{
	"id": "557bedc2-7e39-4c96-b0bd-c3e0730ee878",
	"created_at": "2026-04-29T02:21:44.123912Z",
	"updated_at": "2026-04-29T08:22:53.519722Z",
	"deleted_at": null,
	"sha1_hash": "08e9e0ad5443356d56daf1ac7bff52dbb538463f",
	"title": "",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "2026-04-16T15:11:44Z",
	"file_modification_date": "2026-04-16T15:11:44Z",
	"file_size": 3362954,
	"plain_text": "1 2025 I C 3 AN NUA L R EPORT\n\nF ED ER A L BU R EAU OF I NVE STIGATIO N\r\n \r\n2\r\nCONTENTS\r\nA QUARTER-CENTURY OF CYBERCRIME REPORTING .......................................... 3\r\nOUR ROLE IN COMBATING CYBERCRIME .......................................................... 5\r\nIC3 COMPLAINTS IN 2025 ............................................................................... 6\r\nCYBER-ENABLED FRAUD IN 2025 ..................................................................... 9\r\nCYBER THREATS IN 2025............................................................................... 13\r\nIC3 RECOVERY ASSET TEAM - FINANCIAL FRAUD KILL CHAIN ............................ 17\r\nPOSITIVE IMPACTS ....................................................................................... 19\r\nINTERNATIONAL COMPLAINT COUNTRIES ...................................................... 24\r\nTHREE YEAR COMPLAINT COUNT COMPARISON ..................................................... 25\r\nCOMPLAINTS BY STATE ............................................................................................. 27\r\nCRIME TYPES BY AGE GROUPS ................................................................................. 32\r\nCOMPLAINANTS 17 YEARS OLD OR YOUNGER ................................................. 34\r\nARTIFICIAL INTELLIGENCE (AI) USED IN CYBERCRIME ...................................... 39\r\nIC3 ELDER FRAUD – COMPLAINTS FILED BY INDIVIDUALS 60+ ........................... 44\r\nCOMPLAINTS INVOLVING CRYPTOCURRENCY ................................................. 52\r\nAPPENDIX A: ABOUT IC3 ............................................................................................. 58\r\nAPPENDIX B: DEFINITIONS AND DESCRIPTORS ............................................................ 59\r\nAPPENDIX C: ADDITIONAL INFORMATION ABOUT IC3 DATA........................................... 62\r\nAPPENDIX D: PUBLIC SERVICE ANNOUNCEMENTS PUBLISHED IN 2025 ........................ 63\r\nAPPENDIX E: INDUSTRY ALERTS PUBLISHED IN 2025 .................................................... 65\r\nAPPENDIX F: IC3 QR CODES ........................................................................................ 66\n\n3 2025 I C 3 AN NUA L R EPORT\r\n \r\nA Quarter-Century of Cybercrime Reporting\r\n \r\nIn 2025, the FBI Internet Crime Complaint Center (IC3) celebrated its 25th anniversary as\r\nthe central hub for reporting cyber-enabled crime. This milestone signifies the FBI's\r\nenduring commitment to fighting the ever-evolving cyber threat. Our success in protecting\r\nindividuals and organizations is driven by public participation and robust data analysis.\r\nFor the past quarter-century, IC3 has been the primary connection between the FBI and the\r\npublic for information related to cyber-enabled criminal activity. Since our founding,\r\nreporting to IC3 has surged. We received a few thousand complaints per month in our early\r\ndays. We now average almost 3,000 complaints per day. IC3 produces annual reports (like\r\nthe one you are reading) based on the information we receive, publishes public awareness\r\ncampaigns, and provides industry alerts to the private sector. IC3 remains an essential\r\nresource for our law enforcement colleagues in combating cyber-enabled crime.\r\nIn 2025, losses reported to IC3 continued to climb, surpassing the $20 billion mark.\r\nInvestment-related fraud was once again the largest component of these losses, followed\r\nby business email compromises and tech support scams. The FBI continues to disrupt and\r\ndeter malicious cyber actors -- and shift the cost from victims to our adversaries. One\r\nexample was Operation Level Up, which countered crypto investment scams. This FBI-led\r\ninitiative has reduced potential losses by more than $500 million since 2024.\r\nIt has never been more important to be diligent with your cybersecurity, social media\r\nfootprint, and electronic interactions. Cyber threats and cyber-enabled crime will continue\r\nto evolve as the world embraces emerging technologies such as artificial intelligence. At\r\nthe time of publication, the FBI was engaged in Operation Winter Shield, which highlights\r\nconcrete steps for organizations to bolster their digital security. The FBI remains fully\r\ncommitted to ensuring Americans’ safety online and reinforcing the recent Executive Order\r\ntargeting cybercrime, fraud, and foreign scam centers, to hold those accountable who\r\nexploit the internet for nefarious purposes.\n\nF ED ER A L BU R EAU OF I NVE STIGATIO N\r\n \r\n4\r\nA Quarter-Century of Cybercrime Reporting, continued\r\n1\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n2\r\n \r\n \r\n \r\n1\r\n Accessibility description: Chart describes the number of complaints filed with IC3.gov from 2001 – 2025.\r\n2\r\n Accessibility description: Chart describes the losses of complaints filed with IC3.gov from 2001 – 2025.\r\n49,711\r\n231,493\r\n303,809\r\n288,012\r\n791,790\r\n1,008,597\r\n2001 2003 2005 2007 2009 2011 2013 2015 2017 2019 2021 2023 2025\r\nComplaints by Year\r\n2001 2005 2010 2015 2020 2021 2022 2023 2024 2025\r\nLosses by Year\r\n$16.6 billion\r\n$12.5 billion\r\n$10.3 billion\r\n$6.9 billion\r\n$4.2 billion\r\n$1.0 billion $1.1 billion\r\n$183 million $17.8 million\r\n$20.877 billion\n\n5 2025 I C 3 AN NUA L R EPORT\r\n \r\nOur Role in Combating Cybercrime3\r\n \r\n \r\n \r\n \r\n \r\n3\r\n Accessibility description: Image contains icons with the core IC3 roles: Collection, Analysis, Referral and Enhancement, Coordination,\r\nand Public Awareness. Each is listed in individual blocks as components of an ongoing process.\n\nF ED ER A L BU R EAU OF I NVE STIGATIO N\r\n \r\n6\r\nIC3 Complaints in 2025 4\r\n \r\n \r\n4\r\n Accessibility description: 2025 complaint highlights: 1,008,597 complaints; $20.877 billion in losses; 26% increase in losses from 2024;\r\n$20,699 Average Loss. Chart shows number of complaints and losses by age group. Under 20: 31,254 complaints, $67.1 million in\r\nlosses; 20-29: 112,069 complaints, $563.1 million in losses; 30-39: 153,293 complaints, $1.7 billion in losses; 40-49: 167,066\r\ncomplaints, $2.957 billion in losses; 50-59: 124,820 complaints, $3.7 billion in losses; 60+: 201,266 complaints, $7.7 billion in losses.\r\nPlease see Appendix B and C for additional information related to IC3 complaint data, crime types, and descriptors.\n\n7 2025 I C 3 AN NUA L R EPORT\r\n \r\n2025 Crime Types\r\n \r\nBy Complaint Count\r\nCrime Type Complaints\r\n \r\nCrime Type Complaints\r\nPhishing/Spoofing 191,561\r\n \r\nCredit Card/Check Fraud 18,774\r\nExtortion 89,129\r\n \r\nReal Estate 12,368\r\nInvestment 72,984\r\n \r\nAdvanced Fee 7,762\r\nPersonal Data Breach 67,456\r\n Lottery/Sweepstakes/\r\nInheritance\r\n5,623\r\nNon-Payment/\r\nNon-Delivery\r\n56,478\r\n \r\nThreats of Violence 4,826\r\nTech/Customer\r\nSupport\r\n47,794\r\n \r\nData Breach 3,963\r\nGovernment\r\nImpersonation\r\n32,424\r\n \r\nRansomware 3,611\r\nIdentity Theft 31,675\r\n \r\nIPR/Copyright and\r\nCounterfeit\r\n2,386\r\nBusiness Email\r\nCompromise\r\n24,768\r\n \r\nOverpayment 2,194\r\nEmployment 24,688\r\n \r\nSIM Swap 971\r\nConfidence/Romance 23,159\r\n Malware 893\r\nHarassment/Stalking 21,557\r\n \r\nBotnet 715\r\nOther 20,031\r\n \r\nCharity 662\r\nDescriptors\r\nCryptocurrency 181,565\r\n \r\nAI Related 22,364\r\nCrimes Against\r\nChildren\r\n7,239\r\n \r\nPlease see Appendix B and C for additional information related to IC3 complaint data, crime types, and descriptors.\n\nF ED ER A L BU R EAU OF I NVE STIGATIO N\r\n \r\n8\r\n2025 Crime Types, continued\r\n \r\nBy Complaint Loss\r\nCrime Type Loss\r\n \r\nCrime Type Loss\r\nInvestment $8,648,617,756\r\n Lottery/Sweepstakes/\r\nInheritance\r\n$194,147,851\r\nBusiness Email\r\nCompromise\r\n$3,046,598,558\r\n \r\nIdentity Theft $185,832,657\r\nTech/Customer\r\nSupport\r\n$2,134,675,818\r\n \r\nAdvanced Fee $155,910,852\r\nPersonal Data Breach $1,314,923,988\r\n \r\nExtortion $122,499,133\r\nConfidence/Romance $929,287,469\r\n \r\nRansomware $32,320,105\r\nGovernment\r\nImpersonation\r\n$797,943,193\r\n \r\nHarassment/Stalking $27,707,167\r\nOther $512,146,819\r\n \r\nIPR/Copyright and\r\nCounterfeit\r\n$26,667,006\r\nNon-Payment/\r\nNon-Delivery\r\n$503,373,587\r\n \r\nOverpayment $22,898,075\r\nData Breach $435,240,992\r\n Malware $19,370,572\r\nEmployment $362,934,762\r\n \r\nSIM Swap $17,366,758\r\nCredit Card/Check\r\nFraud\r\n$282,670,235\r\n \r\nBotnet $13,859,049\r\nReal Estate $275,110,419\r\n \r\nThreats of Violence $9,509,532\r\nPhishing/Spoofing $215,843,126\r\n \r\nCharity $7,907,609\r\nDescriptors\r\nCryptocurrency\r\n$11,366,669,732\r\n \r\nAI Related $893,346,472\r\nCrimes Against\r\nChildren\r\n$6,694,350\r\n \r\nPlease see Appendix B and C for additional information related to IC3 complaint data, crime types, and descriptors.\n\n9 2025 I C 3 AN NUA L R EPORT\r\n \r\nGovernment Impersonation; 32,424\r\nTech Support; 47,794\r\nNon-Payment/Non-Delivery; 56,478\r\nInvestment; 72,984\r\nExtortion; 89,129\r\nTop 5 Cyber-Enabled Fraud Crime Types by Count\r\nGovernment Impersonation; $797,943,193\r\nConfidence/Romance; $929,287,469\r\nTech Support; $2,134,675,818\r\nBEC; $3,046,598,558\r\nInvestment;\r\n$8,648,617,756\r\nTop 5 Cyber-Enabled Fraud Crime Types by Loss\r\nCyber-Enabled Fraud in 2025 5\r\n \r\nCyber-enabled fraud includes complaints where\r\ncriminals use the Internet or other technology to\r\ncommit fraudulent activities, often involving the\r\ntheft of money, data, identities, or the creation of\r\ncounterfeit goods or services. Cyber-enabled\r\nfraud is responsible for almost 85% of all losses\r\nreported to IC3 in 2025.\r\n \r\n6\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n7\r\n \r\n \r\n \r\n5\r\n Cyber-enabled fraud complaint highlights: 452,868 complaints; $17.697 billion in losses; accounts for 45% of all 2025 complaints and\r\n85% of all 2025 losses.\r\n6\r\n Accessibility description: Chart shows the counts of cyber-enabled crime complaints by reported age ranges.\r\n7\r\n Accessibility description: Chart shows the top five crime types for cyber-enabled fraud by count and loss.\r\n4.3%\r\n13.2%\r\n14.3%\r\n14.5%\r\n13.1%\r\n24.2%\r\n16.4%\r\n20/Under\r\n20 - 29\r\n30 - 39\r\n40 - 49\r\n50 - 59\r\n60+\r\nNo Age\r\nAge Ranges of Cyber-Enabled Fraud Reporting\r\n452,868 Complaints\r\n$17,697,074,980 Losses\r\n45% of 2025 Complaints\r\n85% of 2025 Losses\n\nF ED ER A L BU R EAU OF I NVE STIGATIO N\r\n \r\n10\r\n31%\r\n25%\r\n21%\r\n15%\r\n8%\r\nConfidence/Romance\r\nTop Reported Transaction Types in Fraud8\r\n \r\nTransaction information provided in IC3 complaints helps the FBI understand how victims\r\nare losing funds to fraud and assists the IC3 Recovery Asset Team (RAT) Financial Fraud Kill\r\nChain (FFKC) process when complaints are filed as quickly as possible. These charts identify\r\nthe most frequent ways complainants reported financial losses from cyber-enabled fraud.\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n8\r\n Accessibility description: Chart depicts the top reported transaction types: Cryptocurrency, Wire Transfer/ACH, Debit/Credit Card,\r\nPeer-to-Peer, Gift/Prepaid Card, Check/Cashier’s Check, and Cash.\r\n86%\r\n7%\r\n3%\r\n2%\r\n2%\r\nBusiness Email Compromise\r\n72%\r\n19% 3%\r\n4%\r\n2%\r\nInvestment\r\n28%\r\n28%\r\n27%\r\n11%\r\n6%\r\nExtortion\r\n43%\r\n20%\r\n14%\r\n12%\r\n11%\r\nTech/Customer Support\r\n40%\r\n21%\r\n15%\r\n14%\r\n10%\r\nGovernment Impersonation\r\nCryptocurrency Wire Transfer/ACH Debit Card/Credit Card Peer-to-Peer Transfer\r\nPrepaid card/Gift card Check/Cashier's Check Cash\n\n11 2025 I C 3 AN NUA L R EPORT\r\n \r\nRead More\r\nFinancially Motivated Sextortion — FBI\r\nSextortion — FBI\r\n \r\nCyber-Enabled Fraud Trends\r\n \r\nSextortion\r\nSextortion can start on any site, app, messaging platform, or game where people meet and\r\ncommunicate. In some cases, the first contact from the criminal will be a threat - the\r\nperson may claim to already have a revealing picture or video of a child that will be shared\r\nif the victim does not send more pictures. More often, however, this crime starts when\r\npeople believe they are communicating with someone their own age who is interested in a\r\nrelationship, or with someone who is offering something of value. After the criminals have\r\none or more videos or pictures, they threaten to publish that content, or they threaten\r\nviolence, to compel the victim to produce more images. The shame, fear, and confusion\r\npeople feel when they are caught in this cycle often prevent them from asking for help or\r\nreporting the abuse. The public should understand how sextortion occurs and openly\r\ndiscuss online safety.\r\nIn 2025, IC3 received more than 75,000 submissions regarding sextortion. When\r\nappropriate, IC3 refers complaints to the National Center for Missing \u0026 Exploited Children\r\n(NCMEC). In 2025, IC3 referred more than 5,700 submissions involving minors to NCMEC.\r\n \r\n \r\n2025 Sextortion by Age Range\r\nAge Range Count Adjusted Loss\r\nUnder 20 11,316 $1,297,653\r\n20 - 29 22,061 $7,282,686\r\n30 - 39 11,855 $8,063,178\r\n40 - 49 7,791 $6,507,936\r\n50 - 59 5,139 $6,186,794\r\n60+ 6,121 $14,894,547\r\n \r\nCryptocurrency Investment Fraud\r\nCryptocurrency Investment Scams are sophisticated long-term scams using\r\npsychological manipulation, the appearance of legitimacy, and exploitation of\r\ncryptocurrencies to deceive victims into investing large sums of money. These scams are\r\nlargely perpetrated by organized criminal enterprises based in Southeast Asia using\r\nvictims of human trafficking as forced labor to run the scam operations. Cryptocurrency\r\ninvestment fraud was the highest source of financial losses to Americans in 2025 with $7.2\r\nbillion reported in losses.