iOn March 6, 2024, the FBI’s Internet Crime Complaint Center (IC3) released its Internet Crime Report for 2023. The report offers key insights into the cyberthreat landscape based upon aggregated data from complaints reported during the last calendar year. As with prior IC3 annual reports, the 2023 report reveals alarming increases in both the frequency and financial impact of online fraud perpetrated by cybercriminals and nation-states against individuals, businesses, government agencies, and public infrastructure.
What is the IC3?
Established in May 2000, the IC3 operates an online portal (www.ic3.gov) to receive complaints from the general public on a wide array of internet-facilitated crimes. The IC3 analyzes and disseminates intelligence from the portal for investigative and law enforcement purposes, and also uses the data to promote awareness through public service announcements, industry alerts, and annual reports.
Total Complaints Reported in 2023
In 2023, the IC3 received 880,418 complaints with total reported losses of $12.5 billion. The number of complaints in 2023 increased nearly 10% from 2022, and over 88% compared to 2019. Total reported losses in 2023 rose nearly 22% from 2022, and over 257% since 2019.
Source: IC3 2023 Internet Crime Report
Most Frequently Reported Crime Types in 2023
As with 2019-2022, by far the most frequently reported crime in 2023 was “phishing/spoofing,” which the IC3 defines as “[t]he use of unsolicited email, text messages, and telephone calls purportedly from a legitimate company requesting personal, financial, and/or login credentials.” Phishing accounted for approximately 34% of all complaints reported, followed by personal data breach, non-payment/non-delivery, extortion, and tech support scams.
Reported Monetary Losses in 2023
The highest reported losses in 2023 were, by far, attributable to “investment scams,” with losses of $4.57 billion, up 38% from 2022. Investment fraud with reference to cryptocurrency accounted for over 86% of these losses. The IC3 defines an “investment” scam as a “[d]eceptive practice that induces investors to make purchases based on false information. These scams usually offer those targeted large returns with minimal risk. (Retirement, 401K, Ponzi, Pyramid, etc.).” The IC3 issued several public service announcements on these threats in 2023, with particular emphasis on cryptocurrency investment schemes.
Source: IC3 2023 Internet Crime Report
Complaints involving business email compromise (BEC) accounted for the second-highest total losses in 2023—over $2.9 billion, up 7.5% from 2022. The IC3 describes BEC as “a sophisticated scam targeting both businesses and individuals performing transfers of funds. The scam is frequently carried out when a subject compromises legitimate business email accounts through social engineering or computer intrusion techniques to conduct unauthorized transfers of funds.” According to the report, BEC scams have historically involved compromised vendor emails, requests for W-2 information, targeting of the real estate sector, and requests for large amounts of gift cards, but have increasingly used custodial accounts held at financial institutions for cryptocurrency exchanges or third-party payment processors. The IC3 recommends two-factor or multi-factor authentication and careful scrutiny of email communications as best practices to combat BEC.
Complaints of government impersonation and tech and customer support scams accounted for reported losses of over $1.3 billion in 2023. Such scams heavily target older adults. Individuals over the age of 60 accounted for 40% of these complaints and 58% of the losses.
Ransomware complaints were also prevalent in 2023, affecting 14 of 16 critical infrastructure sectors, most notably the healthcare and public health, critical manufacturing, government facilities, information technology, and financial services sectors.
Geographic Breakdown of Reported Complaints in 2023
California led all states in both complaints (77,271) and losses ($2.16 billion), followed by Texas (47,305 complaints, $1.022 billion losses) and Florida (41,061 complaints, $874.7 billion losses). Complaints also poured in from outside the United States, including 288,355 complaints from the United Kingdom, 6,061 from Canada, and 3,405 from India.
IC3 Recovery Asset Team
The report touts the IC3’s Recovery Asset Team (RAT). Established in February 2018, RAT interfaces with financial institutions and assists FBI field offices with the freezing of domestic funds transfers using a tool known as a Financial Fraud Kill Chain (FFKC). An FFKC is a process used to recover international wire transfers of at least $50,000.00 within 72 hours after the wire has occurred, where a SWIFT recall notice has been initiated. In 2023, RAT initiated FFKCs on 3,008 reported incidents with potential losses at stake of $758.05 million. Of these, monetary holds were successfully placed on $538.39 million—a 71% success rate. However, the funds successfully frozen by RAT amount to just 4.3% of total reported losses in 2023, underscoring the substantial obstacles faced by law enforcement in effectively combatting cyberthreats.
IC3 Appeals for Increased Public Reporting
The IC3 assesses that these statistics are actually a “conservative” depiction of cybercrime in 2023. To support this, the IC3 notes anecdotally that the FBI infiltrated the Hive ransomware group’s infrastructure and determined that only 20% of Hive’s victims had reported to law enforcement. Thus, in addition to promoting two-factor or multi-factor authentication and best practices in handling email communications, the IC3 urges increased public reporting as the best defense against the rising tide of cyberthreats, stating:
The information submitted to the IC3 can be impactful in the individual complaints, but it is most impactful in the aggregate. That is, when the individual complaints are combined with other data, it allows the FBI to connect complaints, investigate reported crimes, track trends and threats, and, in some cases, even freeze stolen funds. Just as importantly, the IC3 shares reports of crime throughout its vast network of FBI field offices and law enforcement partners, strengthening our nation’s collective response both locally and nationally.
To promote public awareness and as part of its prevention mission, the IC3 aggregates the submitted data and produces an annual report on the trends impacting the public as well as routinely providing intelligence reports about trends. The success of these efforts is directly related to the quality of the data submitted by the public through the www.ic3.gov interface. Their efforts help the IC3, and the FBI better protect their fellow citizens.
If you or your business have been victimized by an internet-facilitated crime and are seeking to recover misappropriated funds, every moment is critical. IMMEDIATELY notify all financial institutions involved in the relevant transactions, file a complaint at www.ic3.gov, contact your nearest FBI field office, and contact local law enforcement.
