June 5, 2023 By Jonathan Reed 4 min read

The introduction of the most recent FBI Internet Crime Report says, “At the FBI, we know ‘cyber risk is business risk’ and ‘cybersecurity is national security.’” And the numbers in the report back up this statement. The FBI report details more than 800,000 cyber crime-related complaints filed in 2022. Meanwhile, total losses were over $10 billion, shattering 2021’s total of $6.9 billion, according to the bureau’s Internet Crime Complaint Center (IC3).

Top five cyber crime types

In the past five years, the IC3 received a total of 3.26 million complaints for $27.6 billion in losses. During 2022, the top five cyber crime types were:

  1. Phishing: 300,497 complaints.
  2. Personal Data Breach: 58,859 complaints.
  3. Non-Payment / Non-Delivery: 51,679 complaints.
  4. Extortion: 39,416 complaints.
  5. Tech Support: 32,538 complaints.

The FBI also outlined various threat overviews in their report. These overviews included business email compromise (BEC), investment scams, ransomware and call center fraud.

Business email compromise (BEC)

In 2022 the IC3 received 21,832 complaints related to BEC, which caused losses of over $2.7 billion. In BEC scams, fraudsters use social engineering or hacking methods to gain access to legitimate business email accounts to enable unauthorized transfers of funds.

As the battle between threat actors and security teams escalates, BEC has also evolved. Historically, these schemes relied on compromised vendor emails, W-2 information requests, real estate sector scams or asking for large amounts of gift cards. More recently, attackers increasingly utilize custodial accounts held at financial institutions for cryptocurrency exchanges. They may also request victims to send funds directly to cryptocurrency platforms where funds can be quickly dispersed.

Last year, the IC3 also noticed a subtle shift in the targets of BEC scams. Actors are now targeting victims’ investment accounts in addition to traditional banking accounts. Furthermore, bad actors are increasingly spoofing legitimate business phone numbers to confirm fraudulent banking transactions. This technique is particularly effective as it provides the appearance of legitimacy to the scam.

As a result, the FBI stresses multi-factor authentication as essential for adequate security. It’s also crucial to scrutinize all email addresses, URLs and spelling used in any bank correspondence. Users should never click on links in unsolicited emails or text messages that request to verify account information.

Investment scams

The IC3 report revealed that the most costly cyber crime category in 2022 was investment fraud. The complaints related to investment fraud nearly doubled from $1.45 billion in 2021 to $3.31 billion in 2022, an increase of 127%. Among these complaints, cryptocurrency investment fraud accounted for a major portion of reported losses, rising from $907 million in 2021 to $2.57 billion in 2022 (183% increase).

Reports indicate that the most targeted individuals for this type of fraud are aged between 30 to 49. This highlights the need for increased awareness and caution when it comes to investing in cryptocurrencies.

Some common crypto-investment scams outlined in the IC3 report include:

  • Liquidity mining: Victims are duped into linking their cryptocurrency wallet to a fraudulent liquidity mining application that siphons funds without authorization.
  • Social engineering: Actors use hacked social media accounts to perpetrate fraudulent investment opportunities using cryptocurrency. This involves targeting existing friends of the hacked user.
  • Celebrity impersonation: Scammers impersonate celebrities or social figures to engage with a target. Actors then entice the victim with false cryptocurrency investment opportunities, which are actually schemes to take money from victims.
  • Real estate agent: Cyber criminals contact real estate agents and offer to buy a property for cash or cryptocurrency. Once engaged, the fraudster exposes details about fictitious accounts with a purported value of millions of dollars. The actors then entice real estate agent victims to engage in an investment scheme.
  • Job scams: Victims apply for fake jobs posted online at an investment firm or company affiliated with investing. Instead of a job offer, the victims are offered fraudulent investment advice designed to steal their money.


The IC3 reported that in 2022, it received a total of 2,385 complaints classified as ransomware. Adjusted losses associated with ransomware totaled more than $34.3 million.

Phishing, Remote Desktop Protocol (RDP) exploitation and software vulnerabilities were the most commonly reported initial infection vectors for ransomware incidents reported to the IC3. Businesses and individuals must take steps to protect themselves against these types of attacks, including keeping software and systems up to date, implementing strong access controls and educating employees on how to spot phishing attempts.

The top five sectors affected by ransomware, according to the IC3 report, are:

  1. Healthcare and Public Health
  2. Critical manufacturing
  3. Government facilities
  4. Information Technology
  5. Financial services.

The top three ransomware variants reported to the IC3 were:

  1. Lockbit: 149 incidents.
  2. ALPHV/BlackCat: 114 incidents.
  3. HIVE: 87 incidents.

The FBI does not encourage paying a ransom to criminal actors. The IC3 report says:

“Paying a ransom may embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware and/or fund illicit activities. Paying the ransom also does not guarantee that a victim’s files will be recovered.”

Call center fraud

As per the IC3, illegitimate call centers defraud thousands of victims every year. Tech / Customer Support Fraud and Government Impersonation were responsible for over $1 billion in losses in 2022. Call centers overwhelmingly target the elderly, with devastating effects. Almost half the victims report to be over 60 (46%) and experience 69% of the losses (over $724 million).

The majority of call center scams originate from South Asia, particularly India. For this reason, the Department of Justice (DOJ) and the FBI are partnering with law enforcement in India (Central Bureau of Investigation in New Delhi and local Indian states) to combat cyber financial crimes and transnational call center fraud.

U.S. victims of call center fraud have provided testimony for use in legal proceedings against the alleged perpetrators. The IC3 states that this joint effort between U.S. and Indian law enforcement agencies is critical in bringing these criminals to justice and preventing future victimization.

Fighting cyber crime loss

When it comes to ransomware, the FBI report states, “Regardless of whether you or your organization have decided to pay the ransom, the FBI urges you to report ransomware incidents to the IC3. Doing so provides investigators with the critical information they need to track ransomware attackers, hold them accountable under U.S. law and prevent future attacks.”

More from News

State Department releases International Cyberspace and Digital Policy Strategy

3 min read - U.S. Secretary of State Antony Blinken announced the new U.S. International Cyberspace and Digital Policy Strategy during the recent RSA Conference in San Francisco. The strategy emphasizes the role of technology in diplomacy and the urgent need to build international coalitions.“Security, stability, prosperity — they are no longer solely analog matters,” Blinken said at the conference.The new strategy focuses on “digital solidarity” not “digital sovereignty,” Blinken said, emphasizing the importance of collaboration with like-minded nations. Also mentioned was the need…

DHS establishes Artificial Intelligence Safety and Security Board

3 min read - As part of its commitment to addressing the rapid growth and adoption of AI technology across all industries and sectors, the Department of Homeland Security (DHS) announced the establishment of the Artificial Intelligence Safety and Security Board in late April. The Board’s first meeting is planned for early May when they will begin the task of focusing on how to develop and deploy AI technology within the United States’ critical infrastructure safely and securely. Based on the DHS Homeland Threat…

White House cements CISA’s role as national coordinator for cybersecurity

2 min read - In 2013, the Obama Administration rolled out "The Presidential Policy Directive (PPD) on Critical Infrastructure Security and Resilience", a forerunner to the Cybersecurity and Infrastructure Security Agency (CISA), created "to strengthen and maintain secure, functioning and resilient critical infrastructure." The directive was groundbreaking in 2013, noting the importance of the rising risk of cyberattacks against critical infrastructure. But as cyber risks are constantly shifting, every cybersecurity program needs to be re-evaluated, and CISA is no exception. That’s why, in April 2024,…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today