FBI Internet Crime Report 2025 - Internet Crime Complaint Center (IC3)

A Quarter-Century of Cybercrime Reporting

In 2025, the FBI Internet Crime Complaint Center (IC3) celebrated its 25th anniversary as the central hub for reporting cyber-enabled crime. This milestone signifies the FBI's enduring commitment to fighting the ever-evolving cyber threat. Our success in protecting individuals and organizations is driven by public participation and robust data analysis.

For the past quarter-century, IC3 has been the primary connection between the FBI and the public for information related to cyber-enabled criminal activity. Since our founding, reporting to IC3 has surged. We received a few thousand complaints per month in our early days. We now average almost 3,000 complaints per day.

IC3 produces annual reports (like the one you are reading) based on the information we receive, publishes public awareness campaigns, and provides industry alerts to the private sector. IC3 remains an essential resource for our law enforcement colleagues in combating cyber-enabled crime.

In 2025, losses reported to IC3 continued to climb, surpassing the $20 billion mark. Investment-related fraud was once again the largest component of these losses, followed by business email compromises and tech support scams. The FBI continues to disrupt and deter malicious cyber actors -- and shift the cost from victims to our adversaries.

One example was Operation Level Up, which countered crypto investment scams. This FBI-led initiative has reduced potential losses by more than $500 million since 2024. It has never been more important to be diligent with your cybersecurity, social media footprint, and electronic interactions. Cyber threats and cyber-enabled crime will continue to evolve as the world embraces emerging technologies such as artificial intelligence.

At the time of publication, the FBI was engaged in Operation Winter Shield, which highlights concrete steps for organizations to bolster their digital security. The FBI remains fully committed to ensuring Americans’ safety online and reinforcing the recent Executive Order targeting cybercrime, fraud, and foreign scam centers, to hold those accountable who exploit the internet for nefarious purposes.

Read full report:

Grok Summary

Overall 2025 Highlights

• Total complaints: 1,008,597
• Total reported losses: $20.877 billion
• Average loss per complaint (where reported): approximately $20,699
• Losses increased 26% from 2024.
• Cyber-enabled fraud accounted for 452,868 complaints (~45% of total) and $17.697 billion in losses (~85% of total losses).

Age group with highest losses: individuals 60+ ($7.7 billion). Highest complaint volume in the 40–49 age range.

Each complaint is assigned one primary crime type. Descriptors (e.g., Cryptocurrency, AI Related) can be applied in addition to the crime type for tracking.

Top Crime Types by Complaint Count (2025)

(Other notable: Credit Card/Check Fraud 18,774; Real Estate 12,368; Advanced Fee 7,762; Lottery/Sweepstakes/Inheritance 5,623; Ransomware 3,611.)

Top Crime Types by Reported Loss (2025)

Cryptocurrency descriptor appeared in 181,565 complaints with $11.367 billion in associated losses. AI Related descriptor appeared in 22,364 complaints with $893 million in associated losses.

Grouped by IC3 Official Definitions (Appendix B)

Below are the primary crime types using the exact or closely paraphrased government definitions from the 2025 report, with 2025 complaint counts and losses where available. Most categories are oriented toward financial or property gain for the perpetrator.

Financial / Investment-Oriented Fraud

• Investment Fraud: Deceptive practice that induces investors to make purchases based on false information. These scams usually offer those targeted large returns with minimal risk (Retirement, 401K, Ponzi, Pyramid, etc.). 72,984 complaints | $8.649 billion
• Business Email Compromise (BEC): Targets businesses or individuals working with suppliers and/or businesses regularly performing wire transfer payments. Fraudsters compromise email accounts and other communication methods through social engineering or computer intrusion to conduct unauthorized transfer of funds. 24,768 complaints | $3.047 billion
• Advanced Fee Fraud: An individual pays money to someone in anticipation of receiving something of greater value in return but instead receives significantly less than expected or nothing. 7,762 complaints | $156 million
• Lottery/Sweepstakes/Inheritance Fraud: An individual is contacted about winning a lottery or sweepstakes they never entered, or to collect on an inheritance from an unknown relative. 5,623 complaints | $194 million
• Real Estate Fraud: Loss of funds from a real estate investment or fraud involving rental or timeshare property. 12,368 complaints | $275 million
• Overpayment: An individual is sent a payment/commission and is instructed to keep a portion of the payment and send the remainder to another individual or business. 2,194 complaints | $23 million