\r\nThe scammers typically initiate contact through text messages, social media sites,\r\nadvertisements, or dating applications and then quickly move the conversation to a\r\nmessaging platform. Often the victims are introduced to investment groups representing\r\nthemselves to be knowledgeable industry insiders offering guidance on trading or\r\ninvesting in cryptocurrency or gold. The victims are enticed to send cryptocurrency to fake\r\ninvestment scam platforms or apps and are shown fake profits and offered loans to\r\nencourage larger investments. Eventually, when the victims try to withdraw their money,\n\nF ED ER A L BU R EAU OF I NVE STIGATIO N\r\n \r\n12\r\nthey will be charged taxes and fees as a final attempt to exploit money from the victims\r\nbefore the scammers disappear with all the victim funds. Victims are also targeted in\r\nrecovery scams, claiming to help recover lost\r\nfunds.\r\nThese scams are often devastating because they\r\ncan leave victims with significant financial loss and\r\nemotional distress. The FBI is working to combat\r\nthese scams through its work on the U.S.\r\nAttorney’s Office District of Columbia Scam\r\nCenter Strike Force and Operation Level Up, as\r\ndetailed in the “Positive Impact” section of this report.\r\n \r\n \r\nAccount Takeover (ATO)\r\nApproximately 4,700 complaints\r\n$359.7 million in losses\r\n----\r\nIC3 - Account Takeover Fraud via\r\nImpersonation of Financial Institution\r\nSupport\r\n \r\nGold Courier Scams\r\nApproximately 725 complaints\r\n$311.8 million in losses\r\n----\r\nIC3 - Scammers Use Couriers to Retrieve\r\nCash and Precious Metals from Victims of\r\nTech Support and Government\r\nImpersonation Scams\r\n \r\nInvestment Club Scams\r\nApproximately 1,600 complaints\r\n$160 million in losses\r\n----\r\nIC3 - Fraudsters Target US Stock Investors\r\nthrough Investment Clubs Accessed on\r\nSocial Media and Messaging Applications\r\n \r\n \r\nGovernment Impersonation\r\nApproximately 32,000 complaints\r\n$798 million in losses\r\n----\r\nIC3 - Senior US Officials Impersonated in\r\nMalicious Messaging Campaign\r\nIC3 - Criminals Impersonate US Health\r\nInsurance Providers and Chinese Law\r\nEnforcement to Target Chinese Speakers\r\nResiding in the United States\r\n \r\n \r\nRead More\r\nInvestment Fraud - Internet\r\nCrime Complaint Center (IC3)\r\nCryptocurrency Investment\r\nFraud — FBI\n\n13 2025 I C 3 AN NUA L R EPORT\r\n \r\nCyber Threats in 2025\r\nHijacked networks, cryptocurrency heists, and corporate espionage are a few examples of\r\nthe spiraling cyber threat. Every year, our adversaries become savvier and increasingly\r\ncallous – attacking power grids, shutting down hospitals, and stoking geopolitical tensions.\r\nState-sponsored cyber actors wield every element of their national power to target the\r\nUnited States and its critical infrastructure. Skilled cybercriminals exploit new and\r\nlongstanding vulnerabilities to steal our money and hold our data for ransom.\r\nCombating these threats is the primary mission of the FBI’s Cyber program. As the lead\r\nfederal agency for investigating cyberattacks and intrusions, we engage with victims and\r\nwork to unmask those committing malicious cyber activities, wherever they are.\r\n \r\n9\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n9\r\n Accessibility description: Chart shows the typically associated cyber threat crime types and percentage of the total cyber threat\r\ncomplaints received.\r\n7%\r\n39%\r\n9%\r\n36%\r\n10%\r\nCyber Threats Reported to IC3 in 2025\r\nBotnet\r\nData Breach\r\nMalware\r\nRansomware\r\nSIM Swap\n\nF ED ER A L BU R EAU OF I NVE STIGATIO N\r\n \r\n14\r\nRansomware as Reported to IC3 in 2025\r\nTop 10 Reported Variants\r\n \r\n \r\n \r\nRansomware is among the highest reported cyber\r\nthreats targeting critical infrastructure organizations.\r\nRansomware is a type of malicious software designed to\r\nblock access to a computer system until money is paid.\r\nIn 2025, the IC3 received more than 3,600 complaints\r\nreporting ransomware, with losses exceeding $32\r\nmillion.\r\nIn 2025, the following ransomware variants were among\r\nthose most frequently reported variants to the FBI via\r\nIC3, accounting for 56.8% of the total number of\r\nransomware incidents reported. The 2025 loss amount reported to IC3 attributed to these\r\nvariants is over $16 million, almost half (49.8%) of the total losses reported. Regarding\r\nransomware adjusted losses, this number does not normally include estimates of lost\r\nbusiness, time, wages, files, or equipment, or any third-party remediation services acquired\r\nby an entity. In some cases, entities do not report any loss amount to the FBI, thereby\r\ncreating an artificially low overall ransomware loss rate. Lastly, the number only represents\r\nwhat entities report to the FBI via IC3 and does not account for the entity directly reporting\r\nto FBI field offices.\r\n \r\n \r\n \r\nThe top 10 reported ransomware variants most impacted the following Critical Sectors:\r\nCritical Manufacturing, Healthcare and Public Health, and Government Facilities.\r\nJoint Cyber Security Advisories (JCSAs) are available to learn more about several of these\r\nvariants.\r\n \r\n \r\n \r\n1. Akira 2. Qilin 3. INC./Lynx/Sinobi 4. BianLian 5. Play\r\n6. Ransomhub 7. Lockbit 8. Dragonforce 9. SAFEPAY 10. Medusa\r\n \r\n \r\n• 63 New\r\nRansomware\r\nVariants Identified\r\nvia IC3\r\n• Average 5.25 New\r\nVariants Per Month\n\n15 2025 I C 3 AN NUA L R EPORT\r\n \r\nRecommendations to Protect Against Ransomware\r\n \r\n \r\nA key step to limit damage and lower risk is to establish and maintain a solid foundation of\r\nindustry best practices, which can help mitigate the threat and reduce your organization’s\r\nattack surface. The FBI recommends the following mitigating practices for companies:\r\n• Create off-site or offline backups and regularly maintain backup and restoration.\r\nAdditionally, ensure all backup data is encrypted, immutable (i.e., cannot be altered or\r\ndeleted), and covers the entire organization’s data infrastructure.\r\n• Eliminate default passwords and credentials when installing software and require all\r\naccounts with password logins (e.g., service accounts, admin accounts, and domain\r\nadmin accounts) to comply with NIST’s standards.\r\n• Disable and remove unnecessary protocols by default. Audit user accounts with\r\nadministrative privileges and configure access controls according to the principle of\r\nleast privilege.\r\n• Enable multi-factor authentication (MFA) for all services to the extent possible,\r\nparticularly for webmail, virtual private networks, and accounts that access critical\r\nsystems.\r\n• Secure initial access points - To help in detecting the ransomware, implement a tool\r\nthat logs and reports all network traffic, including lateral movement activity on a\r\nnetwork. Endpoint detection and response (EDR) tools are particularly useful for\r\ndetecting lateral connections as they have insight into common and uncommon\r\nnetwork connections for each host.\r\n• Segment networks to prevent the spread of ransomware. Network segmentation can\r\nhelp prevent the spread of ransomware by controlling traffic flows between—and\r\naccess to— various subnetworks and by restricting adversary lateral movement.\r\n• Keep all operating systems, software, and firmware up to date. Timely patching is one\r\nof the most efficient and cost-effective steps an organization can take to minimize its\r\nexposure to cybersecurity threats. Prioritize patching known exploited vulnerabilities in\r\ninternet-facing systems.\r\nIf you are impacted by ransomware or cybercrime, file a report with IC3 to share information\r\nwith the FBI.\r\nFor a more extensive list of mitigations and recommendations regarding ransomware, please\r\nrefer to #StopRansomware Guide | CISA.\n\nF ED ER A L BU R EAU OF I NVE STIGATIO N\r\n \r\n16\r\n \r\n \r\nThere are 16 critical infrastructure sectors whose assets, systems, and networks, whether\r\nphysical or virtual, are considered so vital to the U.S., their incapacitation or destruction\r\nwould have a debilitating effect on national security, economic security, or public health and\r\nsafety.\r\nRead More – https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors 10\r\n \r\nNon-Critical Sector Ransomware Reporting\r\nIC3 received more than 1,400 ransomware complaints from businesses and\r\norganizations not related to a critical sector. Below are the most reported industries for\r\nthese complaints.\r\n Example\r\n18% Legal services law firms, estate planning\r\n17% Contracting services electricians, general contractors\r\n10% Engineering, architectural services engineering firms, land surveying\r\n7% Consulting services project management, marketing services\r\n5% Non-critical manufacturing furniture, building materials\r\n \r\n10\r\n Accessibility description: This chart outlines complaints categorized as ransomware and data breach complaints related to one of the\r\n16 critical infrastructure sectors.\r\n1 1 17 11 9 28 31 8\r\n82\r\n51 84\r\n199 174 189\r\n52\r\n182\r\n24 25 34 51 54 59\r\n80\r\n89\r\n164\r\n232\r\n233\r\n258\r\n355\r\n460\r\nCyber Threats to Critical Infrastructure Data Breach Ransomware\r\nCyber Threats to Critical Infrastructure in 2025\n\n17 2025 I C 3 AN NUA L R EPORT\r\n \r\nIC3 Recovery Asset Team - Financial Fraud\r\nKill Chain in 2025\r\n \r\nEstablished in 2018, the IC3 RAT streamlines\r\ncommunications with financial institutions and FBI field\r\noffices to assist in the freezing of funds for victims of\r\nfraudulent domestic and international transactions via\r\nthe FFKC.\r\nFor the domestic FFKC process, the IC3 RAT will expand\r\nthe FFKC process beyond the initial recipient bank if\r\ninformation is provided during the FFKC initiation on\r\n“second hop” transactions to other domestic or\r\ninternational accounts to request freezes on as much of\r\nthe lost funds as possible. For the international FFKC\r\nprocess, the IC3 RAT coordinates with the Financial Crimes Enforcement Network Rapid\r\nResponse Team and law enforcement entities, including FBI LEGAT offices and international\r\nlaw enforcement partners to assist in freezing funds.\r\n \r\nDomestic FFKC International FFKC\r\n3,574 Incidents 326 Incidents\r\n$507,042,623 Frozen $171,970,560 Frozen\r\n \r\nIn the past, the majority of FFKC incidents initiated by the IC3 RAT were Business Email\r\nCompromises (BECs), however in 2025 the FFKC process saw a rise in Tech Support and\r\nAccount Takeover (ATO) initiations. ATO-related incidents can contain upwards of 50 or more\r\ntransactions to different recipient accounts at multiple banks happening simultaneously via\r\nACH transactions. It is extremely important for individuals and businesses to follow this\r\nguidance:\r\n• If you discover a fraudulent transfer, time is of the essence. Immediately, contact\r\nyour financial institution and request a recall of the funds along with any\r\nnecessary indemnification documents. Different financial institutions have\r\nvarying policies; it is important to know what assistance your financial institution\r\nwill provide when attempting to recover funds.\r\n• Regardless of the amount lost, file a complaint at www.ic3.gov. Be sure to include\r\nthe full transaction details in your report. IC3 may be able to assist both the\r\nfinancial institutions and law enforcement in freezing funds.\r\n \r\n3,900 Incidents\r\n \r\n$1,163,919,846\r\nAttempted Theft\r\n \r\n$679,013,183 Frozen\r\n \r\n58% Success Rate\n\nF ED ER A L BU R EAU OF I NVE STIGATIO N\r\n \r\n18\r\n \r\n \r\nOf the 3,900 FFKCs incidents initiated for 2025, there were 642 incidents involving victims\r\naged 60+ with a total reported loss of $65,367,648. The FFKC process was able to assist in\r\nfreezing $32,865,655 of those funds. The top three IC3 crime types in 2025 FFKC incidents\r\ninvolving 60+ victims:\r\n• Tech Support/ATO scams: 360 FFKC incidents\r\n• BEC (BEC/Real Estate): 104 FFKC incidents\r\n• Investment (Investment/Crypto): 64 FFKC incidents\r\n \r\n \r\n \r\nIn 2025, the RAT initiated 655 FFKC incidents reported by businesses and organizations\r\nbelonging to one of the 16 critical infrastructure sectors. Of the $261,451,001 in reported\r\nlosses, the RAT was able to freeze $146,561,094, for an overall success rate of 56%.\r\n11\r\n \r\n \r\n \r\n11\r\n Accessibility description: Chart shows the success rate of FFKC incidents initiated related to critical infrastructure sectors.\r\n95%\r\n67%\r\n47%\r\n36%\r\n100%\r\n33%\r\n65%\r\n53%\r\n48%\r\n55%\r\n60%\r\n31%\r\n51%\r\n92%\r\nSuccess Rate of FFKC Actions for Critical Infrastructure\r\nChemical\r\nCommercial Facilities\r\nCommunications\r\nCritical Manufacturing\r\nDefense Industrial Base\r\nEmergency\r\nEnergy\r\nFinancial\r\nFood \u0026 Agriculture\r\nGovernment Facilities\r\nHealthcare\r\nInformation Technology\r\nTransportation\r\nWater/Waste Systems\r\nFFKC in Elder Fraud\r\nFFKC Initiated for Critical Infrastructure\n\n19 2025 I C 3 AN NUA L R EPORT\r\n \r\nPositive Impacts\r\n \r\n \r\n \r\n \r\n \r\nIn response to the massive losses to cryptocurrency investment scams, the newly formed\r\nU.S. Attorney’s Office District of Columbia Scam Center Strike Force combines the power,\r\nreach, and resources of the U.S. Attorney’s Office with the Department of Justice’s Criminal\r\nDivision, the FBI, and the U.S. Secret Service to crackdown and disrupt these schemes. The\r\nStrike Force is also seeking to use all government tools available, partnering with the State\r\nDepartment, the Department of Treasury’s Office of Foreign Assets Control (OFAC), and the\r\nDepartment of Commerce.\r\nThe Scam Center Strike Force is investigating the worst scam compounds located in\r\nSoutheast Asia. Strike Force teams focus on identifying and pursuing key leaders—including\r\nChinese organized crime affiliates operating in Cambodia, Laos, and Burma—to bring them\r\nto justice.