The FBI's 2024 cybercrime total counts complaints, not incidents

What the document says

The FBI's Internet Crime Complaint Center published its 2024 Internet Crime Report in April 2025, recording 859,532 complaints and 16.6 billion dollars in reported losses for the year, figures the accompanying FBI press release also cites. Investment fraud was the largest loss category at 6.57 billion dollars, followed by business email compromise at 2.77 billion dollars, tech support fraud at 1.46 billion dollars and personal data breach complaints at 1.45 billion dollars. Victims aged 60 and older reported the highest losses of any age group, 4.8 billion dollars across 147,127 complaints, an increase the report attributes partly to more complaints being filed rather than only to more crime occurring. Ransomware specifically accounted for 3,156 complaints and just over 12.4 million dollars in reported losses, a figure the report itself flags as an undercount because it does not include estimates of lost business, time, wages, files or equipment, or any third-party remediation services.

Confidence and limits

These numbers come directly from the FBI's own report and press release, which is strong evidence for what was reported to IC3 in 2024. It is not evidence for the true scale of internet-enabled crime against Americans. The report states plainly that entities do not always report a loss amount, which it says creates an artificially low overall ransomware loss rate, and that the dataset only represents what entities report to FBI via IC3, excluding complaints made directly to FBI field offices or never reported at all. The IC3 reporting index confirms the data is self-reported by complainants through an online form, not independently verified before publication.

Why it mattered

A record annual total drew attention, but the more consequential fact for a security team is what the total excludes: business disruption, remediation labour and unreported incidents. Ransomware's low reported-dollar figure alongside its high operational disruption illustrates why the IC3 total should never stand in as a complete cost-of-cybercrime figure, particularly for categories where victims are reluctant or unable to quantify loss.

Defensive takeaway

When citing IC3 figures internally, state explicitly that they represent US-reported, self-declared losses only, and pair any ransomware citation with the report's own undercounting caveat.

• Are we citing an IC3 total as a global or complete figure, when it is US-reported and complaint-based only?
• Does our own incident reporting include an actual loss estimate, or would it fall into IC3's no-loss-amount gap?
• Have we filed an IC3 complaint for incidents that affected us, so the aggregate reflects them?

The report is a valuable, consistent time series precisely because its limits are stated rather than hidden. Reading the record honestly means repeating those limits alongside the headline number, not only the number itself.