Blog

Nearly $21 billion lost: what the FBI's 2025 internet crime report means for small organizations

26 October 2026 · 3 min read

Every spring the FBI's Internet Crime Complaint Center (IC3) publishes what Americans reported losing to online crime the year before. The 2025 edition, released on 6 April 2026, is the largest yet: 1,008,597 complaints and nearly $21 billion in reported losses, up from 859,532 complaints the year before. And these are only the cases people reported. Many never are.

What stood out this year

• Phishing and spoofing were again among the most reported crimes. Fake emails and texts that pretend to come from someone you trust are still the most common way in.
• AI got its own chapter for the first time. The IC3 counted 22,364 complaints that mentioned artificial intelligence, with close to $893 million in losses. The FBI describes fake social profiles, cloned voices, forged identity documents and convincing videos of people the victim knows or trusts.
• Older adults lost the most. People over 60 reported about $7.7 billion in losses, up 37% on 2024.
• Cryptocurrency carried the biggest losses. Crypto-related complaints alone topped $11 billion, much of it from fake investment schemes.

The Federal Trade Commission sees the same trend from the consumer side: in March 2026 it reported 3 million fraud reports and $15.9 billion in losses for 2025, with imposter scams drawing more than a million reports.

Why this matters for a small business or nonprofit

Large companies have security teams. A ten-person accounting office, a church or a local charity usually has one person who "does the computers". Criminals know that. The costliest scams against organizations are rarely technical break-ins; they are convincing messages that ask someone to pay, change bank details, share a code or open a file.

Five habits that stop most of it

1. Verify money requests through a second channel. If an email asks you to pay, change bank details or buy gift cards, call the person on a number you already have, not one in the message.
2. Slow down when a message is urgent or secret. "Do this before 3 pm and don't tell anyone" is the scammer's favourite sentence.
3. Never share a sign-in code. No real colleague, bank or IT team needs the code your phone just received.
4. Report, don't just delete. One reported message can warn the whole team.
5. Keep a copy of your email outside the mail provider. If an account is taken over and mail is deleted, you can still prove what happened and recover it.

Where KnoxDefender fits

KnoxDefender checks incoming mail before it reaches the inbox, explains in plain English why a message was held, can add a CAUTION banner to mail from outside, and gives staff a one-click way to report suspicious messages. Short training courses cover exactly the tricks in this report. None of that replaces the habits above; it makes them easier to keep.

Sources

• FBI press release: Cryptocurrency and AI Scams Bilk Americans of Billions (6 April 2026)
• IC3 2025 Internet Crime Report (PDF)
• FTC: testimony on its efforts to combat fraud (25 March 2026)

← All stories · Questions? Contact us.