\r\nThe Scam Center Strike Force is also working to seize and disable the U.S.-based facilities\r\nand infrastructure that provide the manner and means to execute these scams, which\r\nincludes U.S. internet service providers and social media accounts scammers use to prey\r\non Americans. The Scam Center Strike Force will collaborate with U.S. companies to sever\r\naccess to the scam centers and prevent U.S. infrastructure from being weaponized against\r\nAmerican citizens.\r\nRead More\r\nNew Scam Center Strike Force Battles Southeast Asian Crypto Investment Fraud Targeting\r\nAmericans | United States Department of Justice\r\n \r\nU.S. Attorney’s Office District of Columbia\r\n Scam Center Strike Force on Cryptocurrency Investment\r\nFraud\n\nF ED ER A L BU R EAU OF I NVE STIGATIO N\r\n \r\n20\r\nPositive Impacts, continued\r\n \r\n \r\n \r\nLaunched in January 2024, Operation Level Up identifies victims of cryptocurrency\r\ninvestment fraud and notifies them of the scam. The operation was initiated with the\r\nsupport of agents from the FBI and U.S. Secret Service. Since its launch, Operation Level\r\nUp has achieved big milestones, surpassing 8,000 total victims notified and $500 million\r\nin savings to notified victims.\r\n2025 Success Stories\r\nUtilizing IC3 complaint data, Operation\r\nLevel Up reported:\r\n• 3,780 victims of cryptocurrency\r\ninvestment fraud were notified\r\n• 78% of those victims were unaware they\r\nwere being scammed\r\n• Estimated victim savings of\r\n$225,871,319\r\n• 38 victims were referred to a Victim\r\nSpecialist for suicide intervention\r\n \r\nPrevented Losses\r\n• Stopped a victim from cashing out\r\n$750,000 from his 401K.\r\n• Stopped a victim from selling her house\r\nto invest $500,000.\r\n• Stopped a victim from obtaining a loan to\r\nsend $400,000 to the scammer.\r\n• Multiple FBI initiations to the FFKC\r\nreversed wires and returned funds to\r\nvictims.\r\n• Several victims’ finances, which needed\r\nto pay for serious medical treatments,\r\nwere saved. Victims were planning to\r\nsend these funds in hopes of earning\r\nmore to pay for their treatments.\r\n• Intervened with multiple victims who\r\nwere contemplating suicide or self-harm.\r\nAlong with FBI Victim Specialists, FBI\r\nAgents maintained contact with the\r\nvictim until local law enforcement\r\narrived.\r\n \r\nRead More\r\nOperation Level-Up: How the FBI Is Saving\r\nVictims from Cryptocurrency Investment\r\nFraud — FBI\r\nOperation Level Up — FBI\r\n \r\n \r\nOperation Level Up\n\n21 2025 I C 3 AN NUA L R EPORT\r\n \r\nPositive Impacts, continued\r\n \r\n \r\n \r\n \r\nIllegal call centers defraud thousands of victims each year. Two categories of call center\r\nfraud reported to the IC3 are Tech/Customer Support and Government Impersonation. In\r\n2025, the number of complaints totaled more than 80,000, with losses exceeding $2.9\r\nbillion.\r\nDOJ, FBI, and Central Bureau\r\nof Investigation\r\nSince 2022, the DOJ, FBI, and\r\nIC3 have collaborated with law\r\nenforcement in India, to\r\ninclude the Central Bureau of\r\nInvestigation (CBI) in New Delhi\r\nand local Indian states, to\r\ncombat cyber-enabled\r\nfinancial crimes and\r\ntransnational call center fraud.\r\nSuccess Stories\r\n \r\n \r\nIn 2025, the FBI enabled approximately 175 arrests\r\nthrough 13 joint operations with the CBI and other local\r\nlaw enforcement. Since 2022, the FBI and CBI have had\r\nover 1,200 exchanges of information to support\r\ncriminal investigations, with more than 475 arrests\r\nacross 27 joint operations. The FBI has conducted\r\nhundreds of interviews and continues to support Indian\r\nlaw enforcement efforts to dismantle and disrupt\r\nfraudulent call centers and the prosecution of\r\nindividuals in Indian perpetrating these frauds.\r\nFBI Baltimore Field Office: The CBI, in a joint operation with the FBI, dismantled a large\r\nNoida, India-based transnational cybercrime network in December 2025, arresting six\r\nindividuals for duping more than 600 U.S. citizens through tech-support scams and\r\nimpersonating U.S. agencies like the Drug Enforcement Administration and the Social\r\nSecurity Administration. The operation, codenamed \"Operation Chakra,\" involved raiding an\r\nillegal call center, seizing cash and devices, and uncovering complex money laundering\r\nthrough crypto and bank transfers, with ongoing efforts to trace international funds and\r\nexecute further arrests. Victim reporting to IC3 identified more than $48.7 million in losses\r\nattributed to the criminal network, which encouraged the CBI to pursue the call center.\r\nRead More Maryland police, Prosecutor, FBI announce arrests in international fraud\r\nscheme\r\nFBI San Diego Field Office: The FBI San Diego Elder Justice Task Force (EJTF), along with\r\nover 100 law enforcement personnel, executed multiple federal and state arrest and\r\nsearch warrants in November 2025, targeting alleged members and associates of an\r\ninternational elder scam network. Via IC3 reporting, the FBI identified over 500 suspected\r\nor confirmed U.S. victims with the approximate loss amount exceeding $40 million. Read\r\nMore Nineteen Alleged Fraudsters Arrested for Conspiring to Scam Over 500 U.S. Seniors —\r\nFBI\r\nRead More Tech/Customer Support and Government Impersonation\r\n \r\nCall Center Fraud\n\nF ED ER A L BU R EAU OF I NVE STIGATIO N\r\n \r\n22\r\nPositive Impacts, continued\r\n \r\n \r\n \r\n \r\nBlackSuit (Royal) Ransomware\r\nIC3 enhances and supports intelligence analysis, while triaging victim reporting in support\r\nof ongoing investigations. In 2025, BlackSuit (Royal) ransomware attacks targeted critical\r\ninfrastructure sectors including, but not limited to, critical manufacturing, government\r\nfacilities, healthcare and public health, and commercial facilities. IC3 provided information\r\nregarding numerous victims of the BlackSuit (Royal) Ransomware group to the field for\r\nvictim notification and assistance. On August 11, 2025, the Department of Justice issued a\r\npress release highlighting coordinated actions taken to disrupt this group which involved\r\nmultiple domestic and foreign law enforcement partner participation.\r\nRead More Office of Public Affairs | Justice Department Announces Coordinated\r\nDisruption Actions Against BlackSuit (Royal) Ransomware Operations | United States\r\nDepartment of Justice\r\n \r\n \r\n \r\n \r\n \r\nDPRK\r\nIC3 identified dozens of victim companies of the Democratic People’s Republic of Korea\r\n(DPRK) Information Technology (IT) worker scam through complaints filed on IC3.gov. The\r\nDPRK government reportedly dispatched thousands of individuals around the globe with\r\nthe aim of deceiving U.S. and other businesses worldwide into hiring them as remote IT\r\nworkers to generate revenue to fund its weapons program. In addition, the FBI observed\r\nthese IT workers leverage unlawful access to company networks to exfiltrate proprietary\r\nand sensitive data and facilitate cyber-criminal activities on behalf of the DPRK.\r\nRead More\r\nIC3 - North Korean IT Workers Conducting Data Extortion\r\nIC3 - North Korean IT Worker Threats to U.S. Businesses\r\n \r\n \r\n \r\n \r\n \r\n \r\nRansomware\r\nData Breach\n\n23 2025 I C 3 AN NUA L R EPORT\r\n \r\nPositive Impacts, continued\r\n \r\n \r\n \r\nIn March 2025, the RAT received an IC3 complaint regarding a BEC incident involving a\r\nMissouri victim who was a senior citizen. The victim was attempting to close on a property\r\nand received a compromised email from the “title company” containing wire instructions\r\nfor over $1.3 million to a fraudulent bank account. The RAT immediately initiated the FFKC\r\nwith domestic banking partners to freeze the fraudulent recipient account and confirmed\r\nfunds were frozen and other wires had come into the fraudulent account from additional\r\nvictims. The RAT was notified the owner of the fraudulent recipient account was a victim of\r\nan overpayment scam and instructed to send $1 million to a fraudulent international\r\naccount in Hong Kong. The RAT immediately initiated the International FFKC to the\r\nFinancial Crime Enforcement Network and LEGAT Hong Kong partners.\r\nIn April 2025, the FBI Portland Office notified the RAT a city government office in Oregon\r\nwas the victim of a BEC incident with a reported loss of over $6 million dollars. The RAT\r\nsearched FFKC records for the fraudulent recipient bank account and found the March\r\n2025 FFKC was for the same recipient account. The RAT notified the FBI Portland Field\r\nOffice of the details regarding the prior FFKC and notified the recipient banking partners of\r\nthe additional wire transfer to the fraudulent recipient account. Due to the previous FFKC\r\nnotification and freeze on the recipient account, the recipient bank notified the originating\r\nbank in Oregon of the situation and to confirm the validity of the wire instructions. The wire\r\ninstructions were determined to be fraudulent, and the originating bank was able to issue\r\na recall for the $6 million wire. https://www.justice.gov/usao-or/pr/united-states-files-forfeiture-action-recover-67-million-stolen-funds\r\n \r\n \r\nIn August 2025, the RAT received a complaint reporting a BEC/Real Estate incident. The\r\nindividuals were closing on a home when they received an email impersonating their\r\nlegitimate attorneys. A wire was submitted at their bank for over $449,000 and was sent to\r\nthe recipient bank. After the fraud was discovered, the individuals reported the fraud to\r\ntheir bank, and their attorneys made separate attempts to contact the recipient bank with\r\nnegative results. Upon receiving the IC3 complaint filed about the incident, the RAT\r\nimmediately initiated the FFKC to request a freeze of the fraudulent account at the recipient\r\nbank. The RAT received notification from the recipient bank that the full amount was still in\r\nthe account and on hold.\r\n \r\n \r\n \r\n \r\nFinancial Fraud Kill Chain\n\nF ED ER A L BU R EAU OF I NVE STIGATIO N\r\n \r\n24\r\nInternational Complaint Countries 12\r\n \r\nIC3 received complaints from more than 200 countries in 2025, which accounts for almost\r\n$1.6 billion of the overall 2025 losses.\r\nTop 20 Foreign Countries with IC3 Complainants\r\nCountry Complaints\r\n \r\nCountry Complaints\r\nCanada 7,479\r\n Mexico 1,654\r\nIndia 5,879\r\n South Africa 1,532\r\nJapan 5,764\r\n Pakistan 1,514\r\nUnited Kingdom 4,106\r\n Nigeria 1,219\r\nGermany 3,056\r\n Greece 1,205\r\nPhilippines 2,725\r\n \r\nIran 1,101\r\nBrazil 2,686\r\n China 1,030\r\nFrance 2,326\r\n Spain 993\r\nColombia 2,222\r\n Turkey 944\r\nAustralia 2,069\r\n \r\nItaly 918\r\n \r\nTransactional information provided in IC3 complaints also helps identify where funds are\r\ngoing when victims are directed to send funds overseas.\r\n13\r\n \r\n \r\n12\r\n Accessibility description: Chart lists the top 20 countries by number of total complaints submitted to IC3, aside from the U.S. Please\r\nsee Appendix B and C for additional information related to IC3 complaint data, crime types, and descriptors.\r\n13\r\n Accessibility description: Chart shows the countries with the highest number of reported fraudulent wire transactions in 2025.\r\n1858\r\n1782\r\n1685\r\n1583 1538\r\n1301\r\n918\r\n831 767\r\n550\r\nHighest International Wire Transaction Destinations in 2025\n\n25 2025 I C 3 AN NUA L R EPORT\r\n \r\n IC3 Complaints in 2025\r\n \r\nThree Year Complaint Count Comparison\r\n \r\nBy Complaint Count\r\nCrime Type 2025 2024 2023\r\nAdvanced Fee 7,762 7,097 8,045\r\nBEC 24,768 21,442 21,489\r\nBotnet 715 587 540\r\nCharity 662 * *\r\nConfidence/Romance 23,159 17,910 17,823\r\nCredit Card/Check Fraud 18,774 12,876 13,718\r\nCrimes Against Children * 4,472 2,361\r\nData Breach 3,963 3,204 3,727\r\nEmployment 24,688 20,044 15,443\r\nExtortion 89,129 86,415 48,223\r\nGovernment Impersonation 32,424 17,367 14,190\r\nHarassment/Stalking 21,557 11,672 9,587\r\nIdentity Theft 31,675 21,403 19,778\r\nInvestment 72,984 47,919 39,570\r\nIPR/Copyright and Counterfeit 2,386 1,583 1,498\r\nLottery/Sweepstakes/Inheritance 5,623 3,690 4,168\r\nMalware 893 441 659\r\nNon-Payment/Non-Delivery 56,478 49,572 50,523\r\nOther 20,031 12,318 8,808\r\nOverpayment 2,194 2,705 4,144\r\nPersonal Data Breach 67,456 64,882 55,851\r\nPhishing/Spoofing 191,561 193,407 298,878\r\nRansomware 3,611 3,156 2,825\r\nReal Estate 12,368 9,359 9,521\r\nSIM Swap 971 982 1,075\r\nTech/Customer Support 47,794 36,002 37,560\r\nThreats of Violence 4,826 1,360 1,697\r\n* Crime Type or Descriptor was not captured in these years.\n\nF ED ER A L BU R EAU OF I NVE STIGATIO N\r\n \r\n26\r\nIC3 Complaints in 2025\r\n \r\nThree Year Complaint Loss Comparison\r\n \r\nBy Complaint Loss\r\nCrime Type 2025 2024 2023\r\nAdvanced Fee $155,910,852 $102,074,512 $134,516,577\r\nBEC $3,046,598,558 $2,770,151,146 $2,946,830,270\r\nBotnet $13,859,049 $8,860,202 $22,422,708\r\nCharity $7,907,609 * *\r\nConfidence/Romance $929,287,469 $672,009,052 $652,544,805\r\nCredit Card/Check Fraud $282,670,235 $199,889,841 $173,627,614\r\nCrimes Against Children * $519,424 $2,031,485\r\nData Breach $435,240,992 $364,855,818 $534,397,222\r\nEmployment $362,934,762 $264,223,271 $70,234,079\r\nExtortion $122,499,133 $143,185,736 $74,821,835\r\nGovernment Impersonation $797,943,193 $405,624,084 $394,050,518\r\nHarassment/Stalking $27,707,167 $10,611,223 $9,677,332\r\nIdentity Theft $185,832,657 $174,354,745 $126,203,809\r\nInvestment $8,648,617,756 $6,570,639,864 $4,570,275,683\r\nIPR/Copyright and Counterfeit $26,667,006 $8,715,512 $7,555,329\r\nLottery/Sweepstakes/Inheritance $194,147,851 $102,212,250 $94,502,836\r\nMalware $19,370,572 $1,365,945 $1,213,317\r\nNon-Payment/Non-Delivery $503,373,587 $785,436,888 $309,648,416\r\nOther $512,146,819 $280,278,325 $240,053,059\r\nOverpayment $22,898,075 $21,452,521 $27,955,195\r\nPersonal Data Breach $1,314,923,988 $1,453,296,303 $744,219,879\r\nPhishing/Spoofing $215,843,126 $70,013,036 $18,728,550\r\nRansomware $32,320,105 $12,473,156 $59,641,384\r\nReal Estate $275,110,419 $173,586,820 $145,243,348\r\nSIM Swap $17,366,758 $25,983,946 $48,798,103\r\nTech/Customer Support $2,134,675,818 $1,464,755,976 $924,512,658\r\nThreats of Violence $9,509,532 $1,842,186 $13,531,178\r\n* Crime Type or Descriptor was not captured in these years.