The FBI Just Told You Exactly How Your Business Will Be Attacked. Did You Read It?
Threat Intelligence Financial Impact
Every April the FBI releases its Internet Crime Complaint Center annual report — the most comprehensive government analysis of real cybercrime in the US. The 2024 report landed April 23, 2025. $16.6 billion in losses. 859,532 complaints. Five findings that apply directly to your business right now.
Every year in April, the FBI publishes the most authoritative cybercrime document available to any business owner in the United States. It's called the Internet Crime Complaint Center Annual Report — IC3 for short — and it contains 25 years of data on how Americans and American businesses are being attacked, how much they're losing, and which attack types are accelerating.
The 2024 report, released April 23, 2025, documented a record-breaking year. $16.6 billion in losses. 859,532 complaints. A 33% increase in losses from 2023. The average loss per incident jumped from $14,197 in 2023 to $19,372 in 2024 — meaning attacks aren't just more frequent, they're more financially devastating per event.
Most small business owners have never read it. Most have never heard of it. And the five findings most relevant to an SMB in 2026 are not the ones that made headlines.
The five findings that matter most for your business
Phishing is still the #1 attack — and it's getting more effective, not less
193,407 complaintsPhishing and spoofing were the most reported cybercrime type in 2024 by a significant margin — 193,407 complaints, more than double the second-place category. The reason phishing leads every year isn't because defenders aren't trying. It's because phishing is getting harder to detect. 82.6% of phishing emails in 2026 now contain AI-generated content — polished prose, accurate context, no grammatical errors, and personalization that previously required hours of manual research.
The 193,000 complaints represent only the cases where someone knew they'd been phished and reported it. Phishing that successfully harvests credentials or initiates a wire transfer without the victim's awareness — the most damaging kind — doesn't generate a complaint. It generates a breach investigation 292 days later.
BEC cost $2.77 billion — second highest dollar loss of any crime type
21,442 complaints · $2.77B lostBusiness email compromise was the 7th most complained-about crime type in 2024 — but the second most financially damaging, with $2.77 billion in reported losses. That gap between complaint volume and dollar loss is the most important signal in the entire report. The math is stark: 21,442 complaints averaging $129,000 each.
Over three years — 2022 through 2024 — BEC caused nearly $8.5 billion in reported losses to IC3 alone. 83% of all cybercrime losses in 2024 came from cyber-enabled fraud — BEC, phishing, spoofing, social engineering — not from malware or ransomware. The attacks winning in 2024 are not sophisticated technical exploits. They're emails that look legitimate and requests that seem urgent.
Ransomware complaints rose 9% — but the dollar figure dramatically understates the real cost
3,156 complaints · true cost uncountedIC3 received 3,156 ransomware complaints in 2024 — an 11.7% increase from 2023. The top five ransomware variants were Akira, LockBit, RansomHub, FOG, and LYNX. The FBI explicitly flags that ransomware loss figures do not capture lost business, downtime, wages, equipment damage, or recovery costs — which represent the majority of actual financial impact.
IBM's 2025 data puts the average ransomware breach cost at over $5 million when all downstream costs are included — a figure the IC3 ransomware line item doesn't come close to capturing. Many organizations also report ransomware directly to local FBI field offices rather than IC3, meaning the complaint count significantly underrepresents actual incidents.
The FBI recovered $561 million — but only 3.4% of total losses
$561M frozen · $16.6B lostThe FBI's Recovery Asset Team froze $561.6 million through the Financial Fraud Kill Chain in 2024, with a 66% success rate on escalated cases. That's meaningful progress — and 3.4% of the $16.6 billion lost. The gap between what the FBI can recover and what cybercriminals extract is the most honest statement in the report about what prevention is worth compared to recovery.
The Financial Fraud Kill Chain primarily handles BEC and works best when victims report immediately — within hours, not days. Funds moved to international accounts become nearly impossible to recover regardless of how quickly they're reported thereafter.
The most targeted victim group includes your staff, your clients, and your business owners
Ages 30–59 filed most complaintsThe 2024 IC3 report breaks down victims by age. The largest number of complaints came from people aged 30–59 — described by the FBI as "working professionals, business owners, and staff with financial access or approval authority." These are the people with the most access to business systems, financial workflows, and client data — and the most time pressure that makes them susceptible to social engineering.
People aged 60 and older suffered the highest total losses at nearly $4.8 billion — partly through personal scams, and partly through targeting of senior executives who have the highest financial authority. The FBI's findings align with Unit 42's 2026 research: the human with financial authority is the primary target, not the technical system.
The one stat the FBI buried that every SMB owner needs to see
On page 9 of the 2024 IC3 report, almost as a footnote, the FBI notes that cyber-enabled fraud — phishing, BEC, spoofing, social engineering — was responsible for 83% of all reported losses in 2024. $13.7 billion of the $16.6 billion total came from attacks that didn't require malware, didn't require a technical exploit, and didn't require a sophisticated attacker. They required a convincing email and an employee who clicked it, approved it, or wired money because of it.
The vast majority of what the FBI documented in 2024 is stoppable with the same five controls this series has covered: credential monitoring, DMARC enforcement, MFA with number matching, behavioral awareness training, and an incident response plan with the FBI's reporting URL already written in it.
The report is public. The URL is ic3.gov. The 2024 annual report is downloadable for free. Reading it takes about 20 minutes. The businesses that read it — that understand which attack types are accelerating, which victim profiles are being targeted, and what the FBI is and isn't able to recover — are the businesses that make better decisions about the five controls that determine whether they appear in next year's report.
📚 Credential Security Series — Read the full series
See what the FBI report means for your specific domain — not the country. Veriti Spottr's beta is free.
Join the free beta →
Comments
Post a Comment