Impersonation & Social Engineering Fraud

• Confidence/Romance Fraud: An individual believes they are in a relationship (family, friendly, or romantic) and are tricked into sending money, personal and financial information, or items of value to the perpetrator or to launder money or items. Includes the Grandparent’s Scheme and schemes that prey on the targeted individual’s “heartstrings.” 23,159 complaints | $929 million
• Government Impersonation: A government official is impersonated to collect or extort money. 32,424 complaints | $798 million
• Tech/Customer Support Fraud: Subject posing as technical or customer support/service. 47,794 complaints | $2.135 billion
• Employment Fraud: An individual believes they are legitimately employed and loses money, or launders money/items during their employment. 24,688 complaints | $363 million
• Charity: Using deception to get money from individuals believing they are making donations to legitimate charities and/or charities representing victims of natural disasters shortly after the incident occurs. 662 complaints | $8 million

Identity, Data & Account Takeover

• Phishing/Spoofing: The use of unsolicited email, text messages, and telephone calls purportedly from a legitimate company requesting personal, financial, and/or login credentials. 191,561 complaints | $216 million
• Identity Theft: Someone wrongfully obtains and uses personally identifiable information in some way that involves fraud or deception, typically for economic gain. 31,675 complaints | $186 million
• Personal Data Breach: A leak/spill of personal data which is released from a secure location to an untrusted environment. Also, a security incident in which an individual’s sensitive, protected, or confidential data is copied, transmitted, viewed, stolen, or used by an unauthorized individual. 67,456 complaints
• SIM Swap: The use of unsophisticated social engineering techniques against mobile service providers to transfer a victim’s phone service to a mobile device in the criminal’s possession. 971 complaints | $17 million
• Credit Card/Check Fraud: Theft and fraud committed using a credit card or any similar payment mechanism (ACH, EFT, recurring charge, etc.) as a fraudulent source of funds in a transaction. 18,774 complaints | $283 million

Extortion, Threats & Harassment

• Extortion: Unlawful extraction of money or property through intimidation or undue exercise of authority. It may include threats of physical harm, criminal prosecution, or public exposure. 89,129 complaints
• Threats of Violence: An expression of an intention to inflict pain, injury, self-harm, or death not in the context of extortion. 4,826 complaints | $10 million
• Harassment/Stalking: Repeated words, conduct, and/or action that serve no legitimate purpose and are directed at a specific person to annoy, alarm, or distress that person. Engaging in a course of conduct directed at a specific person that would cause a reasonable person to fear for his/her safety or the safety of others or suffer substantial emotional distress. 21,557 complaints | $28 million

Cyber Threats / Technical Attacks

• Ransomware: A type of malicious software designed to block access to a computer system until money is paid. 3,611 complaints | $32 million
• Data Breach (cyber context): The use of a computer intrusion to acquire confidential or secure information. (Excludes intrusions targeting personally owned computers/systems or personal accounts.) 3,963 complaints | $435 million
• Malware: Software or code intended to damage, disable, or capable of copying itself onto a computer and/or computer systems to have a detrimental effect or destroy data. 893 complaints | $19 million
• Botnet: A group of two or more computers controlled and updated remotely for an illegal purpose such as a Distributed Denial of Service or Telephony Denial of Service attack or other nefarious activity. 715 complaints | $14 million

Other

• Non-Payment/Non-Delivery Fraud: Goods or services are shipped and payment is never rendered (non-payment). Payment is sent and goods or services are never received, or are of lesser quality (non-delivery). 56,478 complaints | $503 million
• IPR/Copyright and Counterfeit: The illegal theft and use of others’ ideas, inventions, and creative expressions (intellectual property)—everything from trade secrets and proprietary products to movies, music, and software. 2,386 complaints | $27 million
• Other: Criminal or civil matters not currently designated as an IC3 crime type. 20,031 complaints | $512 million

Key Descriptors (Applied in Addition to Crime Type)

• Cryptocurrency: Information reported contains some reference to virtual currency (181,565 complaints; $11.367 billion losses).
• AI Related: Information reported contains a reference to artificial intelligence (22,364 complaints; $893 million losses).
• Crimes Against Children: Related to the sexual abuse/exploitation of children (including when reported by another age group on behalf of a child) — 7,239 complaints; $6.7 million losses.

Do They All Lead to Financial/Property Gains?

The large majority of IC3 crime types are structured around financial or property extraction (investment, BEC, romance/confidence, tech support, government impersonation, advanced fee, non-delivery, employment, real estate, etc.).

A smaller subset focuses primarily on access, data theft, disruption, intimidation, or other harms (certain data breaches, malware, botnets, pure harassment/stalking, threats of violence, some IPR cases).

Even in those cases, financial motives frequently appear as a secondary or parallel goal. Cryptocurrency and AI descriptors cut across many of the financial categories and significantly amplify reported losses.