\n\n27 2025 I C 3 AN NUA L R EPORT\r\n \r\nComplaints by State\r\n \r\nTop 10 States\r\nby Number of\r\nComplaints14 \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\nTop 10 States\r\nby Loss\r\n(In Millions)\r\n15\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n14\r\n Accessibility description: Chart depicts the top 10 states based on number of complaints. These include California, Texas, Florida,\r\nNew York, Illinois, Pennsylvania, Arizona, Ohio, North Carolina, and Georgia. Please see Appendix C for more information regarding IC3\r\ndata.\r\n15\r\n Accessibility description: Chart depicts the top 10 states based on reported losses are labeled. These include California, Texas,\r\nFlorida, New York, New Jersey, Arizona, Pennsylvania, Illinois, Georgia, and Virginia. Please see Appendix C for more information\r\nregarding IC3 data.\r\n116,414\r\n97,912\r\n71,843\r\n45,255\r\n32,977\r\n31,154\r\n28,868\r\n27,626\r\n25,940\r\n25,936\r\nCalifornia\r\nTexas\r\nFlorida\r\nNew York\r\nIllinois\r\nPennsylvania\r\nArizona\r\nOhio\r\nNorth Carolina\r\nGeorgia\r\n$3,675\r\n$1,826\r\n$1,596\r\n$1,226\r\n$660\r\n$631\r\n$538\r\n$535\r\n$535\r\n$476\r\nCalifornia\r\nTexas\r\nFlorida\r\nNew York\r\nNew Jersey\r\nArizona\r\nPennsylvania\r\nIllinois\r\nGeorgia\r\nVirginia\n\nF ED ER A L BU R EAU OF I NVE STIGATIO N\r\n \r\n28\r\nStates by Complaint Count\r\nRank State Complaints\r\n State Complaints\r\n1 California 116,414\r\n 30 Kentucky 9,414\r\n2 Texas 97,912\r\n 31 Louisiana 8,623\r\n3 Florida 71,843\r\n 32 Kansas 7,927\r\n4 New York 45,255\r\n 33 Arkansas 6,161\r\n5 Illinois 32,977\r\n 34 New Mexico 5,688\r\n6 Pennsylvania 31,154\r\n 35 Iowa 5,436\r\n7 Arizona 28,868\r\n 36 Mississippi 5,084\r\n8 Ohio 27,626\r\n 37 Idaho 4,479\r\n9 North Carolina 25,940\r\n 38 New Hampshire 4,374\r\n10 Georgia 25,936\r\n 39 West Virginia 4,209\r\n11 Washington 25,619\r\n 40 Puerto Rico 4,108\r\n12 Virginia 25,314\r\n 41 Nebraska 3,724\r\n13 Massachusetts 22,936\r\n 42 Hawaii 3,328\r\n14 Michigan 22,191\r\n 43 Alaska 3,202\r\n15 Indiana 20,777 44 District of Columbia 3,113\r\n16 New Jersey 20,648 45 Delaware 3,089\r\n17 Maryland 19,430\r\n 46 Maine 2,888\r\n18 Colorado 18,847\r\n 47 Rhode Island 2,700\r\n19 Wisconsin 16,680\r\n 48 Montana 2,618\r\n20 Tennessee 16,261\r\n 49 South Dakota 2,514\r\n21 South Carolina 14,699\r\n 50 Vermont 1,580\r\n22 Missouri 14,087\r\n 51 Wyoming 1,552\r\n23 Minnesota 13,595\r\n 52 North Dakota 1,418\r\n24 Nevada 13,366\r\n 53\r\nUnited States Minor Outlying\r\nIslands\r\n211\r\n25 Oregon 12,477\r\n 54 American Samoa 188\r\n26 Oklahoma 11,964\r\n 55 Guam 171\r\n27 Alabama 9,936\r\n 56 Virgin Islands, U.S. 125\r\n28 Utah 9,903\r\n 57 Northern Mariana Islands 30\r\n29\r\n Connecticut 9,714\r\n \r\n \r\nPlease see Appendix B and C for additional information related to IC3 complaint data, crime types, and descriptors.\n\n29 2025 I C 3 AN NUA L R EPORT\r\n \r\nStates by Complaint Loss\r\nRank State Loss\r\n State Loss\r\n1 California $3,674,716,305\r\n 30 Oklahoma $131,921,776\r\n2 Texas $1,825,636,181\r\n 31 Kentucky $119,685,861\r\n3 Florida $1,596,138,595\r\n 32 Hawaii $106,447,375\r\n4 New York $1,226,307,877\r\n 33 Louisiana $105,440,238\r\n5 New Jersey $660,411,901\r\n 34 Arkansas $102,541,947\r\n6 Arizona $630,700,609\r\n 35 District of Columbia $97,368,097\r\n7 Pennsylvania $537,787,231\r\n 36 Iowa $95,520,131\r\n8 Illinois $535,255,201\r\n 37 West Virginia $92,648,544\r\n9 Georgia $534,581,965\r\n 38 Idaho $88,725,284\r\n10 Virginia $476,120,025\r\n 39 New Mexico $85,571,285\r\n11 Washington $458,165,375\r\n 40 Mississippi $77,360,761\r\n12 North Carolina $431,561,716\r\n 41 Rhode Island $71,960,439\r\n13 Ohio $421,289,526\r\n 42 Nebraska $71,844,724\r\n14 Massachusetts $410,924,066\r\n 43 Delaware $62,012,494\r\n15 Maryland $390,242,821\r\n 44 New Hampshire $59,283,023\r\n16 Michigan $381,068,131\r\n 45 Maine $56,536,020\r\n17 Colorado $355,049,719\r\n 46 Montana $53,192,859\r\n18 Nevada $302,235,247\r\n 47 South Dakota $51,452,806\r\n19 Tennessee $269,214,519\r\n 48 Puerto Rico $44,266,380\r\n20 South Carolina $264,083,026\r\n 49 Alaska $39,972,438\r\n21 Minnesota $248,892,986\r\n 50 North Dakota $37,865,442\r\n22 Missouri $233,933,401\r\n 51 Vermont $26,567,033\r\n23 Indiana $233,016,771\r\n 52 Wyoming $25,826,205\r\n24 Connecticut $219,500,212\r\n 53\r\nUnited States Minor\r\nOutlying Islands\r\n$3,486,871\r\n25 Utah $195,417,205\r\n 54 Virgin Islands, U.S. $2,448,598\r\n26 Wisconsin $194,227,722\r\n 55 Guam $1,416,690\r\n27 Oregon $193,196,479\r\n 56\r\nNorthern Mariana\r\nIslands\r\n$290,585\r\n28 Alabama $167,212,658\r\n 57 American Samoa $172,395\r\n29 Kansas $147,337,101\r\n \r\n \r\n \r\nPlease see Appendix B and C for additional information related to IC3 complaint data, crime types, and descriptors.\n\nF ED ER A L BU R EAU OF I NVE STIGATIO N\r\n \r\n30\r\n \r\nComplaints per 100K Citizens*\r\nRank State Count\r\n State Count\r\n1 District of Columbia 448.8\r\n 27 Vermont 245.1\r\n2 Alaska 434.3\r\n 28 Rhode Island 242.3\r\n3 Nevada 407.2\r\n 29 Pennsylvania 238.6\r\n4 Arizona 378.7\r\n 30 West Virginia 238.3\r\n5 Massachusetts 320.6\r\n 31 Minnesota 233.2\r\n6 Washington 320.2\r\n 32 Hawaii 232.3\r\n7 Colorado 313.5\r\n 33 Ohio 232.1\r\n8 Maryland 310.1\r\n 34 North Carolina 231.6\r\n9 New Hampshire 309.0\r\n 35 Georgia 229.5\r\n10 Texas 308.8\r\n 36 Montana 228.7\r\n11 Florida 306.2\r\n 37 New York 226.2\r\n12 Indiana 297.9\r\n 38 Missouri 224.7\r\n13 California 295.8\r\n 39 Tennessee 222.3\r\n14 Oregon 292.0\r\n 40 Idaho 220.7\r\n15 Delaware 291.4\r\n 41 Michigan 219.1\r\n16 Oklahoma 290.2\r\n 42 New Jersey 216.2\r\n17 Virginia 285.1\r\n 43 Kentucky 204.3\r\n18 Utah 279.8\r\n 44 Maine 204.1\r\n19 Wisconsin 279.3\r\n 45 Arkansas 197.8\r\n20 South Dakota 268.8\r\n 46 Alabama 191.3\r\n21 New Mexico 267.6\r\n 47 Louisiana 186.7\r\n22 Kansas 266.3\r\n 48 Nebraska 184.5\r\n23 South Carolina 263.9\r\n 49 North Dakota 177.4\r\n24 Wyoming 263.6\r\n 50 Mississippi 172.1\r\n25 Connecticut 263.4\r\n 51 Iowa 167.9\r\n26 Illinois 259.3\r\n 52 Puerto Rico 129.0\r\nPlease see Appendix B and C for additional information related to IC3 complaint data, crime types, and descriptors.\n\n31 2025 I C 3 AN NUA L R EPORT\r\n \r\n \r\nLosses per 100K Citizens*\r\nRank State Loss\r\n State Loss\r\n1 District of Columbia $14,037,165\r\n 27 Oregon $4,520,711\r\n2 California $9,337,282\r\n 28 Wyoming $4,386,594\r\n3 Nevada $9,208,347\r\n 29 Idaho $4,371,279\r\n4 Arizona $8,272,766\r\n 30 Minnesota $4,268,880\r\n5 Hawaii $7,429,222\r\n 31 Illinois $4,208,265\r\n6 New Jersey $6,916,601\r\n 32 New Hampshire $4,188,601\r\n7 Florida $6,802,930\r\n 33 Vermont $4,121,073\r\n8 Rhode Island $6,456,625\r\n 34 Pennsylvania $4,117,999\r\n9 Maryland $6,228,591\r\n 35 New Mexico $4,025,941\r\n10 New York $6,130,795\r\n 36 Maine $3,995,834\r\n11 Connecticut $5,950,941\r\n 37 North Carolina $3,853,929\r\n12 Colorado $5,905,133\r\n 38 Michigan $3,762,564\r\n13 Delaware $5,850,500\r\n 39 Missouri $3,730,673\r\n14 Texas $5,757,321\r\n 40 Tennessee $3,680,270\r\n15 Massachusetts $5,743,909\r\n 41 Nebraska $3,560,184\r\n16 Washington $5,726,337\r\n 42 Ohio $3,540,096\r\n17 Utah $5,521,970\r\n 43 Indiana $3,341,541\r\n18 South Dakota $5,502,421\r\n 44 Arkansas $3,292,097\r\n19 Alaska $5,421,682\r\n 45 Wisconsin $3,251,878\r\n20 Virginia $5,361,647\r\n 46 Alabama $3,219,908\r\n21 West Virginia $5,245,800\r\n 47 Oklahoma $3,199,432\r\n22 Kansas $4,948,815\r\n 48 Iowa $2,949,621\r\n23 South Carolina $4,740,934\r\n 49 Mississippi $2,618,706\r\n24 North Dakota $4,736,982\r\n 50 Kentucky $2,597,990\r\n25 Georgia $4,729,664\r\n 51 Louisiana $2,283,151\r\n26 Montana $4,646,906\r\n 52 Puerto Rico $1,389,911\r\nPlease see Appendix B and C for additional information related to IC3 complaint data, crime types, and descriptors.\n\nF ED ER A L BU R EAU OF I NVE STIGATIO N\r\n \r\n32\r\nCrime Types by Age Groups\r\n \r\nCounts Under 20 20 - 29 30 – 39 40 – 49 50 - 59\r\nAdvanced Fee 288 991 1,170 1,120 1,169\r\nBEC 73 1,250 3,619 5,090 4,910\r\nBotnet 106 155 137 129 56\r\nCharity 34 87 114 148 101\r\nConfidence/Romance 393 1,886 2,501 3,010 3,745\r\nCredit Card/\r\nCheck Fraud\r\n451 1,760 2,767 2,958 2,810\r\nData Breach 21 135 443 625 522\r\nEmployment 835 4,555 5,025 4,524 3,671\r\nExtortion 13,110 26,963 15,866 11,279 7,841\r\nGovernment\r\nImpersonation\r\n420 3,401 5,446 6,136 5,636\r\nHarassment/Stalking 1,827 4,711 5,473 4,076 2,249\r\nIdentity Theft 487 3,526 6,498 6,433 5,528\r\nInvestment 901 6,102 10,996 13,737 12,773\r\nIPR/Copyright and\r\nCounterfeit\r\n70 261 504 502 359\r\nLottery/Sweepstakes/\r\nInheritance\r\n75 315 528 679 773\r\nMalware 57 159 193 147 93\r\nNon-payment/\r\nNon-Delivery\r\n2,351 8,331 9,947 9,981 8,158\r\nOther 2,159 2,864 3,938 3,659 2,620\r\nOverpayment 304 350 294 295 310\r\nPersonal Data Breach 2,601 7,877 13,238 13,403 9,703\r\nPhishing/Spoofing 2,380 19,765 27,433 27,800 26,782\r\nRansomware 15 67 204 427 457\r\nReal Estate 158 1,986 2,189 2,037 2,036\r\nSIM Swap 6 61 162 210 194\r\nTech/Customer Support 405 3,045 4,864 5,182 5,512\r\nThreats of Violence 508 1,045 1,084 829 531\r\n60+ crime type information is available in the 2025 IC3 Elder Fraud Section.\n\n33 2025 I C 3 AN NUA L R EPORT\r\n \r\nLosses Under 20 20 - 29 30 – 39 40 – 49 50 - 59\r\nAdvanced Fee $327,823 $7,081,874 $13,311,458 $18,801,337 $25,811,979\r\nBEC $15,137,36\r\n4\r\n$45,754,756 $356,707,180 $624,292,591 $618,105,890\r\nBotnet $20,532 $53,205 $383,680 $5,923,019 $191,046\r\nCharity $41,917 $914,968 $282,824 $323,872 $224,605\r\nConfidence/\r\nRomance\r\n$3,057,718 $25,097,693 $42,460,967 $74,644,395 $131,385,454\r\nCredit Card/\r\nCheck Fraud\r\n$606,192 $6,076,760 $32,039,262 $49,971,180 $43,817,766\r\nData Breach $1,741,450 $4,158,310 $72,145,136 $64,973,932 $77,385,567\r\nEmployment $1,489,854 $33,049,422 $42,865,213 $57,604,303 $100,853,442\r\nExtortion $1,715,733 $12,179,028 $14,964,819 $13,427,693 $15,710,381\r\nGovernment\r\nImpersonation\r\n$8,583,219 $50,358,843 $82,005,707 $55,019,630 $84,516,785\r\nHarassment/\r\nStalking\r\n$218,229 $591,102 $5,343,712 $6,098,635 $4,721,979\r\nIdentity Theft $1,547,663 $10,815,080 $19,440,941 $27,807,082 $35,573,535\r\nInvestment $17,022,80\r\n4\r\n$163,145,27\r\n0\r\n$564,898,178 $1,152,243,858 $1,748,651,287\r\nIPR/Copyright\r\n\u0026 Counterfeit\r\n$72,650 $377,545 $2,108,962 $14,161,896 $3,270,925\r\nLottery/\r\nSweepstakes/\r\nInheritance\r\n$89,050 $2,273,833 $5,047,453 $12,877,295 $19,385,699\r\nMalware $3,766 $504,839 $1,714,483 $1,998,406 $10,661,574\r\nNon-payment/\r\nNon-Delivery\r\n$2,391,036 $37,006,257 $69,016,236 $97,620,771 $73,863,630\r\nOther $2,616,321 $12,967,479 $58,543,283 $96,902,505 $85,195,234\r\nOverpayment $181,495 $783,264 $3,937,790 $2,601,879 $2,301,154\r\nPersonal Data\r\nBreach\r\n$7,314,429 $86,102,381 $173,434,730 $241,244,329 $225,239,544\r\nPhishing/\r\nSpoofing\r\n$360,429 $7,954,797 $32,669,619 $33,063,856 $30,918,367\r\nRansomware $0 $2,956,745 $821,075 $6,918,385 $5,394,639\r\nReal Estate $189,875 $7,294,459 $23,316,890 $33,724,892 $46,373,027\r\nSIM Swap $6,303 $153,247 $796,329 $3,399,856 $2,698,369\r\nTech/\r\nCustomer\r\nSupport\r\n$2,328,729 $45,718,725 $119,274,031 $261,313,644 $283,494,484\r\nThreats of\r\nViolence\r\n$40,982 $159,365 $7,335,885 $454,130 $239,803\r\n60+ crime type information is available in the 2025 IC3 Elder Fraud Section.\n\nF ED ER A L BU R EAU OF I NVE STIGATIO N\r\n \r\n34\r\n31%\r\n20%\r\n15%\r\n10%\r\n6%\r\n4%\r\n3% 1%\r\n10%\r\nTransaction Types Reported by 17 and Younger\r\nPrepaid Card/Gift Card\r\nPeer-to-peer Transfer\r\nDebit Card/Credit Card\r\nCryptocurrency/Crypto ATM\r\nWire Transfer\r\nCheck/Cashier's Check\r\nCash\r\nMoney Order\r\nOther\r\nComplainants 17 Years Old or Younger\r\n \r\nRecent trends indicate a serious rise in cybercrimes\r\ntargeting minors (17 years old or younger), driven by\r\nsextortion, cyberbullying, and online grooming.\r\nThe FBI is actively investigating a violent online\r\ngroup known as \"764,\" which coerces children into\r\nengaging in self-harm, animal cruelty, and suicidal\r\nacts on live stream, sometimes leading to the death\r\nof the victim.\r\nIn 2025, IC3 referred more than 5,700 submissions\r\ninvolving minors to NCMEC.\r\n \r\nRead More: IC3 - Violent Online Networks Target\r\nVulnerable and Underage Populations Across the\r\nUnited States and Around the Globe\r\n \r\n16\r\n \r\n16\r\n Accessibility description: Chart depicts the most reported transaction types by complainants 17 years old or younger.\r\n13,168 Complaints\r\n$12,988,892 Losses\r\n$986 Average Loss\n\n35 2025 I C 3 AN NUA L R EPORT\r\n \r\n \r\n17 or Younger By Complaint Count\r\nCrime Type Complaints\r\n \r\nCrime Type Complaints\r\nExtortion 5,151\r\n Government\r\nImpersonation\r\n99\r\nPersonal Data Breach 1,510\r\n \r\nTech Support 85\r\nOther 1,460\r\n \r\nBotnet 65\r\nHarassment/Stalking 1,053\r\n \r\nConfidence/Romance 57\r\nPhishing/Spoofing 878\r\n \r\nIPR/Copyright and\r\nCounterfeit\r\n42\r\nNon-payment/Non-Delivery\r\n825\r\n \r\nMalware 29\r\nThreats of Violence 251\r\n \r\nReal Estate 23\r\nEmployment 246\r\n \r\nCharity 16\r\nInvestment 237\r\n Lottery/Sweepstakes/\r\nInheritance\r\n13\r\nIdentity Theft 181\r\n \r\nData Breach 9\r\nOverpayment 164\r\n \r\nRansomware 5\r\nCredit Card/Check\r\nFraud\r\n125\r\n \r\nBEC 4\r\nAdvanced Fee 102\r\n \r\nSIM Swap 1\r\nDescriptors\r\nCryptocurrency 950\r\n \r\nAI Related 355\r\nCrimes Against\r\nChildren\r\n5,200\r\nPlease see Appendix B and C for additional information related to IC3 complaint data, crime types, and descriptors.