Cybercrime in America 2025: Inside the FBI's $20.9 Billion Record, and How to Report It

In 2025, Americans reported losing a record $20.9 billion to online crime, and for the first time the FBI's complaint center took in more than a million reports in a single year. The headline number is staggering, but the more useful story is underneath it: where the money actually goes, who loses the most, and what the United States does, and does not do, to get it back. This is the FBI's 2025 Internet Crime Report, decoded, and a plain guide to how reporting and recovery really work.

A record year, and what it really measures

The FBI's Internet Crime Complaint Center, known as IC3, is the central place Americans report online crime. Its 2025 annual report logged 1,008,597 complaints and $20.877 billion in reported losses, a 26 percent jump from $16.6 billion the year before. The average reported loss per complaint was $20,699.

One number frames everything that follows: these are reported losses. As the section on under-reporting below shows, they are widely understood to be a fraction of the true total. The IC3 figure is best read not as the full scale of US cybercrime, but as the clearest annual snapshot of which crimes are growing and where the money flows.

Where the money is actually lost

Losses are wildly uneven across crime types. A single category, investment fraud, accounts for more than its share of every other category combined, while the crimes people fear most are not always the ones that drain the most money.

Two things stand out. First, investment fraud is the single largest driver by a wide margin, and most of it is crypto-based. Second, the crimes that generate the most complaints are different from the ones that generate the most losses: phishing and spoofing led by volume with 191,561 complaints, followed by extortion at 89,129, even though those categories sit far lower in dollar terms. High-loss crimes like BEC are comparatively rare but devastating per victim: BEC produced over $3 billion from just 24,768 complaints.

The crypto engine

Cryptocurrency is now the central rail of high-value fraud. The 2025 report tracked $11.4 billion in crypto-related losses across 181,565 complaints. The largest single slice is crypto investment fraud, at $7.2 billion, which the FBI calls the highest source of financial losses to Americans in 2025.

Most of that is the long-con romance-and-investment hybrid better known as pig-butchering investment scams: a stranger builds trust over weeks, then steers the victim into a fake crypto platform that shows fictional gains until the money is gone. Because crypto transfers are fast and hard to reverse, recovery is far less likely than with a bank wire, which is exactly why this category dominates the losses.

The elder-fraud crisis

No group is hit harder in dollar terms than older Americans. People aged 60 and over filed 201,266 complaints and reported $7.7 billion in losses, with an average loss of $38,500 and 12,444 victims losing more than $100,000 each.

The losses rose 59 percent year on year while complaints rose 37 percent, meaning older victims are not only being targeted more often, they are losing more each time, a pattern driven by investment and tech-support scams that escalate over time.

AI arrives in the data

For the first time, the 2025 report broke out AI-enabled crime as its own descriptor: 22,364 complaints and $893 million in losses. That covers deepfaked executives in BEC, cloned voices in family-emergency scams, and AI-generated personas in romance fraud. The dollar figure is still small next to investment fraud, but it is a baseline that is widely expected to climb fast, and it is why AI voice-cloning scams are now a mainstream threat rather than a novelty.

The geography of loss, at home and abroad

Losses cluster where wealth and population do. California alone reported $3.67 billion in losses, more than the next two states combined.

The report also counts complainants outside the United States, a reminder that IC3 is a global reference point. The top foreign countries by complaints were Canada (7,479), India (5,879), Japan (5,764), the United Kingdom (4,106) and Germany (3,056). If you are reading this from one of those countries, your own national channels matter more for recovery, which is covered in the comparison below.

How US reporting actually works: who handles what

The most common mistake American victims make is reporting to the wrong place, or to only one place. There is no single hotline. Four channels matter, and serious cases should use more than one.

For the full step-by-step, including what details to gather before you file, see our US reporting and recovery guide.

What happens after you file: the Recovery Asset Team

Filing with IC3 is not just record-keeping. It can claw money back. The FBI's Recovery Asset Team, working through a process called the Financial Fraud Kill Chain, contacts the receiving bank to freeze fraudulent transfers before the money is withdrawn or moved on.

The formal kill chain for international wires is triggered when a transfer is $50,000 or more, sent internationally, reported within 72 hours, and a SWIFT recall has been initiated. In practice the team also runs a domestic process: of its 3,900 cases in 2025, 3,574 were domestic. The lesson for victims is simple: report immediately, regardless of the amount. Speed, not size, decides whether the money can be frozen.

