a $17.6 billion industry that touches every sector and every age group. Here are concrete steps to reduce your risk:

• Enable multi factor authentication on every account that supports it, especially email and financial services
• Verify payment requests through a separate communication channel before wiring funds or changing payment details
• Be skeptical of unsolicited calls or emails claiming to be from tech support, government agencies, or financial institutions
• Report suspicious activity to the FBI's IC3 at ic3.gov
• Use a privacy focused email setup that blocks tracking pixels and reduces your exposure to phishing reconnaissance