\n\nF ED ER A L BU R EAU OF I NVE STIGATIO N\r\n \r\n36\r\n \r\n17 or Younger By Complaint Loss\r\nCrime Type Loss\r\n \r\nCrime Type Loss\r\nInvestment $4,743,664\r\n \r\nConfidence/Romance $75,440\r\nOther $1,810,134\r\n IPR/Copyright and\r\nCounterfeit\r\n$72,188\r\nData Breach $1,693,400\r\n \r\nOverpayment $61,918\r\nGovernment\r\nImpersonation\r\n$1,412,003\r\n \r\nReal Estate $43,861\r\nNon-payment/\r\nNon-Delivery\r\n$648,538\r\n \r\nAdvanced Fee $23,765\r\nIdentity Theft $510,553\r\n \r\nBEC $10,750\r\nPersonal Data Breach $500,264\r\n \r\nCharity $4,552\r\nExtortion $468,831\r\n \r\nThreats of Violence $1,547\r\nTech Support $396,487\r\n Lottery/Sweepstakes/\r\nInheritance\r\n$488\r\nHarassment/Stalking $203,807\r\n \r\nBotnet $82\r\nCredit Card/Check\r\nFraud\r\n$121,506\r\n \r\nMalware $35\r\nEmployment $106,727\r\n \r\nRansomware $0\r\nPhishing/Spoofing $77,852\r\n \r\nSIM Swap $0\r\nDescriptors\r\nCryptocurrency\r\n$5,620,716\r\n \r\nAI Related $126,391\r\nCrimes Against\r\nChildren\r\n$298,240\r\n \r\nPlease see Appendix B and C for additional information related to IC3 complaint data, crime types, and descriptors.\n\n37 2025 I C 3 AN NUA L R EPORT\r\n \r\n \r\n17/Younger Complaints by State\r\nRank State Count\r\n State Count\r\n1 California 1,492\r\n 30 Oregon 146\r\n2 Texas 1,082\r\n 31 Kentucky 143\r\n3 Florida 702\r\n 32 Connecticut 129\r\n4 New York 539\r\n 33 Louisiana 111\r\n5 Illinois 371\r\n 34 Kansas 94\r\n5 Pennsylvania 366\r\n 35 Idaho 91\r\n7 North Carolina 365\r\n 36 Mississippi 91\r\n8 Arizona 341\r\n 37 Arkansas 89\r\n9 Ohio 337\r\n 38 Iowa 82\r\n10 Georgia 317\r\n 39 Nebraska 71\r\n11 Washington 312\r\n 40 Alaska 63\r\n12 Michigan 292\r\n 41 New Mexico 62\r\n13 Virginia 292\r\n 42 West Virginia 55\r\n14 Colorado 240\r\n 43 Maine 44\r\n15 New Jersey 240 44 New Hampshire 38\r\n16 Indiana 226 44 Hawaii 37\r\n17 Maryland 224\r\n 46 Rhode Island 35\r\n18 Missouri 205\r\n 47 Delaware 34\r\n18 Nevada 202\r\n 47 Montana 33\r\n20 Tennessee 197\r\n 49 Puerto Rico 30\r\n21 Massachusetts 195\r\n 50 District of Columbia 23\r\n22 Minnesota 180\r\n 51 North Dakota 23\r\n23 Alabama 175\r\n 52 South Dakota 22\r\n23 Utah 168\r\n 53 Wyoming 21\r\n25 South Carolina 165\r\n 54 Vermont 16\r\n26 Oklahoma\r\n160\r\n 55\r\nUnited States Minor\r\nOutlying Islands\r\n8\r\n27 Wisconsin 154\r\n 56 Guam 2\r\nPlease see Appendix B and C for additional information related to IC3 complaint data, crime types, and descriptors.\n\nF ED ER A L BU R EAU OF I NVE STIGATIO N\r\n \r\n38\r\n \r\n17/Younger Losses by State\r\nRank State Loss\r\n State Loss\r\n1 Georgia $3,087,376\r\n 30 District of Columbia $34,840\r\n2 Texas $1,676,326\r\n 31 Tennessee $27,917\r\n3 Utah $1,017,481\r\n 32 North Carolina $27,457\r\n4 Washington $758,830\r\n 33 Missouri $24,678\r\n5 South Carolina $758,428\r\n 34 Puerto Rico $16,566\r\n6 California $719,483\r\n 35 Louisiana $14,661\r\n7 New York $578,293\r\n 36 Wisconsin $14,612\r\n8 Arizona $491,722\r\n 37 Iowa $14,576\r\n9 Illinois $269,389\r\n 38 Maryland $14,395\r\n10 Florida $211,888\r\n 39 Wyoming $13,749\r\n11 New Mexico $170,580\r\n 40 Indiana $10,691\r\n12 West Virginia $153,035\r\n 41 Maine $9,345\r\n13 Virginia $150,736\r\n 42 Idaho $7,171\r\n14 Michigan $148,264\r\n 43 Nebraska $6,404\r\n15 Massachusetts $101,315\r\n 44 Hawaii $6,231\r\n16 New Jersey $85,885\r\n 45 Alaska $4,880\r\n17 Minnesota $76,832\r\n 46 South Dakota $4,080\r\n18 Oregon $59,874\r\n 47 Arkansas $3,479\r\n19 Colorado $55,032\r\n 48 Mississippi $3,041\r\n20 Ohio $53,439\r\n 49 North Dakota $2,365\r\n21 Alabama $52,541\r\n 50 Montana $2,261\r\n22 Kansas $47,016\r\n 51 New Hampshire $1,862\r\n23 Pennsylvania $46,527\r\n 52 Rhode Island $1,021\r\n24 Connecticut $43,520\r\n 52 Vermont $744\r\n25 Nevada $40,475\r\n 52 Delaware $475\r\n26 Oklahoma $39,442\r\n 52 Guam $0\r\n27 Kentucky $37,653\r\n 52\r\nUnited States Minor\r\nOutlying Islands\r\n$0\r\nPlease see Appendix B and C for additional information related to IC3 complaint data, crime types, and descriptors.\n\n39 2025 I C 3 AN NUA L R EPORT\r\n \r\nArtificial Intelligence (AI) Used in Cybercrime\r\n \r\nLike most technology, artificial intelligence (AI) is a tool\r\nwhich can be used for legitimate, helpful purposes or for\r\ncriminal motives. AI technology enables the creation of\r\nconvincing synthetic content, such as social media\r\nprofiles and personalized conversations, often in mass\r\nquantities. People have manipulated video and audio\r\nsimilarly for decades, but the widespread availability of\r\nthis developing technology makes it possible to create\r\nhigh-quality content. AI-enabled synthetic content is\r\nbecoming increasingly difficult to detect and easier to\r\nmake, which allows criminal actors to potentially conduct successful fraud schemes against\r\nindividuals, businesses, and financial institutions.\r\nIn 2025, IC3 received more than 22,000 complaints reporting AI-related information.\r\nAdjusted losses of these complaints exceed $893 million.\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\nBEC: Chat generators can quickly create official-sounding emails mimicking a\r\ncompany's CEO or other officials. These emails can contain phishing links or\r\ndirections to wire funds. Voice cloning can also be used to request wire payment or\r\nprovide employee. There are multiple BEC tactics, and not all are AI-enabled. In 2025,\r\nbusinesses reported losses over $30 million to BEC scams involving AI.\r\n \r\nConfidence/Romance Scams: Scammers are creating fake profiles and scripts\r\nproduced by AI chat generators to make speech more believable. In 2025, victims lost\r\nover $19 million to Confidence/Romance scams with a likely AI-nexus. This type of\r\nscam also includes grandparent scams, or “distress” scams, in which voice cloning\r\ntechnology is used to mimic the sound of a loved one in distress. Victims claimed\r\nlosses over $5 million in 2025 to distress scams. This type of scam is evolving to\r\nmimic other family members or close friends in different types of emergency\r\nscenarios.\r\n \r\nHow AI Could Be Used in Frauds/Scams\r\n22,364 Complaints\r\n \r\n$893,346,472\r\nLosses\n\nF ED ER A L BU R EAU OF I NVE STIGATIO N\r\n \r\n40\r\n \r\n \r\n \r\n \r\nRead More\r\nIC3 - Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud\r\nIC3 - Criminals Using Altered Proof-of-Life Media to Extort Victims in Virtual Kidnapping for\r\nRansom Scams\r\nIC3 - Fraudsters Target US Stock Investors through Investment Clubs Accessed on Social\r\nMedia and Messaging Applications\r\nInfographic; ABA Foundation and FBI Release New Infographic to Help Americans Spot and\r\nAvoid Deepfake Scams\r\n \r\nEmployment: The use of voice spoofing, or potentially voice deepfakes, during online\r\ninterviews of the potential applicants. In these interviews, the actions and lip\r\nmovement of the person interviewed on-camera do not completely coordinate with\r\nthe audio of the person speaking. At times, actions such as coughing, sneezing, or\r\nother auditory actions are not aligned with what is presented visually. From IC3\r\ncomplaint data, there does not seem to be significant dollar loss associated as the\r\ngoal generally appears to be gaining access to private computer networks. In 2025,\r\nvictims reported losses of almost $13 million to AI-involved employment type scams.\r\n.\r\nInvestment Scams: Subjects in investment scams often use AI to enhance their\r\nconversations with potential victims allowing the scammers to quickly generate\r\nthousands of conversations that appear different to each prospective victim.\r\nInvestment clubs employ AI-generated videos and voices of celebrities, CEOs, or\r\ntrusted figures to create fraudulent, high-stakes opportunities. These scams often\r\nfeature fake, professional-looking endorsements on social media or in video calls. This\r\nmakes it harder for victims to detect they are in a scam. In 2025, losses in Investment\r\ncomplaints with a reported AI-nexus, surpassed $632 million. However, overall losses\r\nto Investment scams exceeded $8 billion, demonstrating that many victims do not\r\nrealize the extent AI may be involved in scams.\n\n41 2025 I C 3 AN NUA L R EPORT\r\n \r\n \r\nAI References by Complaint Count\r\nCrime Type Complaint\r\ns\r\n \r\nCrime Type Complaint\r\ns\r\nInvestment 4,356\r\n BEC 135\r\nExtortion 1,764\r\n Real Estate 115\r\nPersonal Data Breach 1,204\r\n Advanced Fee 105\r\nPhishing/Spoofing 803\r\n Threats of Violence 95\r\nHarassment/Stalking 763\r\n \r\nIPR/Copyright and\r\nCounterfeit\r\n63\r\nEmployment 691\r\n Data Breach 60\r\nConfidence/Romance 626\r\n Lottery/Sweepstakes/\r\nInheritance\r\n54\r\nNon-Payment/\r\nNon-Delivery\r\n609\r\n \r\nMalware 42\r\nTech/Customer Support 574\r\n Charity 19\r\nOther 504\r\n Ransomware 16\r\nIdentity Theft 460\r\n SIM Swap 14\r\nGovernment\r\nImpersonation\r\n260\r\n \r\nOverpayment 13\r\nCredit Card/Check Fraud 139\r\n Botnet 12\r\nDescriptors\r\nCrimes Against Children 214\r\n \r\nCryptocurrency\r\n7,623\r\n \r\n \r\n \r\nPlease see Appendix B and C for additional information related to IC3 complaint data, crime types, and descriptors.\n\nF ED ER A L BU R EAU OF I NVE STIGATIO N\r\n \r\n42\r\n \r\nAI References by Complaint Loss\r\nCrime Type Loss\r\n \r\nCrime Type Loss\r\nInvestment $632,041,188\r\n Extortion $2,940,642\r\nBEC $30,256,592\r\n Real Estate $2,699,085\r\nTech/Customer Support $19,457,078\r\n Credit Card/Check Fraud $1,836,105\r\nConfidence/Romance $19,041,653\r\n \r\nIdentity Theft $1,643,308\r\nPersonal Data Breach $18,767,964\r\n Advanced Fee $1,642,712\r\nEmployment $12,550,185\r\n Harassment/Stalking $1,445,378\r\nOther $11,750,591\r\n Malware $1,248,199\r\nPhishing/Spoofing $10,283,732\r\n Botnet $697,226\r\nIPR/Copyright and\r\nCounterfeit\r\n$10,103,789\r\n \r\nCharity $531,455\r\nGovernment\r\nImpersonation\r\n$7,061,628\r\n \r\nSIM Swap $13,082\r\nLottery/Sweepstakes/\r\nInheritance\r\n$4,486,965\r\n \r\nThreats of Violence $9,576\r\nData Breach $4,319,380\r\n Overpayment $4,719\r\nNon-Payment/\r\nNon-Delivery\r\n$3,726,777\r\n \r\nRansomware $0\r\n Descriptors\r\nCrimes Against Children\r\n$9,866\r\n \r\nCryptocurrency\r\n$658,714,247\r\n \r\nPlease see Appendix B and C for additional information related to IC3 complaint data, crime types, and descriptors.\n\n43 2025 I C 3 AN NUA L R EPORT\n\nF ED ER A L BU R EAU OF I NVE STIGATIO N\r\n \r\n44\r\nIC3 Elder Fraud – Complaints filed by\r\nIndividuals 60+\r\n \r\n17\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n18\r\n \r\n \r\n17\r\n Accessibility Description: Describes Elder Fraud highlights: 201,266 complaints (37% increase from 2024); $7,748 billion losses (59%\r\nincrease from 2024); $38,500 average loss; 12,444 complainants lost more than $100K.\r\n18\r\n Accessibility Description: Chart describes counts and losses for those reporting as 60+ from 2018 to 2025. Please see Appendix B and\r\nC for additional information related to IC3 complaint data, crime types, and descriptors.\r\n201,266 Complaints\r\n37% FROM 2024\r\n \r\n$7.748 Billion in Losses\r\n59% FROM 2024\r\n \r\n$38,500 Average Loss\r\n \r\n12,444 Complainants Lost \u003e $100K\r\n$0\r\n$1,000,000,000\r\n$2,000,000,000\r\n$3,000,000,000\r\n$4,000,000,000\r\n$5,000,000,000\r\n$6,000,000,000\r\n$7,000,000,000\r\n$8,000,000,000\r\n0\r\n50,000\r\n100,000\r\n150,000\r\n200,000\r\n250,000\r\n2018 2019 2020 2021 2022 2023 2024 2025\r\nComplainants 60+ Reporting to IC3 Losses Victims\n\n45 2025 I C 3 AN NUA L R EPORT\r\n \r\nCrime Types Reported by 60+\r\n \r\n \r\nPlease see Appendix B and C for additional information related to IC3 complaint data, crime types, and descriptors.\r\n \r\nComplainants 60+\r\nCrime Type Count\r\n Crime Type Count\r\nPhishing/Spoofing 48,064\r\n \r\nLottery/Sweepstakes/Inheritance 2,785\r\nTech/Customer Support 21,333\r\n \r\nReal Estate 2,473\r\nInvestment 16,926\r\n \r\nAdvanced Fee 2,020\r\nPersonal Data Breach 11,705\r\n \r\nHarassment/Stalking 1,160\r\nConfidence/Romance 10,188\r\n \r\nOverpayment 477\r\nNon-Payment/Non-Delivery 9,743\r\n \r\nRansomware 358\r\nExtortion 9,111\r\n \r\nData Breach 350\r\nGovernment Impersonation 8,628\r\n \r\nThreats of Violence 349\r\nIdentity Theft 5,359\r\n \r\nIPR/Copyright and Counterfeit 316\r\nCredit Card/Check Fraud 5,200\r\n \r\nSIM Swap 222\r\nBusiness Email Compromise*\r\n4,566\r\n Malware 138\r\nOther 3,001\r\n \r\nCharity 126\r\nEmployment 2,853\r\n \r\nBotnet 36\r\nDescriptors\r\nCryptocurrency\r\n42,271\r\n \r\nAI Related\r\n3,143\r\nCrimes Against Children\r\n94\n\nF ED ER A L BU R EAU OF I NVE STIGATIO N\r\n \r\n46\r\nCrime Types Reported by 60+, continued\r\n \r\n \r\nComplainants 60+ Losses\r\nCrime Type Loss\r\n \r\nCrime Type Loss\r\nInvestment $3,519,296,354 Advanced Fee $65,877,660\r\nTech/Customer Support $1,040,730,043 Extortion $54,309,050\r\nConfidence/Romance $584,032,745 Data Breach $48,555,751\r\nBusiness Email\r\nCompromise\r\n$568,048,472 Identity Theft $48,546,133\r\nGovernment\r\nImpersonation\r\n$413,206,251 Overpayment $8,045,862\r\nPersonal Data Breach $324,470,413 SIM Swap $6,741,791\r\nOther $153,412,996 Ransomware $5,644,789\r\nLottery/Sweepstakes/\r\nInheritance\r\n$136,328,519\r\nIPR/Copyright and\r\nCounterfeit\r\n$4,493,512\r\nNon-Payment/\r\nNon-Delivery\r\n$127,041,813 Charity $3,474,668\r\nReal Estate $123,671,936 Malware $3,433,325\r\nEmployment $78,712,899 Harassment/Stalking $3,134,436\r\nPhishing/Spoofing $77,020,936 Botnet $945,812\r\nCredit Card/Check Fraud $71,880,416 Threats of Violence $394,040\r\nDescriptors\r\nCryptocurrency\r\n$4,347,081,557\r\n \r\nAI Related\r\n$352,496,231\r\nCrimes Against Children\r\n$5,806,300\r\n \r\n \r\nPlease see Appendix B and C for additional information related to IC3 complaint data, crime types, and descriptors.\n\n47 2025 I C 3 AN NUA L R EPORT\r\n \r\nThree Year Comparison\r\n \r\n60+ Complaint Count\r\n \r\nCrime Type 2025 2024 2023\r\nAdvanced Fee 2,020 1,897 1,951\r\nBusiness Email Compromise 4,566 3,300 3,080\r\nBotnet 36 23 17\r\nCharity 126 * *\r\nConfidence/Romance 10,188 7,626 6,740\r\nCredit Card/Check Fraud 5,200 3,226 3,182\r\nData Breach 350 300 336\r\nEmployment 2,853 1,928 1,079\r\nExtortion 9,111 12,618 5,396\r\nGovernment Impersonation 8,628 4,521 3,517\r\nHarassment/Stalking 1,160 696 568\r\nIdentity Theft 5,359 4,064 3,010\r\nInvestment 16,926 9,448 6,443\r\nIPR/Copyright and Counterfeit 316 163 152\r\nLottery/Sweepstakes/Inheritance 2,785 1,711 1,771\r\nMalware 138 45 67\r\nNon-Payment/Non-Delivery 9,743 7,646 6,693\r\nOther 3,001 2,017 1,447\r\nOverpayment 477 527 698\r\nPersonal Data Breach 11,705 9,827 7,333\r\nPhishing/Spoofing 48,064 23,252 2,856\r\nRansomware 358 208 175\r\nReal Estate 2,473 1,765 1,498\r\nSIM Swap 222 205 174\r\nTech/Customer Support 21,334 16,777 17,696\r\nThreats of Violence 348 111 115\r\nCryptocurrency 42,271 33,369 16,968\r\nAI Related 3,143 * *\r\nCrimes Against Children 94 25 26\r\n* Crime Type or Descriptor was not captured in these years.