Cybercrime statistics from the FBI show $20.877 billion in reported losses in 2025, up 26% from $16.6 billion the year before. The FBI’s Internet Crime Complaint Center (IC3) received 1,008,597 complaints. This guide covers what the 2025 report says, where small businesses are exposed, and what to put in place first.
Last reviewed: October 6, 2026. This is general information, not legal or security advice.
Key takeaways
- Reported losses reached $20.877 billion in 2025, up from $16.6 billion in 2024 and about $3.5 billion in 2019.
- Complaints topped 1 million (1,008,597), an average of almost 3,000 a day.
- The average reported loss per complaint was $20,699.
- Investment fraud caused the largest losses ($8.65 billion). Business email compromise came second ($3.05 billion).
- Phishing and spoofing was the most common complaint, with 191,561 reports.
How cybercrime losses have grown since 2019
The FBI IC3 2025 Internet Crime Report puts reported losses at $20.877 billion. Figure 1 shows the climb from the 2019 report onward. Losses have risen every year in the series, and 2025 added more than $4 billion to the 2024 total.
Complaint counts moved less. The report counted 467,361 complaints for 2019 and 1,008,597 for 2025, so complaints about doubled while losses grew about sixfold. Each incident is costing more. IC3 also says that the figures cover only what victims choose to report, so they sit below the true total.
Which crimes cost the most
Investment fraud, much of it involving cryptocurrency, led with about $8.65 billion in losses. The category that matters most to a business owner is the second one. Business email compromise cost victims about $3.05 billion across 24,768 complaints in 2025, up from $2.77 billion in 2024.
Phishing and spoofing led the list by complaint count, with 191,561 reports. It carries smaller direct losses, at about $216 million, because it is usually the first step. A stolen password or a fake login page opens the door to the larger losses that follow.
What the FBI cybercrime statistics mean for a small business
Large figures can make this feel like a problem for banks and hospitals. Several details in the report point the other way. IC3’s ransomware section notes that more than 1,400 of the 2025 ransomware complaints came from businesses outside the critical infrastructure sectors. The top industries in that group were legal services (18%), contracting services (17%) and engineering and architectural firms (10%). Those are small and mid-size firms with a lot of client money and client data moving through email.
The age data shows who gets hit hardest. People 60 and older reported about $7.7 billion in losses, up 37% from 2024. For a business that serves older customers, such as a medical practice, a financial office or a property manager, that raises the odds that a customer will receive a convincing fake message that appears to come from you.
Four common crimes and a first safeguard for each
| Crime | What it looks like | First safeguard |
|---|---|---|
| Business email compromise | A fake invoice or a spoofed executive request leads to a wire | Email authentication (SPF, DKIM, DMARC), a call-back rule for payment changes |
| Phishing and spoofing | A staff member enters a password on a fake login page | Multi-factor authentication, filtering, short training sessions |
| Ransomware | Files are locked and a ransom is demanded | Tested offsite backups, patching, limited admin rights |
| Personal data breach | Customer records are taken from a poorly secured system | Encryption, least-privilege access, a monitored and patched website |
1. Lock down your email domain
Spoofed email is how many fake invoices and fake executive requests reach inboxes. Publishing SPF, DKIM and DMARC records tells receiving servers which messages really come from you. Our guide to SPF, DKIM and DMARC walks through the setup.
2. Add a call-back rule for payment changes
Any request to change bank details or to send an urgent wire gets confirmed by phone, using a number you already had on file. This one step defeats most business email compromise attempts.
3. Turn on multi-factor authentication everywhere
Start with email, banking, your website admin and any remote access. A stolen password alone then stops being enough.
4. Keep tested backups and a patched website
Ransomware and website compromises become a restore job when you have a recent clean copy stored away from the original. Test a restore at least once a year. If you want help with the technical side, our cybersecurity services cover monitoring, hardening and incident response.
Frequently asked questions about cybercrime statistics
What is the FBI IC3 report?
The FBI’s Internet Crime Complaint Center publishes an annual report built from complaints that victims file with it. The 2025 edition covers 1,008,597 complaints and $20.877 billion in reported losses. It counts only reported incidents, so real totals are higher.
How much money was lost to cybercrime in 2025?
Victims reported $20.877 billion in losses to the FBI IC3 in 2025. That is up 26% from $16.6 billion in 2024, and about six times the roughly $3.5 billion reported for 2019.
What is business email compromise?
Business email compromise is a scam where a criminal poses as an executive, vendor or colleague over email and tricks someone into sending a payment or sensitive data. IC3 logged 24,768 complaints and about $3.05 billion in losses for it in 2025.
Which crime type had the highest losses?
Investment fraud, at about $8.65 billion in 2025. Business email compromise came second at about $3.05 billion, and tech and customer support scams third at about $2.13 billion.
Do small businesses report these crimes?
Many do not, which is one reason the IC3 totals understate the problem. IC3 notes that its ransomware loss figures leave out lost business and remediation costs, and that many victims report no loss amount at all.