In Brief: A look at the FBI IC3 report
Date : March 08, 2022
On 22 March 2022, the FBI published the 2021 annual report for the Internet Crime Complaint Center (IC3). This report is interesting because it gives figures on financial losses by type of incident. However, it is important to understand what the IC3 is before interpreting these figures.
IC3 is an FBI website that allows users to report Internet frauds. It is therefore comparable to Internet-signalement.gouv.fr in France (or also www.cybermalveillance.gouv.fr, which redirects to the latter). IC3 collects complaints both from individuals (resulting in incident categories such as "Romance scam" or "Tech support scam") and from businesses (with a BEC category, and a breakdown of ransomware incidents by business sector). The results produced are factual (based on actual complaints), but are not representative of all incidents.
Here are the incidents highlighted in the IC3 report for 2021 (amounts are in dollars):
- Business Email Compromise (BEC): 19,954 complaints and 2.4 billion losses
- Crypto-currencies: 34,202 complaints, 1.6 billion losses
- Romance Fraud: 24,299 complaints, 956 million losses
- Tech Support Fraud: 23,903 complaints, 347 million losses
- Ransomware: 3,729 complaints, 49.2 million losses. We comment on this figure below.
Note:
- An infographic has also been published. It gives the TOP 6 incidents (in terms of losses).
- Romance Frauds are scams via e-mail or social networks, where a scammer attracts the victim's sympathy in order to obtain money.
- Tech Support Fraud" are scams where a fake IT support call centre takes money from their victims (e.g. selling them a fake antivirus).
Some figures are surprising because they seem to contradict other sources:
- Ransomware losses seem low: IC3 reported a loss of $49.2 million (mostly in the US, but IC3 also receives few international complaints) while ChainAnalysis reported a figure of $600 million (worldwide).
- The losses related to "Romance Fraud" are 956 million for the IC3 while the FTC (US Federal Trade Commission) estimates it at 547 million.
In conclusion, it is clear that this IC3 data is useful, but care must be taken in interpreting it because it is not representative of all incidents.
