What the numbers really say about AI fraud

Headlines about AI fraud tend to lead with one big number. The numbers are real, but each one measures something narrow, and the gaps between them say as much as the figures do. If you are deciding how worried to be, or explaining the risk to your team or your parents, it helps to know what was actually counted.

Here is what the main official sources say as of October 2026, read straight from the reports.

The FBI's first count

In April 2026, the FBI released its 2025 Internet Crime Report, based on complaints to its Internet Crime Complaint Center (IC3). Overall, IC3 received 1,008,597 complaints with $20.877 billion in reported losses, a 26% rise in losses from 2024.

For the first time, the report has a section on artificial intelligence. IC3 logged 22,364 complaints tagged as AI-related, with adjusted losses of $893,346,472. That works out to about 2% of all complaints and about 4% of all reported losses. Complainants aged 60 and over accounted for 3,143 of those complaints and about $352 million of the losses.

The breakdown is telling. Investment scams with a reported AI link made up about $632 million, the bulk of the total. The report also lists more than $30 million in business email compromise losses involving AI, over $19 million in romance and confidence scams with a likely AI link, over $5 million in "distress" scams where cloned voices mimic a relative in trouble and almost $13 million in AI-involved employment scams.

What "AI-related" means in that report

This is the key detail most summaries skip. In the report's appendix, IC3 defines its AI tag simply: the information reported contains a reference to artificial intelligence. It is a descriptor attached to a complaint, used for tracking.

In other words, the $893 million counts cases where someone mentioned AI when they filed. If a victim never suspected that the friendly investment adviser was a chatbot, or that the CEO's voice was cloned, the complaint is not tagged. The FBI says as much: total investment scam losses topped $8 billion, which the report says shows many victims don't realize how far AI may be involved. As The Register reported at release, the FBI expects its AI figures to undercount.

There is also no trend line yet. The FBI's 2024 report recorded 859,532 complaints and $16.6 billion in losses, but it had no AI category, so nobody can say from FBI data whether AI-related fraud grew or shrank from 2024 to 2025. You will see websites quoting different AI figures. The ones above are taken directly from the FBI's own PDF.

Other agencies, other measuring sticks

The U.S. Federal Trade Commission collects consumer fraud reports through its Consumer Sentinel Network. In March 2026 testimony, the FTC said consumers filed 3 million fraud reports in 2025 and reported $15.9 billion in losses, up from over $12 billion the year before. Its public releases on these figures do not break out AI at all. In October 2026, the FTC estimated that the total cost of fraud to older adults in 2025 alone could be as high as $119.5 billion, far above what people actually report. That gap is a reminder that reported losses are only the visible part.

In Europe, the numbers are even softer. The EU cybersecurity agency ENISA, in its Threat Landscape 2025 covering July 2024 to June 2025, found phishing was the leading way into organizations, at about 60% of the 4,875 incidents it analyzed. It also said AI-supported phishing reportedly made up more than 80% of observed social engineering activity worldwide by early 2025. Note that hedge: the figure is global, and ENISA presents it as reported by others rather than as a result of its own incident count.

Europol's IOCTA 2026, its assessment of internet organized crime, describes generative AI helping fraud networks personalize scams at speed and scale, including impersonation of bank help desks and police and more realistic CEO fraud. It warns that criminal use of agentic AI could push online fraud to new levels. It gives no count of AI-enabled cases.

The UK NCSC's assessment of AI and the cyber threat to 2027, published in May 2025, judges that attackers are almost certainly already using AI to improve social engineering. It frames this mainly as making existing methods more effective, and adds a caution worth keeping in mind: "Technical surprise is likely."

Why AI fraud is so hard to measure

Put side by side, these sources agree on direction and disagree on almost everything else. That is not sloppy work. AI fraud is genuinely hard to count, for a few reasons.

• Victims often can't tell. A well-written email or a convincing voice leaves no label. Unless someone suspects AI, the report never mentions it.

• Counts depend on who reports. IC3 and the FTC rely on people choosing to file. Many never do, especially when they feel embarrassed, which is one more reason never to blame victims.

• Everyone counts something different. The FBI counts U.S. complaints, ENISA analyzes incidents against organizations and Europol and the NCSC give qualitative judgments. The numbers do not add up because they were never meant to.

• AI is usually one tool among many. A scam might use a chatbot for the first message and a human for the payment step. Deciding when that counts as "AI fraud" is a judgment call.

So the honest summary is this: the measured figures are a floor, the trend is pointing up and nobody yet has a reliable total.

What to do with uncertain numbers

The good news is that you don't need precise statistics to protect yourself. The defenses that stop AI-assisted fraud are the same ones that stop the old-fashioned kind, because both rely on getting you to act fast without checking. Share this list with your team or family:

1. Pause on any urgent request for money, gift cards, crypto, passwords or data, however real the voice, video or email seems.

2. Call back on a number you already have or look up yourself, never one supplied in the message.

3. Agree on a code word with family members and a two-person check for payments at work.

4. Be wary of investment tips from people you met online, especially if they come with celebrity endorsements or video calls. That is where the FBI saw most AI-linked losses.

5. Report every attempt, even failed ones, to IT, to IC3 in the U.S. or your national reporting service. Better reporting is how these numbers get more accurate.

Every report you file helps fill in the picture that today's statistics can only sketch.

Sources

• FBI Internet Crime Complaint Center, "2025 IC3 Annual Report," April 2026: ic3.gov

• FBI Internet Crime Complaint Center, "2024 IC3 Annual Report," April 2025: ic3.gov

• The Register, "US cybercrime losses pass $20B for first time as AI boosts online fraud," April 7, 2026: theregister.com

• Federal Trade Commission, "FTC Testifies before the Joint Economic Committee on Agency's Efforts to Combat Fraud," March 25, 2026: ftc.gov

• Federal Trade Commission, "FTC Issues Annual Report to Congress on Agency's Actions to Protect Older Adults," Oct. 19, 2026: ftc.gov

• ENISA, "EU consistently targeted by diverse yet convergent threat groups" (ENISA Threat Landscape 2025), Oct. 1, 2025: enisa.europa.eu

• Europol, "The evolving threat landscape. How encryption, proxies and AI are expanding cybercrime (IOCTA 2026)," 2026: europol.europa.eu

• UK National Cyber Security Centre, "Impact of AI on cyber threat from now to 2027," May 7, 2025: ncsc.gov.uk

Or let NimBot handle it

You can do all of this yourself, and it works. If you'd rather not run it alone, NimBot handles the training, the drills and the reminders for your whole team. Try it at app.nim.bot.