The FBI’s 2023 Internet Crime Report is a blunt instrument. It does not sugarcoat scale or direction. IC3 recorded 880,418 complaints in 2023 with reported losses exceeding $12.5 billion. Those raw figures are the starting point for decisions about resource allocation, not an end in themselves.
What stands out immediately is where the money moved. Investment fraud was the costliest category, with losses of roughly $4.57 billion. Business e-mail compromise followed with about $2.95 billion in reported losses. Tech support scams accounted for nearly $925 million and disproportionately harmed older adults. Ransomware complaints rose again to roughly 2,825 incidents, with reported adjusted losses of about $59.6 million, though the true operational impact on affected organizations is often larger than these adjusted figures reflect. These are not minor trends. They are budget and policy priorities.
Two structural points matter when you read these numbers. First, reporting is incomplete. IC3 analysts note that these figures are conservative. Law enforcement operations and breaches often reveal victims who never report. That gap biases the dataset away from full visibility and toward those who either know to report or are compelled to report by insurers or regulators. Second, different schemes hit different populations and sectors. Investment fraud skewed toward adults aged 30 to 49 while tech support and call-center scams hammered those over 60. California led the states in both complaints and losses. These demographic and geographic contours should shape outreach and defenses.
The Recovery Asset Team produced measurable returns but it is a narrow tool. IC3’s RAT initiated the Financial Fraud Kill Chain on thousands of incidents, putting monetary holds on a large share of traceable transfers. That success demonstrates two things. One, speed and banker cooperation still matter more than any single technical control when funds move. Two, the system only works when victims report quickly and supply accurate transaction details. Expand RAT style capabilities, and incentivize rapid reporting, and you freeze more money. Do neither and the money disappears.
Investment and cryptocurrency-linked schemes deserve special scrutiny. Investment fraud accounted for the largest single category of loss. Cryptocurrency was a common descriptor in many investment complaints, and crypto-enabled schemes show higher recoverability challenges. When funds cross into virtual assets and foreign rails the probability of recovery drops and the investigative effort rises. That reality should drive two responses: accelerate regulatory clarity for exchanges and onramps, and implement mandatory suspicious-transaction flags and timely information-sharing between exchanges and law enforcement. Without those operational changes criminals will keep exploiting speed and irrevocability.
Ransomware is back on the upswing in volume, and tactics continue to shift. The number of reported ransomware complaints rose year over year and IC3 observed multi-variant deployments and data-destruction tactics used to increase pressure on victims. Reported dollar losses for ransomware remain modest in IC3 figures relative to fraud categories because many organizations do not report full business interruption and remediation costs to IC3. Treat the ransomware metric as an attack-frequency indicator as much as a loss metric; frequency and impact to critical infrastructure sectors are the real concerns.
What public and private sector leaders must do now is simple and actionable. First, assume detection and reporting gaps. Invest more in employee training, victim outreach, and low-friction reporting pipelines. Second, bank the controls that work: automated transaction holds, enhanced verification for high-value wires, and playbooks for immediate engagement with law enforcement. Third, harden corporate email and transaction controls to reduce BEC exposure: enforce DMARC, require out-of-band confirmations for vendor payment changes, and apply least-privilege access to payment systems. Fourth, for crypto risk: require stronger KYC at onramps and rapid bilateral channels between regulators, exchanges, and IC3-style recovery teams. Finally, make elder-focused prevention a funded priority. Tech support and call-center scams debit life savings. Targeted outreach, partnerships with financial institutions, and mandatory suspicious-activity alerts for accounts with elder flagging will reduce harm.
Law enforcement cannot solve this alone and IC3’s numbers prove it. Freezes and prosecutions recover some funds and deter operations, but they do not stop the creation of new victims. The proper response is layered: prevention, fast financial controls, law enforcement engagement, and policy to close weak edges in crypto and cross-border finance. Planners should budget accordingly and stop treating these incidents as one-off losses. They are indicators of exploitability in systems and processes that can be hardened.
Bottom line. The 2023 IC3 report is a roadmap. It points to where criminals were most successful in 2023 and where defenders should focus in 2024. If you run an organization that moves money, or care for populations that are targeted, act on the report as if the statistics are a threat forecast. Invest in speed with banks, tighten transaction controls, harden email systems, and treat crypto rails as a high-risk vector until regulatory and operational improvements reduce the asymmetry that criminals exploit. The data are clear. The choice to act remains ours.