\n\nF ED ER A L BU R EAU OF I NVE STIGATIO N\r\n \r\n48\r\nThree Year Comparison, continued\r\n \r\n60+ Complaint Losses\r\nCrime Type 2025 2024 2023\r\n \r\nAdvanced Fee $65,877,660 $41,622,868 $67,923,263\r\nBusiness Email Compromise $568,048,472 $385,001,099 $382,372,731\r\nBotnet $945,812 $14,852 $23,142\r\nCharity $3,474,668 * *\r\nConfidence Fraud/Romance $584,032,745 $389,312,356 $356,888,968\r\nCredit Card/Check Fraud $71,880,416 $33,813,267 $37,862,023\r\nData Breach $48,555,751 $28,546,213 $23,913,130\r\nEmployment $78,712,899 $37,882,347 $6,835,684\r\nExtortion $54,309,050 $24,901,693 $23,093,451\r\nGovernment Impersonation $413,206,251 $208,096,366 $179,646,103\r\nHarassment/Stalking $3,134,436 $713,693 $1,930,347\r\nIdentity Theft $48,546,133 $28,463,106 $34,551,900\r\nInvestment $3,519,296,354 $1,834,242,515 $1,243,010,600\r\nIPR/Copyright and Counterfeit $4,493,512 $1,076,710 $183,169\r\nLottery/Sweepstakes/Inheritance $136,328,519 $75,897,926 $67,396,206\r\nMalware $3,433,325 $187,911 $261,144\r\nNon-Payment/Non-Delivery $127,041,813 $76,794,753 $59,018,965\r\nOther $153,412,996 $111,300,637 $72,707,042\r\nOverpayment $8,045,862 $5,900,921 $7,496,049\r\nPersonal Data Breach $324,470,413 $254,187,196 $109,724,027\r\nPhishing/Spoofing $77,020,936 $20,202,521 $3,355,436\r\nRansomware $5,644,789 $43,199 $635,548\r\nReal Estate $123,671,936 $76,324,236 $65,634,851\r\nSIM Swap $6,741,791 $6,342,329 $15,148,072\r\nTech/Customer Support $1,040,879,243 $982,440,006 $589,759,770\r\nThreats of Violence $244,840 $300,488 $5,128,768\r\nCryptocurrency $4,347,081,557 $2,839,333,197 $1,653,484,444\r\nAI Related $352,496,231 * *\r\nCrimes Against Children $5,806,300 $231,600 $1,159,939\r\n* Crime Type or Descriptor was not captured in these years.\n\n49 2025 I C 3 AN NUA L R EPORT\r\n \r\n \r\nOverall State Statistics for 60+\r\n \r\nCounts by State from Complainants 60+*\r\nRank State Count\r\n \r\n State Count\r\n1 California 22,157\r\n \r\n30 Alabama 2,057\r\n2 Florida 17,147\r\n \r\n31 Kansas 2,013\r\n3 Texas 14,410\r\n \r\n32 Louisiana 1,906\r\n4 Arizona 9,834\r\n \r\n33 Arkansas 1,658\r\n5 New York 8,537\r\n \r\n34 New Mexico 1,449\r\n6 Illinois 7,701\r\n \r\n35 Iowa 1,202\r\n7 Pennsylvania 7,088\r\n \r\n36 Idaho 1,136\r\n8 Ohio 6,948\r\n \r\n37 New Hampshire 1,063\r\n9 North Carolina 5,942\r\n \r\n38 Mississippi 959\r\n10 Michigan 5,731\r\n \r\n39 West Virginia 931\r\n11 Virginia 5,509\r\n \r\n40 Hawaii 917\r\n12 Massachusetts 5,463\r\n \r\n41 Montana 814\r\n13 Washington 5,392\r\n \r\n42 Delaware 796\r\n14 Georgia 4,865\r\n \r\n43 Nebraska 781\r\n15 Maryland 4,573 44 Maine 721\r\n16 Indiana 4,199 45 Alaska 666\r\n17 New Jersey 4,111\r\n \r\n46 Rhode Island 581\r\n18 Colorado 4,061\r\n \r\n47 Vermont 436\r\n19 Tennessee 3,525\r\n \r\n48 South Dakota 398\r\n20 Missouri 3,247\r\n \r\n49 Wyoming 397\r\n21 South Carolina 3,136\r\n \r\n50 District of Columbia 382\r\n22 Wisconsin 3,014\r\n \r\n51 Puerto Rico 351\r\n23 Nevada 3,008\r\n \r\n52 North Dakota 251\r\n24 Oregon 2,910\r\n \r\n53 United States Minor\r\nOutlying Islands\r\n33\r\n25 Minnesota 2,550\r\n \r\n54 U.S. Virgin Islands. 24\r\n26 Oklahoma 2,449\r\n \r\n55 Guam 18\r\n27 Connecticut 2,360\r\n \r\n56 American Samoa 4\r\n28 Utah 2,341\r\n \r\n57 Northern Mariana Islands 3\r\n29 Kentucky 2,127\r\n \r\n \r\nPlease see Appendix B and C for additional information related to IC3 complaint data, crime types, and descriptors.\n\nF ED ER A L BU R EAU OF I NVE STIGATIO N\r\n \r\n50\r\nOverall State Statistics for 60+, continued\r\n \r\nLosses by State from Complainants 60+*\r\nRank State Loss\r\n State Loss\r\n1 California $1,403,975,91\r\n1\r\n \r\n30 New Mexico $55,820,259\r\n2 Florida $709,823,172\r\n \r\n31 Kansas $55,730,977\r\n3 Texas $678,564,081\r\n \r\n32 Hawaii $55,385,929\r\n4 New York $408,741,632\r\n \r\n33 Oklahoma $53,333,350\r\n5 Arizona $343,984,935\r\n \r\n34 Iowa $44,136,901\r\n6 New Jersey $249,808,786\r\n \r\n35 Idaho $37,394,229\r\n7 Virginia $220,941,233\r\n \r\n36 Arkansas $36,958,369\r\n8 Georgia $218,218,618\r\n \r\n37 Louisiana $35,856,847\r\n9 Pennsylvania $215,887,466\r\n \r\n38 Mississippi $33,087,218\r\n10 Illinois $189,491,209\r\n \r\n39 Montana $31,773,898\r\n11 Washington $179,706,909\r\n \r\n40 Nebraska $28,430,567\r\n12 Maryland $176,380,737\r\n \r\n41 New Hampshire $25,068,671\r\n13 Michigan $169,931,948\r\n \r\n42 Maine $23,317,413\r\n14 North Carolina $164,214,173\r\n \r\n43 Rhode Island $21,561,918\r\n15 Ohio $163,748,647\r\n \r\n44 West Virginia $18,953,441\r\n16 Colorado $144,529,956\r\n \r\n45 Alaska $16,252,410\r\n17 Nevada $115,267,384\r\n \r\n46 Delaware $16,189,240\r\n18 Massachusetts $113,880,471\r\n \r\n47 South Dakota $14,708,875\r\n19 Minnesota $111,387,313\r\n \r\n48 District of Columbia $10,077,243\r\n20 Tennessee $108,305,976\r\n \r\n49 Vermont $8,548,782\r\n21 South Carolina $97,344,480\r\n \r\n50 Puerto Rico $8,167,452\r\n22 Wisconsin $92,041,492\r\n \r\n51 Wyoming $5,923,260\r\n23 Missouri $91,563,419\r\n \r\n52 North Dakota $5,895,155\r\n24 Indiana $81,517,309\r\n \r\n53 United States Minor\r\nOutlying Islands\r\n$2,886,025\r\n25 Oregon $77,481,475\r\n \r\n54 U.S. Virgin Islands $1,088,540\r\n26 Connecticut $73,178,714\r\n \r\n55 Guam $380,178\r\n27 Utah $65,946,070\r\n \r\n56 American Samoa $46,362\r\n28 Kentucky $64,441,069\r\n \r\n57 Northern Mariana\r\nIslands\r\n$15,500\r\n29 Alabama $58,838,411\r\n \r\n \r\nPlease see Appendix B and C for additional information related to IC3 complaint data, crime types, and descriptors.\n\n51 2025 I C 3 AN NUA L R EPORT\n\nF ED ER A L BU R EAU OF I NVE STIGATIO N\r\n \r\n52\r\n$0\r\n$2\r\n$4\r\n$6\r\n$8\r\n$10\r\n$12\r\n0\r\n25,000\r\n50,000\r\n75,000\r\n100,000\r\n125,000\r\n150,000\r\n175,000\r\n200,000\r\n2017 2018 2019 2020 2021 2022 2023 2024 2025\r\nBillions\r\nIC3 Complaints with Cryptocurrency Nexus\r\n$ Losses # of Complaints\r\n$26,955,462\r\n$288,875,060\r\n$861,551,625\r\n$1,552,700,119\r\n$2,139,033,232\r\n$4,432,224,488\r\nUnder 20\r\n20 - 29\r\n30 - 39\r\n40 - 49\r\n50 - 59\r\n60+\r\nCrypto Losses by Age Range\r\nComplaints Involving Cryptocurrency - 2025\r\n \r\n \r\n19\r\n \r\n \r\n \r\n \r\n \r\n \r\n20\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n21\r\n \r\n \r\n \r\n19\r\n Accessibility Description: Describes Cryptocurrency highlights: 181,565 complaints (21% increase from 2024); $11.366 billion in\r\nlosses (22% increase from 2024), $62,604 average loss, 18,589 complainants lost more than $100,000\r\n20\r\n Accessibility Description: Charts describe the count and losses associated with complaints reporting cryptocurrency by age range.\r\n21\r\n Accessibility Description: Chart describes complaint counts and loss with a cryptocurrency nexus from 2017 to 2025.\r\n181,565 Complaints\r\n21% FROM 2024\r\n$11.366 Billion in Losses\r\n22% FROM 2024\r\n18,589 Complainants Lost \u003e$100K\r\n$62,604 Average Loss\r\n3,508\r\n18,107\r\n27,598 29,749\r\n25,453\r\n44,555\r\nUnder\r\n20\r\n20 - 29 30 - 39 40 - 49 50 - 59 60+\r\nCrypto Counts by Age Range\n\n53 2025 I C 3 AN NUA L R EPORT\r\n \r\n \r\n \r\nCryptocurrency Fraud Trends\r\n \r\nCryptocurrency Investment\r\nCrypto Investment Fraud\r\nReported by Age Group\r\n61,559 Complaints; $7.228 billion\r\n-----\r\n48% Increase in Complaints from 2024\r\n25% Increase in Losses from 2024\r\n-----\r\nNew Scam Center Strike Force Battles\r\nSoutheast Asian Crypto Investment Fraud\r\nTargeting Americans | United States\r\nDepartment of Justice\r\nAge Group Count Losses\r\nUnder 20 629 $12,582,997\r\n20 - 29 4,627 $117,353,587\r\n30 - 39 8,576 $412,626,617\r\n40 - 49 10,750 $924,623,370\r\n50 - 59 9,856 $1,383,263,248\r\n60+ 13,685 $2,763,921,910\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\nCryptocurrency ATMs/Kiosks\r\nCrypto ATM/Kiosk Use\r\nReported by Age Group\r\n13,460 Complaints; $389 million in Losses\r\n------\r\n23% Increase in Complaints from 2024\r\n58% Increase in Losses from 2024\r\n------\r\nThe FBI Warns of Fraudulent Schemes\r\nLeveraging Cryptocurrency ATMs and QR\r\nCodes to Facilitate Payment\r\nAge Group Count Losses\r\nUnder 20 58 $124,013\r\n20 - 29 825 $6,474,240\r\n30 - 39 1,275 $10,936,943\r\n40 - 49 1,472 $20,826,227\r\n50 – 59 1,524 $44,584,724\r\n60+ 6,188 $257,466,130\r\nRecovery Scams\r\nRecovery Scams\r\nReported by Age Group\r\n10,516 Complaints; $1.4 billion in Losses\r\n------\r\nIncrease in complaints reporting\r\nimpersonation of government officials and\r\nrecovery firms.\r\n------\r\nFictitious Law Firms Targeting\r\nCryptocurrency Scam Victims Combine\r\nMultiple Exploitation Tactics While\r\nOffering to Recover Funds\r\nFBI Warns of Scammers Impersonating\r\nthe IC3\r\nAge Group Count Losses*\r\nUnder 20 106 $3,825,212\r\n20 - 29 841 $22,498,411\r\n30 - 39 1,511 $76,183,433\r\n40 - 49 1,977 $194,670,794\r\n50 – 59 1,706 $298,233,813\r\n60+ 2,529 $540,505,980\r\n \r\n*Losses may also include losses\r\nexperienced from previous scams\r\nwhich prompted the contact with\r\nthe recovery company.\n\nF ED ER A L BU R EAU OF I NVE STIGATIO N\r\n \r\n54\r\nCrime Types with Cryptocurrency Nexus\r\n \r\n \r\n \r\nComplaints\r\nCrime Type Count\r\n Crime Type Count\r\nInvestment 61,559 Ransomware 902\r\nExtortion 23,797 Credit Card/Check Fraud 901\r\nTech/Customer Support 17,355 Data Breach 866\r\nPersonal Data Breach 13,486 Lottery/Sweepstakes/Inheritance 826\r\nEmployment 10,338 Real Estate 715\r\nPhishing/Spoofing 7,164 Harassment/Stalking 711\r\nGovernment Impersonation 5,955 Overpayment 304\r\nConfidence/Romance 5,925 Threats of Violence 210\r\nNon-Payment/Non-Delivery 4,761 Malware 196\r\nOther 2,332 IPR/Copyright and Counterfeit 182\r\nAdvanced Fee 2,319 SIM Swap 121\r\nIdentity Theft 1,656 Charity 65\r\nBusiness Email Compromise 1,526 Botnet 53\r\nDescriptor\r\nAI Related 8,712\r\nCrimes Against Children 276\r\nPlease see Appendix B and C for additional information related to IC3 complaint data, crime types, and descriptors.\n\n55 2025 I C 3 AN NUA L R EPORT\r\n \r\nCrime Types with Cryptocurrency Nexus, continued\r\n \r\nLosses\r\nCrime Type Loss\r\n \r\nCrime Type Loss\r\nInvestment $7,277,868,919\r\nLottery/Sweepstakes/\r\nInheritance\r\n$29,765,165\r\nTech/Customer Support $1,226,298,080 Real Estate $25,169,423\r\nPersonal Data Breach $939,398,686 Ransomware $17,068,810\r\nConfidence/Romance $394,787,515 Identity Theft $16,995,129\r\nEmployment $288,199,807 Malware $15,693,486\r\nGovernment\r\nImpersonation\r\n$281,146,737\r\nCredit Card/Check\r\nFraud\r\n$13,423,130\r\nOther $147,700,762 Threats of Violence $7,375,785\r\nPhishing/Spoofing $111,025,191 Overpayment $6,356,416\r\nData Breach $95,861,120 Harassment/Stalking $4,682,411\r\nBusiness Email\r\nCompromise\r\n$83,771,329 SIM Swap $4,405,259\r\nNon-Payment/\r\nNon-Delivery\r\n$76,196,341\r\nIPR/Copyright and\r\nCounterfeit\r\n$4,020,461\r\nAdvanced Fee $67,554,554 Charity $3,221,048\r\nExtortion $63,195,612 Botnet $60,916\r\nDescriptor\r\nAI Related $741,639,787\r\n \r\nCrimes Against Children $596,843\r\n \r\nPlease see Appendix B and C for additional information related to IC3 complaint data, crime types, and descriptors.\n\nF ED ER A L BU R EAU OF I NVE STIGATIO N\r\n \r\n56\r\nOverall State Statistics\r\n \r\nCryptocurrency Complaints by State\r\nRank State Count\r\n \r\n State Count\r\n1 California 20,878\r\n \r\n30 Kentucky 1,453\r\n2 Texas 13,965\r\n \r\n31 Louisiana 1,366\r\n3 Florida 13,381\r\n \r\n32 Arkansas 1,084\r\n4 New York 8,088\r\n \r\n33 Kansas 1,057\r\n5 Pennsylvania 5,118\r\n \r\n34 Idaho 1,023\r\n6 Arizona 4,936\r\n \r\n35 New Mexico 914\r\n7 Ohio 4,925\r\n \r\n36 Puerto Rico 903\r\n8 Illinois 4,910\r\n \r\n37 Iowa 887\r\n9 Washington 4,589\r\n \r\n38 Hawaii 826\r\n10 Georgia 4,492\r\n \r\n39 Mississippi 815\r\n11 New Jersey 4,459\r\n \r\n40 New Hampshire 767\r\n12 North Carolina 4,340\r\n \r\n41 Nebraska 730\r\n13 Virginia 4,246\r\n \r\n42 South Dakota 603\r\n14 Colorado 4,066\r\n \r\n43 Montana 590\r\n15 Michigan 3,648 44 West Virginia 556\r\n16 Maryland 3,226 45 Maine 524\r\n17 Wisconsin 3,092\r\n \r\n46 Alaska 482\r\n18 Massachusetts 2,983\r\n \r\n47 District of Columbia 448\r\n19 Tennessee 2,854\r\n \r\n48 Delaware 436\r\n20 Nevada 2,518\r\n \r\n49 Rhode Island 414\r\n21 Missouri 2,500\r\n \r\n50 North Dakota 300\r\n22 Minnesota 2,253\r\n \r\n51 Wyoming 273\r\n23 Indiana 2,211\r\n \r\n52 Vermont 212\r\n24 South Carolina 2,176\r\n \r\n53 Guam 26\r\n25 Oregon 2,175\r\n \r\n53\r\nUnited States Minor Outlying\r\nIslands\r\n26\r\n26 Utah 1,833\r\n \r\n55 Virgin Islands, U.S. 22\r\n27 Alabama 1,687\r\n \r\n56 American Samoa 8\r\n28 Oklahoma 1,581\r\n \r\n57 Northern Mariana Islands 2\r\n29 Connecticut 1,480\r\n \r\n \r\nPlease see Appendix B and C for additional information related to IC3 complaint data, crime types, and descriptors.