Americans Lost Record $12.5 Billion to Online Crime in 2023: FBI

FBI officials warned the real cost to Americans could exceed $12.5 billion, noting not all online scams are reported.

A man types on a computer keyboard in this illustration picture taken on Feb. 28, 2013. Kacper Pempel/Reuters

American consumers and businesses lost a record $12.5 billion to online crimes in 2023, data released by the FBI on March 6 shows.

According to the 2023 Internet Crime Report (pdf), published by the FBI’s Internet Crime Complaint Center (IC3), the agency registered a 22 percent increase in reported losses from online scams last year compared to 2022, marking a $2 billion increase in total losses year-on-year.

The increase also marks the highest tally of losses from cyber scams reported to the FBI since it began publishing data on digital scams in May 2000.

However, FBI officials warned the real cost to Americans could exceed $12.5 billion, noting not all online scams are reported to the agency.

“As impressive as these figures appear, we know they are conservative regarding cybercrime in 2023. Consider that when the FBI recently infiltrated the Hive ransomware group’s infrastructure, we found that only about 20 percent of Hive’s victims reported to law enforcement,” the agency said. “More reporting from victims would mean superior insight for the FBI.”

According to the report, investment fraud cost Americans the most in 2023, with investment-related scams making up approximately $4.5 billion, or roughly a third of the total $12.5 billion in losses reported.

Overall, losses to investment scams rose nearly 40 percent year-on-year, the FBI said, noting that investment fraud with a reference to cryptocurrency made up $3.94 billion of those losses; marking an increase of 53 percent compared to 2022.

The second-costliest type of crime was business e-mail compromise, also referred to as (BEC), with the agency recording $2.9 billion in reported losses.

Those types of scams typically involved compromised vendor emails, requests for W-2 wage and tax forms, and fraudulent requests for large amounts of gift cards, the agency said.

Ransomware Targeting Critical Infrastructure

Tech support scams came in third place at roughly $924,000, according to the report while ransomware losses jumped 74 percent to $59.6 million following a brief turndown in 2022.

Critical infrastructure in the health care and public health sector made up a majority of ransomware complaints, officials said, followed by manufacturing, government, and IT.

The majority of ransomware attack reports were related to attacks by LockBit, the ransomware operator that has claimed responsibility for several cyberattacks, including a data breach that compromised 57,000 Bank of America accounts last year, according to the report.

“Cybercriminals continue to adjust their tactics, and the FBI has observed emerging ransomware trends, such as the deployment of multiple ransomware variants against the same victim and the use of data-destruction tactics to increase pressure on victims to negotiate,” the FBI report stated.

The FBI report also noted that different age groups tended to be impacted by different crimes, with victims between the ages of 30 to 49 being the most likely group to report losses from investment fraud, while older adults accounted for well over half of the losses due to tech support scams.

A woman using a laptop in an unspecified location, on Aug. 6, 2013. PA Media

FBI Freezes Millions in Fraudulent Payments

While investment fraud, BEC, and tech support scams surged last year, reports of phishing/spoofing, personal data breaches, and non-payment/non-delivery scams declined slightly, according to the FBI report.

Elsewhere, the report highlighted “notable achievements” in the cybercrime sector among law enforcement last year, with the IC3’s Recovery Asset Team (RAT) freezing more than $538.39 million of potential losses of $758.05 million following complaints of fraud, which officials said represented a success rate of 71 percent.

The frozen funds include the reversal of a $50 million payment made by an entity involved in a critical infrastructure construction project in New York due to a BEC incident, and a $426,000 payment related to a BEC loss by an individual in Connecticut connected to a real estate transaction.

Timothy Langan, the FBI’s executive assistant director, noted a fast-changing cyber landscape threatened by a “multitude of malicious actors” who have the tools needed to conduct large-scale fraud schemes, including holding money and data for ransom and endangering U.S. national security.

“Profit-driven cybercriminals and nation-state adversaries alike have the capability to paralyze entire school systems, police departments, healthcare facilities, and individual private sector entities,” Mr. Langan wrote.

“The FBI continues to combat this evolving cyber threat. Our strategy focuses on building strong partnerships with the private sector, removing threats from US networks, pulling back the cloak of anonymity many of these actors hide behind, and hitting cybercriminals where it hurts: their wallets, including their virtual wallets,” the senior FBI official said.