- Vulnerable U
- Posts
- Unpacking The 2025 FBI IC3 Annual Report
Unpacking The 2025 FBI IC3 Annual Report

The Internet Crime Complaint Center, otherwise known as IC3, put out their yearly report and it's always staggering to see how the number of complaints per year is just straight up and to the right. These are people who lost stuff in cyberattacks, scams, whatever it is, and actually called and reported it. Which is not everyone, by any means.
It's always old people losing the most, $7 billion in complaints for the 60+ crowd.


The Scams People Don’t Report
This was the one that I thought would have been bigger: I have been hearing about these romance scams at an alarming rate. If I tell you I get three of those stories in my DMs every month, I'm not exaggerating. I know a number of people that have lost $30,000 to $60,000 that have not submitted a complaint. They are embarrassed.
So 23,000 complaints leading to almost a billion dollars in losses. It jumps pretty high up the list from number of complaints to dollars.
It's a numbers game for these scammers. They just spray and pray. They don't bounce off of everybody.
Crypto Dominates Everything
Investment-related fraud was once again the largest component. Operation Level Up reduced potential losses by more than $500 million. That leads me to believe that crypto is included in this.
When you get into the investment scam side, 8 billion, I knew that that had to have been crypto. Crypto fraud is way more prevalent than anything else going on. Crypto, it's like you send it, it's gone. There's no bank to help you out.
Cryptocurrency investment scam, 7.2 billion of the 8 billion: The scammers initiate contact through text messages, quickly move the conversation, introduce investment groups, show fake profits, offer loans to encourage larger investments, and when the victims try to withdraw, they get hit with taxes and fees and then recovery.
They hit them on the way out, too. Have you lost money in a scam? We'll help you recover it. And it's literally the same people that just stole your money.

How the Scams Actually Work
Once you establish trust, criminals introduce the topic of investing. The platforms seem legit. They'll even have two factor on them. Returns appear to be extremely lucrative, encouraging the victim to invest more and more.
It's common in the early stages to allow victims to withdraw. This is tricking them. Scammers use various methods to sweeten the pot. Matching. Scarcity. Taxes and fees. The account gets frozen. It's another method used by the scammers to try to convince the victims to invest even more money.
Ramp and dump. They secretly control a large number of low-price stocks, coordinate efforts to inflate the price, and then they rug-pull and sell it all.
Gold courier scams. They instruct victims to liquidate assets, buy precious metals, send couriers to retrieve them, and then the victims never hear back and lose all their money.
The Human Cost
Sextortion skews super young. A lot of this is teenagers. It's disgusting and insane.

A shocking amount of it is towards men. They'll pose as girls, get men to send sexual pictures, and then flip it and extort them.
A lot of people involved, especially in sextortion, wind up committing suicide. You're talking about a teenager that you're basically threatening to ruin their life if they don't pay you money that they probably don't have, so a lot of them just off themselves.
So yeah, a billion dollars in losses. How many lives lost?
This is just US, just in 2025. The numbers are ridiculous. It is sad.
Why Advice Doesn’t Work
Do not invest per the advice of someone you meet solely online. How? This is such useless advice.
Hover over the link and make sure it's valid. How? You're talking about people that are falling for this stuff. If people are this far in the scam, they do not have the skills to do any of this stuff.
You're hitting vulnerable people at a vulnerable time, the right people at the right time with the right script and they're just toast. None of this matters.
Educate, educate, educate. I honestly think this is on the financial institutions to catch, and crypto is just an unregulated hellscape.
Ransomware vs. Scams
Sixty-three new ransomware variants. More than one new variant of ransomware a week. That's kind of staggering.
But ransomware is way less prevalent. 32 million versus 20 billion in scams.
A lot of this extortion doesn't even involve ransomware. They just extort you without encrypting everything. We have all your information. If you would like us to not release it, pay us.
Critical Infrastructure and Real-World Impact
Healthcare got absolutely pounded in 2025. Manufacturing, financial services, energy, water. Water is a super small number. Just when it happens that it's a big fire.
Physical threats now as well, especially if you own crypto. Break-ins.
This real-estate stuff is crazy. The amount of hoops they make you jump through because of the amount of fraud is insane.

Trends That Stand Out
Three-year complaint count: BEC went up. Botnet went up. Romance scams, pretty flat.
SIM swaps are actually going down. Maybe the TeleCos are getting wise to it.
Extortion has doubled. Harassment and stalking has more than doubled.
Identity theft has damn near doubled. Investment scams, close to doubled.
Phishing and spoofing going way down. That's interesting.
Threats of violence skyrocketing. 3x since 2023.
Crypto investment scams have gone from 4 billion to 8 billion.
The Elder Problem
They have a whole section on the elderly because it's just the most prevalent: a 59% jump in amounts lost in 2025 to the elderly.
Phishing, spoofing, tech support, and romance scams. Three billion in crypto investment scams. It's wild.
Investment scams have more than doubled. Malware way up. Phishing, a 10x jump. Everything else is just up.
They're just getting slammed with these romance scams.
The Bottom Line
People know not how to see the warning signs and protect themselves.
How can we prevent anyone from harming themselves if we don't increase the education of our citizens?
Education is rarely stopping a lot of security breaches. Why is this possible?
We need systemic guard rails that make it really hard for people to do that.