An FBI friend called me a couple of months ago and asked if I remembered a case we had worked together. I didn’t. It took me a minute to work out why: the case was more than seven years old, and it had only just been resolved.
Seven years. In a fraud case, the window to get the money back is about a day. And we keep acting surprised that cybercrime losses keep climbing.
Seven years for the case, one day for the money
Stephen got a case in recently from one of our banking partners. A woman was trying to rent out a property she owns in Mexico. She went back and forth with scammers for several days, then finally sent a $23,000 wire. She noticed within a day, and that matters more than almost anything else about the case. The first day matters most, because money is easier to chase before it moves on, even internationally. That’s a rule of thumb from experience and not a legal deadline, and nothing guarantees the money comes back. Stephen is working the case with the authorities through FinCEN now. Many victims have never heard of the 24-hour wire recall window.
Now compare that to how long the rest of the system takes. Stephen has watched cases from 2017 and 2018 reach a conclusion only now. I started tracking a credential phishing operator in 2017. I had dossiers on him, I knew what country he was in, and other researchers had mapped his companies and fronts. He was arrested in 2025.
It doesn’t have to be that slow. Stephen has worked cases that resolved in 72 hours. When there’s motivation, it can move faster. The researchers aren’t short on information. We need someone to help us turn the key.
About $626 billion, and that’s with the gaps
I went and added up every cyber-enabled fraud and crime loss I could source from 2015 through 2025. The running total comes to about $626 billion. That number is a sum of the figures I could find, and it includes overlap, because the same loss can show up at the FBI, the FTC, and a bank, and surveys and complaint totals aren’t the same kind of number. It isn’t $626 billion in separately confirmed thefts. The floor is the FBI’s Internet Crime Complaint Center (IC3) alone, which comes to about $82 billion over the decade.
The stack shows who is doing the counting. IC3 and the FTC climb steadily on their own. Part of the big jump in 2020, from $18 billion to $86 billion, comes from sources that only start that year, like the Javelin/AARP identity fraud survey at $56 billion, so I wouldn’t read it as losses quadrupling overnight.
IC3 and the FTC keep climbing
Zoom in on the individual sources and the two with the longest, most continuous record keep climbing. IC3 losses went from $1.1 billion in 2015 to $20.9 billion in 2025. IC3 complaints went from 288,012 to 1,008,597, so the FBI now takes in more than a million reports a year. The FTC’s Consumer Sentinel numbers climb the same way, from about $0.9 billion in 2017 to $15.9 billion in 2025.
The dip in the dashed line in 2024 and the spike in 2025 come from sources starting and stopping. The Truecaller survey and the FinCEN elder-fraud filings end in 2023, and the ABA-cited Gallup survey shows up in 2025. Not every series rises, either. The Javelin/AARP and Truecaller survey figures fall in some years. For a longer view, follow the IC3 and FTC lines, since they measure the same thing every year. Neither has turned down since 2017.
I kept this graph on a linear scale on purpose. I tried a logarithmic axis first and went back, because a log axis squashes the climb and hides how many dollars are involved. The log view still teaches something, though. On a log chart, steady percentage growth draws as a straight line, and a line that bends downward would mean the problem is shrinking. IC3 losses grew 21, 33, and 26 percent in the last three years, and about 34 percent a year compounded over the decade, which is a rough endpoint calculation and not a forecasting model. If that pace holds, reported losses double roughly every two and a half years. I don’t know that it will hold, and I’d love to be wrong. Nothing in the IC3 data so far says it’s slowing.
What we know, and what we don’t
The numbers in these graphs are solid for what they cover. They come from the FBI’s IC3 annual reports, the FTC’s Consumer Sentinel data, FinCEN filings, the Secret Service, the Department of Justice, and published industry surveys. A few values I had to derive or approximate, such as the FTC’s 2018 figure, and those are listed at the bottom of this post.
Then there are the estimates. The Global Anti-Scam Alliance (GASA) puts scam losses worldwide at $442 billion for a single year. An underreporting-adjusted estimate attributed to the FTC lands near $196 billion for a single year, compared with the $12.5 billion people actually reported to the FTC in 2024. I kept both out of the running total and drew them as hollow markers, because they’re one-year estimates and not reports. They still matter, because they hint at how much sits outside every report.