\n\n57 2025 I C 3 AN NUA L R EPORT\r\n \r\nOverall State Statistics, continued\r\n \r\nCryptocurrency Losses by State\r\nRank State Loss\r\n State Loss\r\n1 California $2,099,014,715 30 Kansas $78,062,429\r\n2 Texas $1,016,062,841 31 Oklahoma $62,394,493\r\n3 Florida $914,525,497 32 Kentucky $60,156,299\r\n4 New York $593,370,013 33 Louisiana $53,679,269\r\n5 Oregon $545,938,510 34 Idaho $48,296,733\r\n6 New Jersey $383,662,185 35 New Mexico $45,229,204\r\n7 Arizona $346,269,314 36 Arkansas $44,064,469\r\n8 Pennsylvania $292,893,338 37 Iowa $43,685,423\r\n9 Georgia $264,502,467 38 Mississippi $38,286,775\r\n10 Washington $263,067,281 39 District of Columbia $37,013,584\r\n11 Virginia $261,243,361 40 New Hampshire $36,481,772\r\n12 Illinois $257,919,562 41 Maine $35,795,026\r\n13 Maryland $246,476,431 42 Montana $35,136,688\r\n14 North Carolina $229,649,863 43 Nebraska $34,861,429\r\n15 Michigan $210,230,468 44 Delaware $26,893,098\r\n16 Ohio $208,874,675 45 Puerto Rico $24,234,782\r\n17 Nevada $205,388,286 46 West Virginia $23,208,701\r\n18 Colorado $202,127,121 47 South Dakota $23,169,159\r\n19 Massachusetts $180,158,815 48 North Dakota $20,083,064\r\n20 Minnesota $151,658,166 49 Alaska $18,610,389\r\n21 Tennessee $142,006,339 50 Rhode Island $14,125,096\r\n22 South Carolina $118,509,954 51 Wyoming $13,695,308\r\n23 Missouri $108,769,750 52 Vermont $7,532,107\r\n24 Utah $107,495,105 53 Virgin Islands, U.S. $1,056,161\r\n25 Indiana $99,629,036 54\r\nUnited States Minor\r\nOutlying Islands\r\n$1,045,183\r\n26 Alabama $93,813,940 55 Guam $696,853\r\n27 Connecticut $91,039,266 56 American Samoa $105,197\r\n28 Wisconsin $87,426,944 57 Northern Mariana\r\nIslands\r\n$1,000\r\n29 Hawaii $79,759,336\r\nPlease see Appendix B and C for additional information related to IC3 complaint data, crime types, and descriptors.\n\nF ED ER A L BU R EAU OF I NVE STIGATIO N\r\n \r\n58\r\nAppendix A: About IC3\r\nToday’s FBI is an intelligence-driven and threat-focused national security organization with\r\nboth intelligence and law enforcement responsibilities. The FBI is focused on protecting the\r\nAmerican people from terrorism, espionage, cyber-attacks, and major criminal threats,\r\nwhich are increasingly emanating from our digitally connected world. To do that, the FBI\r\nleverages IC3 as a mechanism to gather intelligence on cybercrime so that we can provide\r\nthe public and our many partners with information, services, support, training, and\r\nleadership to stay ahead of the threat.\r\nEvery day, IC3 receives thousands of complaints reporting a wide array of scams, many of\r\nthem targeting our most vulnerable populations. The information submitted to IC3 can be\r\nimpactful in the individual complaints, but it is most impactful in the aggregate. That is, when\r\nthe individual complaints are combined with other data, it allows the FBI to connect\r\ncomplaints, investigate reported crimes, track trends and threats, and, in some cases, even\r\nfreeze stolen funds. Just as importantly, IC3 shares reports of crime throughout its vast\r\nnetwork of FBI field offices and law enforcement partners, strengthening our nation’s\r\ncollective response both locally and nationally.\r\nIC3 was established in May 2000 to receive complaints crossing the spectrum of cyber\r\nmatters, to include cyber threats and cyber-enabled fraud in their many forms such as\r\nransomware, intrusions (hacking), extortion, international money laundering, investment\r\nfraud, and a growing list of crimes. As of this publication, IC3 has received over 10 million\r\ncomplaints. IC3’s mission is to provide the public and our partners with a reliable and\r\nconvenient reporting mechanism to submit information concerning suspected cyber-enabled criminal activity and to develop effective alliances with law enforcement and\r\nindustry partners to help those who report. Information is analyzed and disseminated for\r\ninvestigative and intelligence purposes for law enforcement and public awareness.\r\nTo promote public awareness and as part of its prevention mission, IC3 aggregates the\r\nsubmitted data and produces an annual report on the trends impacting the public as well as\r\nroutinely providing intelligence reports about trends. The success of these efforts is directly\r\nrelated to the quality of the data submitted by the public through the IC3.gov interface. Their\r\nefforts help IC3, and the FBI, better protect their fellow citizens.\r\nFrauds and scams will continue to evolve, but many characteristics of these schemes\r\nremain the same even as new trends develop. Review previous IC3 Annual Reports, PSAs,\r\nand Industry Alerts to further educate and protect yourself, as well as your family, friends,\r\nand community.\n\n59 2025 I C 3 AN NUA L R EPORT\r\n \r\nAppendix B: Definitions and Descriptors\r\nDefinitions\r\nAdvanced Fee Fraud: An individual pays money to someone in anticipation of receiving\r\nsomething of greater value in return but instead receives significantly less than expected or\r\nnothing.\r\nBusiness Email Compromise (BEC): BEC is a scam targeting businesses or individuals\r\nworking with suppliers and/or businesses regularly performing wire transfer payments.\r\nThese sophisticated scams are carried out by fraudsters by compromising email accounts\r\nand other forms of communication such as phone numbers and virtual meeting\r\napplications, through social engineering or computer intrusion techniques to conduct\r\nunauthorized transfer of funds.\r\nBotnet: A botnet is a group of two or more computers controlled and updated remotely for\r\nan illegal purchase such as a Distributed Denial of Service or Telephony Denial of Service\r\nattack or other nefarious activity.\r\nCharity: Using deception to get money from individuals believing they are making donations\r\nto legitimate charities and/or charities representing victims of natural disasters shortly after\r\nthe incident occurs.\r\nConfidence/Romance Fraud: An individual believes they are in a relationship (family,\r\nfriendly, or romantic) and are tricked into sending money, personal and financial information,\r\nor items of value to the perpetrator or to launder money or items to assist the perpetrator.\r\nThis includes the Grandparent’s Scheme and any scheme in which the perpetrator preys on\r\nthe targeted individual’s “heartstrings.”\r\nCredit Card Fraud/Check Fraud: Credit card fraud is a wide-ranging term for theft and fraud\r\ncommitted using a credit card or any similar payment mechanism (ACH, EFT, recurring\r\ncharge, etc.) as a fraudulent source of funds in a transaction.\r\nData Breach: A data breach in cyber context is the use of a computer intrusion to acquire\r\nconfidential or secure information. This does not include computer intrusions targeting\r\npersonally owned computers, systems, devices, or personal accounts such as social media\r\nor financial accounts.\r\nEmployment Fraud: An individual believes they are legitimately employed and loses money,\r\nor launders money/items during their employment.\r\nExtortion: Unlawful extraction of money or property through intimidation or undue exercise\r\nof authority. It may include threats of physical harm, criminal prosecution, or public\r\nexposure.\r\nGovernment Impersonation: A government official is impersonated to collect or extort\r\nmoney.\r\nHarassment/Stalking: Repeated words, conduct, and/or action that serve no legitimate\r\npurpose and are directed at a specific person to annoy, alarm, or distress that person.\r\nEngaging in a course of conduct directed at a specific person that would cause a reasonable\n\nF ED ER A L BU R EAU OF I NVE STIGATIO N\r\n \r\n60\r\nperson to fear for his/her safety or the safety of others or suffer substantial emotional\r\ndistress.\r\nIdentity Theft: Someone wrongfully obtains and uses personally identifiable information in\r\nsome way that involves fraud or deception, typically for economic gain.\r\nInvestment Fraud: Deceptive practice that induces investors to make purchases based on\r\nfalse information. These scams usually offer those targeted large returns with minimal risk.\r\n(Retirement, 401K, Ponzi, Pyramid, etc.).\r\nIntellectual Property Rights (IPR)/Copyright and Counterfeit: The illegal theft and use of\r\nothers’ ideas, inventions, and creative expressions – what’s called intellectual property –\r\neverything from trade secrets and proprietary products and parts to movies, music, and\r\nsoftware.\r\nLottery/Sweepstakes/Inheritance Fraud: An individual is contacted about winning a\r\nlottery or sweepstakes they never entered, or to collect on an inheritance from an unknown\r\nrelative.\r\nMalware: Software or code intended to damage, disable, or capable of copying itself onto a\r\ncomputer and/or computer systems to have a detrimental effect or destroy data.\r\nNon-Payment/Non-Delivery Fraud: Goods or services are shipped, and payment is never\r\nrendered (non-payment). Payment is sent, and goods or services are never received, or are\r\nof less quality (non-delivery).\r\nOther: Criminal or civil matters not currently designated as an IC3 crime type.\r\nOverpayment: An individual is sent a payment/commission and is instructed to keep a\r\nportion of the payment and send the remainder to another individual or business.\r\nPersonal Data Breach: A leak/spill of personal data which is released from a secure location\r\nto an untrusted environment. Also, a security incident in which an individual’s sensitive,\r\nprotected, or confidential data is copied, transmitted, viewed, stolen, or used by an\r\nunauthorized individual.\r\nPhishing/Spoofing: The use of unsolicited email, text messages, and telephone calls\r\npurportedly from a legitimate company requesting personal, financial, and/or login\r\ncredentials.\r\nRansomware: A type of malicious software designed to block access to a computer system\r\nuntil money is paid.\r\nReal Estate Fraud: Loss of funds from a real estate investment or fraud involving rental or\r\ntimeshare property.\r\nSIM Swap: The use of unsophisticated social engineering techniques against mobile service\r\nproviders to transfer a victim’s phone service to a mobile device in the criminal’s possession.\r\nTech/Customer Support Fraud: Subject posing as technical or customer support/service.\r\nThreats of Violence: An expression of an intention to inflict pain, injury, self-harm, or death\r\nnot in the context of extortion.\n\n61 2025 I C 3 AN NUA L R EPORT\r\n \r\nDescriptors\r\nA Descriptor relates to the medium or tool used to facilitate crime and is used by IC3 for\r\ntracking purposes only. It is available as a descriptor only after a crime type has been\r\nselected.\r\nAI Related: Information reported contains a reference to artificial intelligence (AI).\r\nCrimes Against Children: Related to the sexual abuse/exploitation of children, including\r\nchild abuse, of complainants age 17 or younger. This descriptor can also be applied when a\r\nperson from another age group is reporting a crime against a child on behalf of the\r\ncomplainant.\r\nCryptocurrency: Information reported contains some reference to virtual currency.\n\nF ED ER A L BU R EAU OF I NVE STIGATIO N\r\n \r\n62\r\nAppendix C: Additional Information about IC3 Data\r\n• As appropriate, complaints are reviewed by IC3 analysts who apply descriptive data,\r\nsuch as crime type and adjusted loss.\r\n• Descriptive data for complaints, such as crime type or loss, is variable and can evolve\r\nbased upon investigative or analytical proceedings. Statistics are an assessment taken\r\nat a point in time, which may change.\r\n• Complainants are not required to provide an age range. Not all complaints include an\r\nassociated age range. Those without this information are excluded from tables depicting\r\nage ranges.\r\n• Each complaint will only have one crime type.\r\n• Complainant is identified as the individual filing a complaint.\r\n• Some complainants may have filed more than once, creating a possible duplicate\r\ncomplaint. Losses are de-duplicated as much as possible.\r\n• Losses reported in foreign currencies are converted to U.S. dollars when possible.\r\n• Regarding Ransomware adjusted losses: This number does not include estimates of lost\r\nbusiness, time, wages, files, or equipment, or any third-party remediation services\r\nacquired by an entity. In some cases, entities do not report any loss amount to the FBI,\r\nthereby creating an artificially low overall ransomware loss rate. Lastly, the number only\r\nrepresents what entities report to the FBI via IC3 and do not account for the entity directly\r\nreporting to FBI field offices/agents.\r\n• Regarding Business Email Compromise counts: A whole number is given to depict the\r\noverall complaint count and includes when a 60+ complainant may be reporting on\r\nbehalf of a business or personally.\r\n• All location-based reports are generated from information entered when known/provided\r\nby the complainant.\r\no Regarding State-related statistics: This information is based on the total number of\r\ncomplaints from each state, American Territory, and the District of Columbia when\r\nthe complainant provided state information.\r\no Complaint counts represent the number of individual complaints received from each\r\nstate and do not represent the number of individuals filing a complaint.\r\no Per 100K Citizens: This information is based on the estimated 2025 Census estimated\r\ndata and the total number of complaints from each state, the District of Columbia,\r\nand Puerto Rico for which the complainant provided state information.