When the bank must pay you back, and when it will not

The single most important thing for an American victim to understand is the line between an unauthorized transfer and an authorized one, because US law treats them completely differently.

Under Regulation E (the Electronic Fund Transfer Act), if someone else moves money out of your account without permission, your liability is capped, provided you report it in time:

1. Report within 2 business days of learning of the loss, and your maximum liability is $50.
2. Report after 2 days but within 60 days of the statement, and it rises to $500.
3. Wait beyond 60 days and you can be liable for the full amount.

The catch is enormous: Regulation E covers unauthorized transfers, not payments you were tricked into sending yourself. If a scammer cons you into wiring money or sending it over a payment app, that is an "authorized" payment in legal terms, even though you were deceived, and the bank is generally not required to refund it. This authorized-payment gap is where most romance, investment and impersonation victims fall, and it is the sharpest difference between the US and some other countries.

The biggest number is the one that is missing

Every figure above understates reality, because most fraud is never reported. The FTC has estimated that true US consumer fraud losses reached $158.3 billion in 2023, against roughly $10 billion reported that year. Separate analysis based on federal victimization data suggests only about 14 percent of fraud victims report the crime at all, deterred by shame, small amounts, or simply not knowing where to go. Both the FBI and FTC state plainly that their published totals are a fraction of the truth. The honest reading of the record $20.9 billion is that it is the visible tip of a far larger problem.

America versus the world

How the US handles recovery looks very different next to other countries, especially on the authorized-payment gap above.

The pattern is clear. The US is strong at freezing money quickly when a transfer is unauthorized or caught in the first hours, but unlike the UK it offers no guaranteed refund for victims who were manipulated into paying. Speed of reporting is therefore everything.

Watch: how to report fraud in the US

This short official walkthrough from the Federal Trade Commission shows how to file a report at reportfraud.ftc.gov.

If you are a US victim: the first hour

1. Call your bank immediately. Ask them to recall or freeze the transfer. Minutes matter more than anything else.
2. File with the FBI at ic3.gov. Include every detail: account numbers, wire information, the timeline. This is what feeds the Recovery Asset Team.
3. Report to the FTC at reportfraud.ftc.gov and to your local police for a case number.
4. Know your Regulation E rights. If the transfer was unauthorized, notify the bank in writing within 2 business days to cap your liability at $50.
5. Preserve everything. Keep messages, receipts, screenshots and contact details for investigators.

Frequently asked questions

What is IC3? The FBI's Internet Crime Complaint Center, at ic3.gov, the central place Americans report online crime. Reports feed investigations and the Recovery Asset Team's fund-freeze process.

Will I get my money back if I report fast? Sometimes. If the transfer was unauthorized or can be frozen at the receiving bank within hours, recovery is possible. In 2025 the Recovery Asset Team froze $679 million, a 58 percent success rate on the cases it took. Crypto and authorized scam payments are much harder to recover.

Does my bank have to refund a scam? Only if the transfer was unauthorized, under Regulation E. If you were tricked into sending the money yourself, US banks are generally not required to reimburse you.

Should I report to IC3 or the FTC? Both. IC3 is the FBI intake that can trigger a fund freeze; the FTC feeds the national scam database. For a serious financial loss, also tell your bank and local police.

Why is the real loss bigger than $20.9 billion? Because most fraud is never reported. Estimates suggest only around 14 percent of victims report, so the official figure captures a fraction of the true total.

Sources

• FBI IC3 2025 Internet Crime Report (PDF)
• FBI, 2025 Internet Crime Report (mirror)
• FBI Internet Crime Complaint Center (ic3.gov)
• FTC, report fraud (reportfraud.ftc.gov)
• FTC, 2025 Consumer Sentinel fraud figures (congressional testimony, Mar 2026)
• Regulation E, 12 CFR 1005.6 (consumer liability)
• CFPB, Electronic Fund Transfers FAQs
• Consumer Federation of America, The Scam Economy (under-reporting, 2026)
• UK Payment Systems Regulator, APP scams reimbursement dashboard
• Singapore Police Force, 2025 scams and cybercrime brief