Many losses likely never reach any agency. Every number above counts only the people who reported anyway, and only to the one agency they happened to find. IC3 is the tip of the iceberg, and Stephen points out that the banks see more of it than the FBI does because victims call the bank first. The ABA-cited Gallup survey puts 2025 losses at $68 billion, more than three times IC3’s $20.9 billion.
I tried to reconcile all of these sources, and I’m not convinced anyone can do it accurately with the data we have today. Some reports overlap, some measure completely different things, and some are surveys. I don’t have a defensible overlap-adjusted total to offer. The $82 billion IC3 figure is the floor I’d stand behind, and the real total sits above it. Even if you throw out everything except the FBI’s own numbers, the trend is deeply concerning. What bothers me most is that we still don’t know how much money is actually being stolen.
Nobody owns this
A victim can report the same crime to the FBI, the FTC, the FCC, the Secret Service, Homeland Security, a bank that files with FinCEN, or a consumer group. Each of them keeps its own count, and none of them shares it in a way that lets anyone add the counts up. I built the graphs above by hand, from a dozen sources, for exactly that reason.
The counts disagree, too. When I compared romance scam numbers a couple of years ago, another federal reporting channel showed nearly four times as many victims as IC3 did. Either that agency sees four times the victims, or the two aren’t counting the same way. I can’t tell you which, and I’m not sure anyone can, because nobody lines them up. Banks file suspicious activity reports with FinCEN, so those two sets of numbers should match closely. When totals sit that far apart, nobody has reconciled them.
I’ve worked cases that crossed four different states, and more than once I couldn’t work out who I was supposed to call. That’s ridiculous. We’re talking about people losing their savings, and sometimes nobody can say who owns the investigation. I’ve worked with the FBI for eleven years in one way or another, and I love the agents I’ve worked with. But as the place most of these reports land, the institution isn’t doing a good job on this. Wire fraud can end up with a white-collar squad or a cyber squad depending on the field office, and each office draws that line a little differently.
Stephen sees the other half of this when he talks to romance scam victims. They get drained: second mortgages, retirement accounts, crypto. Then a lot of them get flipped into money launderers. A scammer asks for their bank account and uses it to receive business email compromise funds or account takeover funds. The romance scam victim and the business that lost a wire are both cogs in the same operation, and a system that files them in separate silos can’t see that.
Stephen’s answer, which he worked on with the Secret Service, is one federal agency built for this problem, with three pillars. The first is rapid response, so that when money moves we go find it. The second is investigations and intelligence, which turn each case into a map of the group behind it. The third is education and awareness. I hate saying “more government.” I agree with him anyway. Six agencies each holding a slice hasn’t bent the curve yet.
Banks and platforms have to pick up the phone
Money is the lifeblood of these groups. When you cut it off, they have to change tactics, and every change exposes them a little more. That gives investigators better intelligence and prosecutors better cases. The people who can cut it off sit on the frontline: banks, fintech platforms, crypto exchanges, and domain registrars.
Stephen works to recover victim funds almost every day, and not everyone cooperates. He has had cases where a victim’s money landed in a mule account, the fraud was obvious, and the receiving bank’s answer was to send a subpoena. In his experience, a subpoena can take weeks. Stephen isn’t asking anyone to skip the legal process. He’s asking banks to freeze stolen bank funds before the subpoena arrives where their policies and the law allow it, and to tell him whether any money is left. Last month a financial institution never answered his team at all. Some of these companies call themselves fintech platforms instead of banks. If you move money, you’re part of this.
Platforms carry their share. I used to work with Meta and passed them romance scam accounts, between two and three million at the peak, and I valued that process. But search Facebook today for stolen Cash App cards, hacked PayPal or Netflix accounts, or the word “wire,” and you can pull up groups where people buy and sell exactly that. Pick any popular influencer and you’ll find an impersonation account within about five seconds. Meta leans on community reports, which means somebody has to get hit before the account comes down. Proactive work is possible. Sextortion schemes reach teenagers on these same platforms, and nobody is going to argue against protecting a kid from that.
How to reverse a fraudulent wire transfer
If you or someone you know just sent a wire to a scammer, here’s what I’d do, in this order. Nobody can promise the money comes back, and the odds fall with every hour. This is general information, not legal advice.
- Call the bank that sent the wire right away. Ask for a wire recall, and give them the receiving bank, account, and amount.
- Report it the same day to IC3 at ic3.gov and to the FTC.