\r\nhttps://www.census.gov/data/tables/time-series/demo/popest/2020s-state-total.html#v2025\n\n63 2025 I C 3 AN NUA L R EPORT\r\n \r\nAppendix D: Public Service Announcements Published in 2025\r\nTitle Date\r\nThreat of Copycat Attacks after ISIS-Inspired Vehicle Attack in New Orleans 13-Jan-25\r\nBeware of Charitable Fraud Related to Mass Casualty and Disaster Events 16-Jan-25\r\nNorth Korean IT Workers Conducting Data Extortion 23-Jan-25\r\nMail Theft-Related Check Fraud is on the Rise 27-Jan-25\r\nNorth Korea Responsible for $1.5 Billion Bybit Hack 26-Feb-25\r\nSafety Concerns Related to Fraudulent Compounding Practices Associated with\r\nWeight Loss Drugs\r\n28-Feb-25\r\nBeijing Leveraging Freelance Hackers and Information Security Companies to\r\nCompromise Computer Networks Worldwide\r\n5-Mar-25\r\nMail Scam Targeting Corporate Executives Claims Ties to Ransomware 6-Mar-25\r\nViolent Online Networks Target Vulnerable and Underage Populations Across the\r\nUnited States and Around the Globe\r\n6-Mar-25\r\nIndividuals Target Tesla Vehicles and Dealerships Nationwide with Arson, Gunfire,\r\nand Vandalism\r\n21-Mar-25\r\nCriminal Actors Steal US Taxpayer Identity to File False Tax Returns and Claim\r\nRefunds\r\n2-Apr-25\r\nFBI Warns of Scammers Impersonating the IC3 18-Apr-25\r\nFBI Seeking Tips about PRC-Targeting of US Telecommunications\r\n(简体中文版) (繁體中文版)\r\n \r\n24-Apr-25\r\nCyber Criminals Impersonating Employee Self-Service Websites to Steal Victim\r\nInformation and Funds\r\n24-Apr-25\r\nThreat Actors Use \"Swatting\" to Target Victims Nationwide 29-Apr-25\r\nEmerging Discount Medical Insurance Scams 30-Apr-25\r\nCyber Criminal Proxy Services Exploiting End of Life Routers 7-May-25\r\nImpersonation Scheme Targeting Middle Eastern Students in the United States 13-May-25\r\nSenior US Officials Impersonated in Malicious Messaging Campaign 15-May-25\r\nCyber Criminals Defraud Hedera Hashgraph Network Non-Custodial Wallet Users\r\nThrough Nonfungible Token Airdrops Disguised as Free Rewards\r\n3-Jun-25\n\nF ED ER A L BU R EAU OF I NVE STIGATIO N\r\n \r\n64\r\nRecent Attacks Highlight Elevated Threat to Israeli and Jewish Communities 5-Jun-25\r\nHome Internet Connected Devices Facilitate Criminal Activity 5-Jun-25\r\nCriminals Posing as Legitimate Health Insurers and Fraud Investigators to Commit\r\nHealth Care Fraud\r\n27-Jun-25\r\nFraudsters Target US Stock Investors through Investment Clubs Accessed on Social\r\nMedia and Messaging Applications\r\n3-Jul-25\r\nNorth Korean IT Worker Threats to U.S. Businesses 23-Jul-25\r\nThe Com: Theft, Extortion, and Violence are a Rising Threat to Youth Online 23-Jul-25\r\nHacker Com: Cyber Criminal Subset of The Community (Com) is a Rising Threat to\r\nYouth Online\r\n23-Jul-25\r\nIn Real Life (IRL) Com: Violent Subset of The Community (Com) is a Rising Threat to\r\nYouth Online\r\n23-Jul-25\r\nUnsolicited Packages Containing QR Codes Used to Initiate Fraud Schemes 31-Jul-25\r\nFictitious Law Firms Targeting Cryptocurrency Scam Victims Combine Multiple\r\nExploitation Tactics While Offering to Recover Funds\r\n13-Aug-25\r\nRussian Government Cyber Actors Targeting Networking Devices, Critical\r\nInfrastructure\r\n20-Aug-25\r\nABA Foundation and FBI Release New Infographic to Help Americans Spot and Avoid\r\nDeepfake Scams\r\n4-Sep-25\r\nThreat Actors Spoofing the FBI IC3 Website for Possible Malicious Activity 19-Sep-25\r\nCriminals Impersonate US Health Insurance Providers and Chinese Law\r\nEnforcement to Target Chinese Speakers Residing in the United States\r\n(简体中文版)\r\n \r\n13-Nov-25\r\nCriminals Using Altered Proof-of-Life Media to Extort Victims in Virtual Kidnapping\r\nfor Ransom Scams\r\n5-Dec-25\r\nGreat Odds, High Risk: The FBI Encourages U.S. Bettors to Know the Risks of Illegal\r\nGambling\r\n17-Dec-25\r\nSenior U.S. Officials Continue to be Impersonated in Malicious Messaging Campaign 19-Dec-25\n\n65 2025 I C 3 AN NUA L R EPORT\r\n \r\nAppendix E: Industry Alerts Published in 2025\r\nTitle Date\r\nSecure by Demand: Priority Considerations for Operational Technology Owners and\r\nOperators when Selecting Digital Products\r\n13-Jan-25\r\nProduct Security Bad Practices 17-Jan-25\r\nThreat Actors Chained Vulnerabilities in Ivanti Cloud Service Applications 22-Jan-25\r\nGuidance on Digital Forensics and Protective Monitoring Specifications for Producers of\r\nNetwork Devices and Appliances\r\n4-Feb-25\r\nMalicious Cyber Actors Use Buffer Overflow Vulnerabilities to Compromise Software 12-Feb-25\r\n#StopRansomware: Ghost (Cring) Ransomware 19-Feb-25\r\n#StopRansomware: Medusa Ransomware 12-Mar-25\r\nFast Flux: A National Security Threat 3-Apr-25\r\nBADBAZAAR and MOONSHINE: Spyware Targeting Uyghur, Taiwanese, and Tibetan\r\nGroups and Civil Society Actors\r\n9-Apr-25\r\nPhishing Domains Associated with LabHost PhaaS Platform Users\r\n(LabHost Domains)\r\n29-Apr-25\r\nPrimary Mitigations to Reduce Cyber Threats to Operational Technology 6-May-25\r\nCyber Criminal Services Target End-of-Life Routers to Launch Attacks and Hide Their\r\nActivities\r\n7-May-25\r\nThreat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations 21-May-25\r\nRussian GRU Targeting Western Logistics Entities and Technology Companies 21-May-25\r\nAI Data Security 22-May-25\r\nSilent Ransom Group Targeting Law Firms 23-May-25\r\nInfrastructure Used to Manage Domains Related to Cryptocurrency Investment Fraud\r\nScams between October 2023 and April 2025\r\n(Funnull Technology Inc. Associated\r\nCAMEs)\r\n(Complete List of Domains Attributed to\r\nFunnull)\r\n \r\n29-May-25\r\n#StopRansomware: Play Ransomware 4-Jun-25\r\nPeople's Republic of China Cyber Threat Activity 20-Jun-25\r\nIranian Cyber Actors May Target Vulnerable US Networks and Entities of Interest 30-Jun-25\n\nF ED ER A L BU R EAU OF I NVE STIGATIO N\r\n \r\n66\r\n#StopRansomware: Interlock 22-Jul-25\r\nScattered Spider 29-Jul-25\r\nFoundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators 13-Aug-25\r\nCountering Chinese State-Sponsored Actors Compromise of Networks Worldwide to\r\nFeed Global Espionage System\r\n27-Aug-25\r\nCyber Criminal Groups UNC6040 and UNC6395 Compromising Salesforce Instances for\r\nData Theft and Extortion\r\n12-Sep-25\r\nCreating and maintaining a definitive view of your Operational Technology (OT)\r\nArchitecture\r\n29-Sep-25\r\n#StopRansomware: Akira Ransomware 13-Nov-25\r\nBulletproof Defense: Mitigating Risks From Bulletproof Hosting Providers 19-Nov-25\r\nPro-Russia Hacktivists Conduct Opportunistic Attacks Against US and Global Critical\r\nInfrastructure\r\n9-Dec-25\r\nPrinciples for the Secure Integration of Artificial Intelligence in Operational Technology 15-Dec-25\r\n \r\n \r\nAppendix F: IC3 QR Codes",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"origins": [
		"pdf"
	],
	"references": [
		"https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf"
	],
	"report_names": [
		"2025_IC3Report.pdf"
	],
	"threat_actors": [
		{
			"id": "1b1271d2-e9a2-4fc5-820b-69c9e4cfb312",
			"created_at": "2024-06-07T02:00:03.998431Z",
			"updated_at": "2026-04-29T06:58:56.876406Z",
			"deleted_at": null,
			"main_name": "RansomHub",
			"aliases": [],
			"source_name": "MISPGALAXY:RansomHub",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "d87fb380-03db-447c-a560-33e1b6e70e87",
			"created_at": "2025-05-29T02:00:03.231385Z",
			"updated_at": "2026-04-29T06:58:57.041728Z",
			"deleted_at": null,
			"main_name": "Luna Moth",
			"aliases": [
				"Silent Ransom",
				"TG2729"
			],
			"source_name": "MISPGALAXY:Luna Moth",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "9ddc7baf-2ea7-4294-af2c-5fce1021e8e8",
			"created_at": "2023-06-23T02:04:34.386651Z",
			"updated_at": "2026-04-29T06:58:58.007866Z",
			"deleted_at": null,
			"main_name": "Muddled Libra",
			"aliases": [
				"0ktapus",
				"Scatter Swine",
				"Scattered Spider"
			],
			"source_name": "ETDA:Muddled Libra",
			"tools": [],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "7da6012f-680b-48fb-80c4-1b8cf82efb9c",
			"created_at": "2023-11-01T02:01:06.643737Z",
			"updated_at": "2026-04-29T06:58:57.795751Z",
			"deleted_at": null,
			"main_name": "Scattered Spider",
			"aliases": [
				"Scattered Spider",
				"Roasted 0ktapus",
				"Octo Tempest",
				"Storm-0875",
				"UNC3944"
			],
			"source_name": "MITRE:Scattered Spider",
			"tools": [
				"WarzoneRAT",
				"Rclone",
				"LaZagne",
				"Mimikatz",
				"Raccoon Stealer",
				"ngrok",
				"BlackCat",
				"ConnectWise"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "6608b798-f92b-42af-a93f-d72800eeb3a3",
			"created_at": "2023-11-30T02:00:07.292Z",
			"updated_at": "2026-04-29T06:58:56.71531Z",
			"deleted_at": null,
			"main_name": "DragonForce",
			"aliases": [],
			"source_name": "MISPGALAXY:DragonForce",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "3fad11c6-4336-4b28-a606-f510eca5452e",
			"created_at": "2022-10-25T16:07:24.346573Z",
			"updated_at": "2026-04-29T06:58:58.236354Z",
			"deleted_at": null,
			"main_name": "Turbine Panda",
			"aliases": [
				"APT 26",
				"Black Vine",
				"Bronze Express",
				"Group 13",
				"JerseyMikes",
				"KungFu Kittens",
				"PinkPanther",
				"Shell Crew",
				"Taffeta Typhoon",
				"Turbine Panda",
				"WebMasters"
			],
			"source_name": "ETDA:Turbine Panda",
			"tools": [
				"Agent.dhwf",
				"Agentemis",
				"BleDoor",
				"Cobalt Strike",
				"CobaltStrike",
				"Derusbi",
				"Destroy RAT",
				"DestroyRAT",
				"FF-RAT",
				"FormerFirstRAT",
				"Hurix",
				"Kaba",
				"Korplug",
				"LOLBAS",
				"LOLBins",
				"Living off the Land",
				"Mivast",
				"PlugX",
				"RbDoor",
				"RedDelta",
				"RibDoor",
				"Sakula",
				"Sakula RAT",
				"Sakurel",
				"Sogu",
				"StreamEx",
				"TIGERPLUG",
				"TVT",
				"Thoper",
				"Winnti",
				"Xamtrav",
				"cobeacon",
				"ffrat"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "8c8fea8c-c957-4618-99ee-1e188f073a0e",
			"created_at": "2024-02-02T02:00:04.086766Z",
			"updated_at": "2026-04-29T06:58:56.786897Z",
			"deleted_at": null,
			"main_name": "Storm-1567",
			"aliases": [
				"Akira",
				"PUNK SPIDER",
				"GOLD SAHARA"
			],
			"source_name": "MISPGALAXY:Storm-1567",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "843f4240-33a7-4de4-8dcf-4ff9f9a8c758",
			"created_at": "2025-07-24T02:05:00.538379Z",
			"updated_at": "2026-04-29T06:58:57.518246Z",
			"deleted_at": null,
			"main_name": "GOLD FLAME",
			"aliases": [
				"DragonForce"
			],
			"source_name": "Secureworks:GOLD FLAME",
			"tools": [
				"ADFind",
				"AnyDesk",
				"Cobalt Strike",
				"FileSeek",
				"Mimikatz",
				"SoftPerfect Network Scanner",
				"SystemBC",
				"socks.exe"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "c3b908de-3dd1-4e5d-ba24-5af8217371f0",
			"created_at": "2023-10-03T02:00:08.510742Z",
			"updated_at": "2026-04-29T06:58:56.587412Z",
			"deleted_at": null,
			"main_name": "Scattered Spider",
			"aliases": [
				"Scatter Swine",
				"Storm-0971",
				"Starfraud",
				"Muddled Libra",
				"Oktapus",
				"Octo Tempest",
				"0ktapus",
				"DEV-0971",
				"UNC3944",
				"Scattered Swine"
			],
			"source_name": "MISPGALAXY:Scattered Spider",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "910b38e9-07fe-4b47-9cf4-e190a07b1b84",
			"created_at": "2024-04-24T02:00:49.516358Z",
			"updated_at": "2026-04-29T06:58:57.756962Z",
			"deleted_at": null,
			"main_name": "Akira",
			"aliases": [
				"Akira",
				"GOLD SAHARA",
				"PUNK SPIDER",
				"Howling Scorpius"
			],
			"source_name": "MITRE:Akira",
			"tools": [
				"Mimikatz",
				"PsExec",
				"AdFind",
				"Akira _v2",
				"Akira",
				"Megazord",
				"LaZagne",
				"Rclone"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "46a151bd-e4c2-46f9-aee9-ee6942b01098",
			"created_at": "2023-01-06T13:46:38.288168Z",
			"updated_at": "2026-04-29T06:58:56.156204Z",
			"deleted_at": null,
			"main_name": "APT19",
			"aliases": [
				"Black Vine",
				"TEMP.Avengers",
				"Group 13",
				"BRONZE FIRESTONE",
				"G0009",
				"Checkered Typhoon",
				"DEEP PANDA",
				"Codoso",
				"KungFu Kittens",
				"PinkPanther",
				"Shell Crew",
				"G0073",
				"Sunshop Group"
			],
			"source_name": "MISPGALAXY:APT19",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "d093e8d9-b093-47b8-a988-2a5cbf3ccec9",
			"created_at": "2023-10-14T02:03:13.99057Z",
			"updated_at": "2026-04-29T06:58:57.746126Z",
			"deleted_at": null,
			"main_name": "Scattered Spider",
			"aliases": [
				"0ktapus",
				"LUCR-3",
				"Muddled Libra",
				"Octo Tempest",
				"Scatter Swine",
				"Scattered Spider",
				"Star Fraud",
				"Storm-0875",
				"UNC3944"
			],
			"source_name": "ETDA:Scattered Spider",
			"tools": [
				"ADRecon",
				"AnyDesk",
				"ConnectWise",
				"DCSync",
				"FiveTran",
				"FleetDeck",
				"Govmomi",
				"Hekatomb",
				"Impacket",
				"LOLBAS",
				"LOLBins",
				"LaZagne",
				"Living off the Land",
				"Lumma Stealer",
				"LummaC2",
				"Mimikatz",
				"Ngrok",
				"PingCastle",
				"ProcDump",
				"PsExec",
				"Pulseway",
				"Pure Storage FlashArray",
				"Pure Storage FlashArray PowerShell SDK",
				"RedLine Stealer",
				"Rsocx",
				"RustDesk",
				"ScreenConnect",
				"SharpHound",
				"Socat",
				"Spidey Bot",
				"Splashtop",
				"Stealc",
				"TacticalRMM",
				"Tailscale",
				"TightVNC",
				"VIDAR",
				"Vidar Stealer",
				"WinRAR",
				"WsTunnel",
				"gosecretsdump"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "e424a2db-0f5a-4ee5-96d2-5ab16f1f3824",
			"created_at": "2024-06-19T02:03:08.062614Z",
			"updated_at": "2026-04-29T06:58:57.516698Z",
			"deleted_at": null,
			"main_name": "GOLD HARVEST",
			"aliases": [
				"Octo Tempest ",
				"Roasted 0ktapus ",
				"Scatter Swine ",
				"Scattered Spider ",
				"UNC3944 "
			],
			"source_name": "Secureworks:GOLD HARVEST",
			"tools": [
				"AnyDesk",
				"ConnectWise Control",
				"Logmein"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "1cf117f9-f478-4330-981c-0d95a97e78e4",
			"created_at": "2024-02-22T02:00:03.774779Z",
			"updated_at": "2026-04-29T06:58:56.818581Z",
			"deleted_at": null,
			"main_name": "LabHost",
			"aliases": [],
			"source_name": "MISPGALAXY:LabHost",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "009750b9-c282-49ea-a734-cfdc8e05548c",
			"created_at": "2025-09-06T02:00:03.716038Z",
			"updated_at": "2026-04-29T06:58:57.047152Z",
			"deleted_at": null,
			"main_name": "UNC6395",
			"aliases": [],
			"source_name": "MISPGALAXY:UNC6395",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "70929bd1-2bf9-4689-bfff-2bc6b113d3ed",
			"created_at": "2026-01-20T02:00:03.666874Z",
			"updated_at": "2026-04-29T06:58:57.065204Z",
			"deleted_at": null,
			"main_name": "UNC6040",
			"aliases": [],
			"source_name": "MISPGALAXY:UNC6040",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "c30358aa-384c-40ad-bac5-54aa6a40224a",
			"created_at": "2026-02-03T02:00:03.448178Z",
			"updated_at": "2026-04-29T06:58:57.086245Z",
			"deleted_at": null,
			"main_name": "Sinobi",
			"aliases": [],
			"source_name": "MISPGALAXY:Sinobi",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1777429304,
	"ts_updated_at": 1777450973,
	"ts_creation_date": 1776352304,
	"ts_modification_date": 1776352304,
	"files": {
		"pdf": "https://archive.orkl.eu/08e9e0ad5443356d56daf1ac7bff52dbb538463f.pdf",
		"text": "https://archive.orkl.eu/08e9e0ad5443356d56daf1ac7bff52dbb538463f.txt",
		"img": "https://archive.orkl.eu/08e9e0ad5443356d56daf1ac7bff52dbb538463f.jpg"
	}
}