Let’s do this.

Cybercrime · Learn

What’s true about cybercrime.

Ten minutes. Nine facts, six words that get misused, and the places where the numbers disagree. The point of knowing them: you’ll stop worrying about the wrong threats and spend your hour on the right ones.

Do the thing Practice

Nine facts

  1. Americans reported $20.9 billion in losses to the FBI in 2025, from just over a million complaints. Up 26% in a year. The FTC separately logged 3 million fraud reports and $15.9 billion. Don’t add them: the FBI’s data feeds the FTC’s.12
  2. The true figure is higher, because most people never report. The FTC’s estimate for all consumer fraud in 2024, adjusted for under-reporting, runs as high as $195.9 billion.2
  3. “Trillions a year” is a forecast, not a measurement. It comes from a 2020 security-industry projection that counts lost productivity and reputation and publishes no data collection. Academics who tried to total global cybercrime declined to give one number.3
  4. People over 60 lost $7.7 billion, more than any other age group. Most of it to fraud, not hacking: people talked into paying.1
  5. The most common crime is a fake message. Phishing and spoofing drew 191,561 complaints in 2025, the largest category. Business email scams, a fake invoice or a changed bank detail, cost $3.05 billion.1
  6. AI fraud is now counted: 22,364 complaints and $893 million in 2025. Cloned-voice “I’m in trouble, send money” calls alone took over $5 million.1
  7. Speed matters after a theft. The FBI’s recovery team chased $1.16 billion in 2025 and froze $679 million of it. Frozen isn’t always returned, and money moved to crypto or gift cards is mostly gone.1
  8. The headline attacks are real and mostly not about you. North Korea took $1.5 billion from one crypto exchange. Chinese intelligence sat inside telecom networks in at least five countries, by an advisory 13 governments signed. Two UK retailers lost an estimated £270 to £440 million to one ransomware crew, four of whom were arrested aged 17 to 20. None of these reached a household through the household’s own door.4
  9. The encryption that protects websites and messages has a replacement ready. US standards for quantum-resistant encryption were finalised in August 2024; the UK’s migration timeline runs to 2035. Agencies warn attackers may be storing encrypted data to read later; no public case has confirmed it.5

Six words that get misused

Hacked
Usually means one of three different things: your password leaked from someone else’s breach and was reused; you were talked into handing over a code or a payment; or, rarely, software on your device was broken into. The first two are almost everything that reaches a household.
Phishing
A message pretending to be someone you trust, to get a click, a code or a payment. By text it’s called smishing; by phone, vishing. Same crime.
SIM swap · port-out
A thief convinces your carrier to move your phone number to their SIM, then receives your text codes. The “number lock” on the Do page is the fix.
Passkey
A sign-in tied to your device and your face or fingerprint. Nothing to type, nothing to phish. Supported by Google, Apple and Microsoft; not yet by many banks.
Credit freeze
Blocks anyone opening new credit in your name at a bureau. Free by law, no effect on your score, lifted online in under an hour when you need it. Different from a fraud alert, which only asks lenders to check.
Ransomware
Software that encrypts an organisation’s files and demands payment. It hits hospitals, schools and retailers far more than individuals, which is why backups are on your list anyway: a lost phone does the same damage to you.

Where the sources disagree

How big it is. $20.9 billion (reported to the FBI), $15.9 billion (reported to the FTC), up to $195.9 billion (FTC’s under-reporting estimate), approaching $1 trillion globally (a 2020 industry-funded estimate), $10.5 trillion (a 2020 projection). Each measures something different, and the biggest numbers rest on surveys where a few unverified answers dominate the total. This site uses the reported FBI figure and says so.123

Whether “harvest now, decrypt later” is happening. Governments treat it as a planning assumption. No attributed case is public. Say “may be”.5

Whether a password manager is a risk. One big one was breached in 2022 and encrypted vaults were copied; strong master passwords held. The UK’s security agency still recommends them, because the alternative, reusing passwords, fails every time one site leaks.6

Read the originals

Next

Do the thing: one hour Practice: scam or not?

Sources

  1. FBI Internet Crime Complaint Center, 2025 Internet Crime Report, April 2026: 1,008,597 complaints, $20.877 billion; over-60s $7.7 billion; phishing/spoofing 191,561; BEC $3.05 billion; AI 22,364 complaints, $893 million; RAT froze $679 million of $1.16 billion. primary
  2. FTC, testimony to the Joint Economic Committee and the written statement, 25 March 2026. primary
  3. CSIS and McAfee, The Hidden Costs of Cybercrime, 9 December 2020 (global losses “approach $1 trillion”) industry research; Cybersecurity Ventures, cybercrime damage projection, 13 November 2020 industry projection; Anderson et al., Measuring the changing cost of cybercrime, 2019 research; Florêncio and Herley, Sex, lies and cyber-crime surveys, 2011 research.
  4. FBI, North Korea responsible for $1.5 billion Bybit theft, 26 February 2025; joint advisory AA25-239A, 27 August 2025; Cyber Monitoring Centre, retail ransomware statement, 20 June 2025; UK National Crime Agency, four arrested, 10 July 2025. primary
  5. NIST, first three post-quantum standards, 13 August 2024; UK NCSC, migration timelines, 20 March 2025; CISA, NSA and NIST, Quantum readiness, August 2023. primary
  6. LastPass, Notice of security incident, 22 December 2022; UK NCSC, Password managers, reviewed 21 May 2026. primary
  7. StateScoop, grant program tops state CIOs’ priorities, 1 September 2026. news
Contest a fact, suggest something, or tell us what’s broken

If someone is in danger right now, don’t use this form. Call your local emergency number (911 in the US). For trafficking: 1-888-373-7888, or text 233733.

What is it?

No name, no account. Your note goes into the site’s private records, nothing about your browser or connection is stored with it, and the email box is the only way we’d know who you are. The weekly review reads every note, re-reads the original source, and fixes the page if it should. A contested fact and its outcome are listed on Contested, in the review’s words, never yours.

No tracking on any link.Ticks stay on this device.Facts checked 5–6 Nov 2026.What changedContested