- Ask about the FBI’s Financial Fraud Kill Chain if the wire was international. Published guidance describes it as covering wires of $50,000 or more sent within the last 72 hours, after a SWIFT recall has started, and it runs through your local FBI field office. Check the current criteria with the FBI before you rely on that.
- Save everything. Keep the original emails with full headers, the invoice, the wire confirmation, and any message that changed the bank details.
- Bring in an investigator early. A private investigator can trace the receiving accounts, contact the institutions holding the money, and package the facts so the bank, FinCEN, and law enforcement can act on them. Stephen and the Rexxfield team do this every week.
The bank recall and the Kill Chain both run on the same clock, which is why that first day matters so much.
Vendor email compromise
One thing that drives me nuts is how often a business assumes an email must be legitimate because it came from someone they’ve worked with for years. Attackers count on that. In a vendor email compromise (VEC), they sit inside a real conversation with a supplier, or a convincing copy of one, and change one thing: where the money gets sent. A fraudulent bank detail change invoice looks like routine paperwork because it arrives on a thread about a real purchase.
Business email compromise (BEC) usually impersonates someone inside your own company, like an executive asking an employee for an urgent payment. VEC impersonates someone outside it, which is why it can be harder to catch.
The difference shows up in the forensics. A BEC investigation looks at your mailboxes and your approval process. A VEC investigation adds another question: where did the compromise happen? It could be at the vendor, at your company, or at a lookalike domain pretending to be the vendor. Supply chain wire fraud recovery starts the same way as any other wire recovery, with a call to the bank and a recall request, and then needs that extra tracing work to find out who controls the account that received the money.
What I want to see happen
At a recent conference I heard that organizations in the UK and Australia have started pushing their fraud numbers down. The United States hasn’t, and every year we wait adds roughly another $20 billion to the FBI’s column alone, before counting anything that goes unreported. Here’s what Stephen and I are asking for.
- One agency for reporting and response. One place for victims to report, one set of numbers, and one team accountable for the trend, working the three pillars of rapid response, investigations and intelligence, and education and awareness.
- Cases measured in months. Take seven years down to a year or six months. We’ve seen 72 hours happen.
- Banks, fintechs, exchanges, and registrars that answer the phone. When a victim’s funds land with you and the fraud is clear, tell the investigator whether money is left, without waiting for a subpoena.
- Platforms that look before a victim gets hurt. Search for the stolen goods, the impersonators, and the wire-transfer groups your own platform is hosting, and take them down.
There is a silver lining, and it’s a small one. More people are looking at this problem and talking about it. Stephen calls it a Sisyphean fight, and he’s probably right, but more people pushing the rock helps. It’s Cybersecurity Awareness Month, so I’ll say it plainly: the big graph goes up, and we need it to go the other way.
Sources and notes
- FBI IC3 annual reports, 2015 to 2025: losses and complaint counts.
- FTC Consumer Sentinel, 2017 to 2025: reported fraud losses (2018 approximate).
- FinCEN: ransomware filings 2020 to 2024; elder financial exploitation filings ($27 billion from June 2022 to June 2023, split evenly across 2022 and 2023); scam-center filings ($5.4 billion, annualized).
- Surveys and other reports: Javelin/AARP identity fraud, 2020 to 2024; Truecaller phone scams, 2021 to 2023 (2021 derived from reported growth); Chainalysis crypto scam revenue (2020 derived from reported growth, no figures for 2022 and 2023); ABA-cited Gallup survey ($68 billion, 2025); DOJ elder fraud report (more than $2 billion); Secret Service FY2019 closed-case losses ($3.5 billion).
- Kept out of the total: the GASA global survey ($442 billion, one year), the FTC underreporting-adjusted estimate (about $196 billion, one year, approximate), and Nasdaq Verafin ($62 billion, global).
The $626 billion total adds everything above except those last three, so it counts overlap. I found no loss figure for Homeland Security Investigations. Wire recall guidance comes from ALTA’s summary of the FBI Financial Fraud Kill Chain, and the VEC and BEC description follows Cloudflare’s explainer on vendor email compromise.
Need help with a wire or a fraud case?
If you or your company just lost money to a wire fraud, a vendor email compromise, or a romance scam, the first day matters most. Stephen and I and the rest of the Rexxfield team trace stolen funds, work with banks and law enforcement, and package the facts so they can act. Contact Rexxfield and tell us what happened, and we will tell you what we can do.
