The FBI's 2025 Internet Crime Report tracked AI fraud for the first time: 22,364 complaints and $893M lost. What the number means and what it doesn't.
Social Engineering Examples·4 sources
Want hard AI fraud statistics? The FBI finally has some. Its Internet Crime Report for 2025, out on 6 April 2026, carries a section on AI for the first time. Count: 22,364 complaints. Losses: $893,346,472. Each one mentioned AI somewhere, whether a cloned voice, a deepfake video, a fake profile or a forged ID. Big number? Sure. Yet it's a sliver of the whole pie: 1,008,597 complaints and roughly $20.877 billion lost across everything IC3 heard about that year. Status: Official statistics; no single case.
| Measure | 2025 |
|---|---|
| Complaints tagged AI related | 22,364 |
| Losses on those (adjusted) | $893,346,472 |
| Every complaint IC3 got | 1,008,597 |
| Every reported loss | Roughly $20.877 billion |
The FBI's press release headline: "Cryptocurrency and AI Scams Bilk Americans of Billions".
| Scam | The AI bit |
|---|---|
| Family emergency | Grandkid, spouse or boss on the phone, panicking, needing cash. The voice is cloned |
| Investment | A celebrity or CEO "backing" some scheme on video. Deepfaked |
| Romance | Months of sweet talk from a persona an AI keeps going, then the money ask |
| Business email | Polished, on-tone emails, no typos to give them away |
| Identity | Fake IDs good enough for a background check or loan form |
Spot the pattern? Hurry. Pay now. Don't check. And since the fake looks and sounds spot on, trusting your gut won't cut it.
Tip: faces and voices are the easy part to fake now. Got a money request from someone familiar? Ring them back yourself, on the number you've always used.
A word on method. If a complaint brings up artificial intelligence, IC3 tags it. Analysts may layer on extra detail, numbers shift once investigators dig in, and duplicate losses get stripped out where they can be. Bottom line: $893 million is a snapshot built from complaints. Nobody audited it.
Separately, federal and Ohio prosecutors charged nine people over more than $42 million in fraud around then, one scheme reportedly using AI video. Different announcement. It doesn't back up the IC3 number.
Related reading: the Ohio twins AI romance case and the FBI's 2024 generative AI warning.
More on deepfake examples and voice cloning.
$893,346,472, says IC3, spread over 22,364 complaints that brought up AI.
No. It sits inside crime types like investment fraud and BEC. Stack it on top and you double count.
Yes, in the sense that 2025's report is IC3's first annual report with its own AI section.
Close to $20.877 billion, from 1,008,597 complaints.
Social Engineering Examples. “FBI IC3 tracks AI fraud for the first time: $893M in 2025 losses”. Accessed 3 November 2026. https://socialengineeringexamples.com/fbi-ic3-ai-fraud-893m-2025
This is an aggregate statistic rather than a single incident, so IC3's report does not detail one recon method, but the scam types folded into the AI figure (romance scams, BEC, executive/official impersonation, investment fraud) typically require identifying both a plausible person to impersonate and a person to target, drawing on OSINT sources such as social media, company websites and org charts, dating-app profiles, and public records to learn names, relationships, and enough personal detail to make an AI-generated persona or cloned voice convincing.
Employee, family, and public OSINT exposure (LinkedIn roles, org charts, social media, dating-app profiles) is very hard to eliminate at the individual or enterprise level; the realistic control assumes an attacker can already learn this and instead limits what a stranger can achieve through a single channel, rather than trying to hide the underlying information.
Per IC3's description of the techniques inside the $893 million figure, scammers typically source commercially available voice-cloning services, deepfake video generation tools, AI-generated or forged identification-document templates, and AI chat/LLM tools to produce the synthetic voice sample, video clip, fake social profile, or forged ID used in the scheme.
There is no practical way to block private acquisition of commercial voice-cloning or deepfake tools before contact occurs; the nearest realistic control sits downstream, treating any voice or video 'proof' received unexpectedly as unverified by default rather than trying to prevent the tooling's existence.
The scammer reaches the victim through a channel matching the scam type, a phone or video call for a cloned voice claiming to be a family member, executive, or government official, a dating app or social media message for a fake AI-generated profile, or a job/loan application flow for a forged ID, opening with a scenario (distress, opportunity, or an official demand) built to feel urgent from first contact.
Unsolicited contact making an urgent claim, a distress call, an investment tip, a romantic overture, or an official demand should trigger independent verification through a channel the recipient controls, not one the caller or messenger provides, before any further engagement.
