Internet crime losses reached a staggering $20.9 billion in 2025, marking a 26% increase from the previous year according to the FBI’s Internet Crime Complaint Center (IC3) annual report. With over one million complaints filed, the data highlights sophisticated threats targeting both individuals and businesses.
https://cybernews.com/cybercrime/fbi-top-4-internet-crime-loss-20-billion/
Key Threats Highlighted in the Report
- Phishing/Spoofing: The most common complaint category, serving as an entry point for many attacks.
- Investment Fraud (often crypto-related): The costliest, exceeding $8.6 billion in losses — about 43% of the total.
- Business Email Compromise (BEC): Responsible for roughly $3 billion in losses.
- Tech Support Scams: A persistent and expensive threat.
- Emerging AI-Enabled Crimes: Over 22,000 complaints linked to AI, resulting in nearly $900 million in losses. AI makes synthetic content (deepfakes, voice cloning) harder to detect.
Organizations face heightened risks from BEC, phishing that leads to data breaches, and fraud involving urgent wire transfers or fake invoices. The good news? Most of these threats are preventable through proactive, layered defenses.
Actionable Measures Organizations Can Take
- Build a Strong Human Firewall with Ongoing Training
Employees remain the first line of defense. Regular security awareness training helps staff recognize red flags like:
- Urgent requests for wire transfers or changes to payment details.
- Slight variations in email addresses or domains (e.g., “compaany.com” instead of “company.com”).
- Unexpected attachments or links.
- Pressure tactics that bypass normal verification processes.
Best practice: Conduct simulated phishing exercises quarterly and tailor training for finance, executive, and HR teams, who are prime BEC targets. Foster a culture where employees feel comfortable questioning suspicious requests.
- Implement Robust Email Security Controls
- Deploy SPF, DKIM, and DMARC protocols to prevent email spoofing.
- Use advanced email gateways with AI-powered phishing detection, sandboxing for attachments, and URL scanning.
- Enable automatic quarantine for suspicious messages.
For BEC specifically, configure rules that flag external emails mimicking internal senders or containing keywords like “urgent,” “wire transfer,” or “invoice update.”
- Enforce Multi-Factor Authentication (MFA) Everywhere
Require MFA for all email accounts, financial systems, VPNs, and cloud services. Prioritize phishing-resistant methods like hardware keys or authenticator apps over SMS where possible. This significantly raises the bar for attackers who obtain passwords through phishing or breaches.
- Establish Strict Verification Procedures for Financial Transactions
- Institute a dual-approval process for any payments above a certain threshold.
- Mandate out-of-band verification: Always call the requester using a known, pre-verified phone number (not one provided in the email) to confirm changes or urgent requests.
- Document and audit all vendor payment details changes.
This simple callback policy has proven highly effective against BEC scams.
- Adopt Advanced Endpoint and Network Protection
- Use comprehensive endpoint detection and response (EDR) tools.
- Implement zero-trust architecture principles: Verify every access request, regardless of origin.
- Segment networks to limit lateral movement if one system is compromised.
- Keep all software, operating systems, and firmware updated to close known vulnerabilities.
- Monitor for and Mitigate AI-Enhanced Threats
- Train staff to scrutinize unusual voice or video calls (e.g., unexpected CEO requests via video).
- Use tools that detect deepfakes or anomalous communication patterns.
- Limit sharing of personal or organizational data on public platforms that could be used for social engineering.
- Develop Incident Response and Recovery Plans
- Have a clear process for reporting suspected incidents internally and to the FBI’s IC3.
- Maintain offline backups and test restoration procedures regularly.
- Consider cyber insurance that covers BEC and ransomware losses, with requirements for strong controls.
- Partner with Managed Security Experts
Many organizations lack the in-house resources to stay ahead of evolving threats. A trusted Managed Security Service Provider (MSSP) can provide 24/7 monitoring, threat intelligence, and rapid response—freeing your team to focus on core business.
Conclusion: Vigilance Is Your Best Investment
The FBI’s report is a wake-up call: cybercrime is not just growing—it’s becoming more professional and technology-driven. Organizations that treat cybersecurity as a continuous business process rather than a one-time checklist will fare far better.
At TMPC, we help businesses in [Miami and beyond] implement these layered defenses through tailored cybersecurity strategies, employee training programs, and advanced managed security services. Don’t wait for a costly incident to act.
Contact our team today for a free cybersecurity risk assessment and learn how we can strengthen your defenses against the threats outlined in the latest FBI data.
Stay safe, stay secure. TMPC – Your Partner in Digital Protection