Online fraud in numbers: what the latest official reports show

Four sources, four ways of counting

Fraud statistics travel fast and lose their context on the way. This post sticks to four official or industry-wide sources, each in the latest edition available in August 2026: the FBI's 2025 Internet Crime Report, the Federal Trade Commission's figures for 2025 from its Consumer Sentinel Network, UK Finance's Annual Fraud Report 2026, which covers 2025, and the 2025 Report on Payment Fraud from the European Banking Authority (EBA) and the European Central Bank (ECB), which covers 2022 to 2024.

They measure different things. The FBI and the FTC count what victims report to them. UK Finance counts losses and cases reported by its member banks and card issuers. The EBA and the ECB count fraudulent transactions that payment service providers must report under European law. Every figure below is given as its source states it, and the figures should not be added together.

United States: complaints to the FBI

According to the FBI's 2025 Internet Crime Report, its Internet Crime Complaint Center (IC3) received 1,008,597 complaints in 2025, and the losses reported to it passed the 20 billion dollar mark, with losses up 26% from 2024.

The same report lists investment fraud as the largest source of loss, at 8,648,617,756 US dollars, followed by business email compromise at 3,046,598,558 US dollars and tech and customer support scams at 2,134,675,818 US dollars. By number of complaints, phishing and spoofing came first with 191,561, then extortion with 89,129 and investment fraud with 72,984.

The FBI's breakdown by age shows who loses the most: people aged 60 and over filed 201,266 complaints and reported 7.7 billion US dollars in losses, the largest total of any age group in the report. The report counts 181,565 complaints that involved cryptocurrency.

United States: reports to the FTC

In a press release on 25 March 2026, the FTC said it received 3 million fraud reports from consumers in 2025, who reported 15.9 billion US dollars in losses. In its testimony to the Joint Economic Committee the same day, the FTC said imposter scams were again the most frequently reported fraud, with over 1 million reports and over 3.5 billion US dollars in reported losses, while investment scams caused the largest losses, at over 7.9 billion US dollars.

The FTC's testimony also says consumers reported the highest total losses when they sent money by bank payment, followed by cryptocurrency, while credit cards were the payment method named most often in fraud reports. In an April 2026 Data Spotlight, the FTC reported that 28% of people who reported losing money to a scam in 2025 said it started on social media, and that those losses reached 2.1 billion US dollars.

Both agencies stress that these are reported figures. The FTC's testimony notes that not every consumer who loses money to a scam reports it, so actual losses are higher than the totals above.

United Kingdom: losses reported by banks

UK Finance's Annual Fraud Report 2026 says criminals stole 1.28 billion pounds through payment fraud in 2025. The report splits fraud into two kinds, and the split matters for anyone building controls.

Unauthorised fraud is a payment the account holder did not make, such as a stolen card used online. UK Finance reports unauthorised losses of 703.4 million pounds in 2025, down 5% from 2024, across 3.81 million confirmed cases. It says the industry prevented a further 1.68 billion pounds of unauthorised fraud, which it describes as 70p in every pound of attempted fraud.

Authorised push payment (APP) fraud is a payment the account holder did make, because a criminal tricked them. UK Finance reports APP losses of 576.4 million pounds across 248,070 cases in 2025. Investment scams were the largest APP category by value, at 221.5 million pounds, and purchase scams the largest by number, with 175,809 cases. Its analysis of where APP cases start found that 66% were enabled by online sources and 17% by telecommunications.

European Economic Area: fraud reported by payment providers

The EBA and ECB 2025 Report on Payment Fraud puts the value of payment fraud reported across the European Economic Area (EEA) at about 4.5 billion US dollars in 2024. Fraudulent credit transfers accounted for about 2.7 billion US dollars and fraudulent card payments, with cards issued in the EU/EEA, for about 1.4 billion US dollars. Amounts converted from euros at the ECB's 2024 average reference rate of 1.08 US dollars per euro.

Two findings matter most for fraud teams. Manipulation of the payer accounted for more than half of the total value of fraudulent credit transfers, which is the European counterpart of the scams UK Finance counts as APP fraud. And card fraud happened mostly in payments made remotely: the report says remote card payment fraud made up around 83% of all card fraud in 2024, while remote payments were only around 28% of the value of card transactions.

What the reports agree on

Put the four sources next to each other and they tell a consistent story. Scams that persuade people to send money are among the largest sources of loss in every one of them: investment scams cause the largest losses in the FBI and FTC figures and the largest APP losses in UK Finance's, and payer manipulation leads credit transfer fraud in the EEA. Card fraud has moved online, where the card is not present. And losses happen at a few specific moments: a login, a change to account details, a new payee, a payout.

Those moments are where a decision can still stop the money. Once a payment has left, recovering it depends on how quickly banks and law enforcement can act, which is slower and less certain than not sending it.

How FRAPE uses this

FRAPE scores the events where this fraud happens, payments, sign-ups, logins, profile changes and payouts, through one API call. Rules and lists stop known fraud first, your own data and data providers fill in what is missing, FRAPE Decision Core gives advice on the events the rules cannot settle, and your policy makes the final call: approve, challenge, review or decline. If Decision Core fails or times out, the event is never approved automatically.

Every decision comes back with its reasons, so your analysts can see why a payment was challenged or a payout was held.

• How a FRAPE decision is made
• Decision Core features