For longer-running schemes (romance, investment), IC3 notes AI-generated conversational scripts let scammers sustain a believable, personalized relationship over weeks or months at a scale that would previously have required more manual effort per victim; for shorter schemes, a deepfake video or cloned voice is used as one-time 'proof' (a celebrity or CEO endorsing an investment, a loved one's panicked voice) standing in for the identity verification a victim would otherwise seek.
Skepticism toward 'proof' delivered only through the same channel as the ask is the core defense here; verifying a loved one's, executive's, or official's claim through a separately initiated call to a known number, or an established in-person channel, neutralizes synthetic credibility regardless of how convincing it sounds or looks.
IC3's report frames this as the throughline across the AI-enabled scam types it tracked, pairing the synthetic 'proof' built up in earlier stages with classic pressure tactics, urgency, secrecy, and emotional appeals, specifically to get the victim to act before they can independently verify what they are seeing or hearing.
pause before acting on an urgent financial request and verify the claimed identity through an independent contact. This is a general recommendation; the aggregate does not measure the effectiveness of a particular control.
The victim wires money, buys and sends cryptocurrency, purchases gift cards, or hands over identity/financial credentials (in employment or loan-fraud variants using forged IDs), completing the transaction the earlier stages built toward.
independently verify high-risk payment instructions and alert the financial institution promptly if fraud is suspected. These are general safeguards, not a proved prevention rate for the AI-related complaint set.
IC3 applies an AI-related descriptor when reported information references AI. Its appendix says analysts may apply crime-type and adjusted-loss data, and statistics can evolve with investigative or analytical proceedings.
report suspected fraud to IC3 and the relevant financial institution. The complaint aggregate does not establish the probability of recovery for an individual payment.
Browse by what this case has in common with others in the library.
ESET found PromptLock, ransomware that had a local AI model write its scripts at runtime. It turned out to be…
APT28's LAMEHUG malware asked an AI model on Hugging Face to write the spy commands it ran on Ukrainian government…
OpenAI says a Russian-speaking actor used throwaway ChatGPT accounts to build Windows malware, spread as a fake Crosshair-X gaming tool.…
Fake finance "directors" in WhatsApp groups steered 18+ US investors to NanoBit, a crypto platform that never traded. The SEC…
A fraudster spoofed Wells Fargo's real 800 number nine minutes after a legitimate advisor call, phished a 2FA code from…
A phone-record pretexting incident involving a retired U.S. Army general was followed by FTC enforcement and broader privacy-policy scrutiny.
Two unencrypted TD Bank backup tapes carrying data on 260,000 customers vanished in transit between Massachusetts offices in 2012.
An unidentified operator jailbroke Anthropic's Claude Code with a fake "authorized bug bounty and penetration test" pretext, then defeated its…
Censys traced a USPS 'package awaiting action' smishing kit to 682 lookalike sites that streamed card numbers as victims typed.…
In June 2025 the DOJ filed to forfeit $225.3M in USDT tied to pig butchering scams, after Tether and OKX…
A respected Kansas bank CEO was groomed on WhatsApp into a crypto scam, wired $47.1M of bank funds in 11…
A job candidate at Vidoc Security Lab hid behind a real-time face filter and refused to cover his face. What…
In late December 2012, attackers rigged the Council on Foreign Relations website to silently exploit an Internet Explorer zero-day and…
Someone used the White House chief of staff's phone contacts and an AI-like voice to call senators and executives, asking…
A Houston- and California-based ring spoofed or compromised business emails to trick four companies and one New Jersey township into…
The FTC's first-ever case under the FACTA Disposal Rule: a Northbrook, Illinois mortgage lender repeatedly dumped intact customer credit reports.
ESET found PromptLock, ransomware that had a local AI model write its scripts at runtime. It turned out to be…
An Austin man lost $1,408,850 to a fake DAIQ crypto platform found on LINE. A staged $40,000 handoff led police…
Fraudsters impersonating FACC's CEO by email convinced finance staff to wire roughly EUR 50M for a fake acquisition project; EUR…
Spoofed emails impersonating Medidata's president, backed by a fake "lawyer" caller, tricked finance staff into wiring $4.8M to an overseas…
Binance's comms chief said scammers used an AI "hologram" of him on Zoom calls. The impersonation is real; the deepfake…
A deepfaked Martin Lewis Facebook ad led to a fake adviser, a Revolut account, £5,000 of savings and £70,000 in…
A scammer spoofed a New Zealand bank's number and obtained authentication codes by claiming they would suspend banking and cancel…
The FBI's December 2024 warning on AI-enabled fraud: AI text, fake IDs, cloned voices and deepfake video, and what the…
Social Engineering Examples