{"id":4591,"date":"2024-04-11T16:36:17","date_gmt":"2024-04-11T04:36:17","guid":{"rendered":"https:\/\/ostermanresearch.com\/2024\/04\/11\/fbi-ic3-2023-report\/"},"modified":"2025-03-10T17:17:16","modified_gmt":"2025-03-10T04:17:16","slug":"fbi-ic3-2023-report","status":"publish","type":"post","link":"https:\/\/ostermanresearch.com\/2024\/04\/11\/fbi-ic3-2023-report\/","title":{"rendered":"Some thoughts on the FBI Internet Crime 2023 report"},"content":{"rendered":"\n<p>The FBI&#8217;s <a href=\"https:\/\/www.ic3.gov\/media\/pdf\/annualreport\/2023_ic3report.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">annual internet crime report for the 2023 year<\/a> (PDF) was released last month. The report is based on data collected by the IC3 &#8211; the &#8220;Internet Crime Complaint Center&#8221; &#8211; run by the FBI.<\/p>\n\n\n\n<p>Key takeaways from the 2023 report:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>40% of lifetime complaints in the past four years (out of 23 total)<\/strong><br>IC3 was established in May 2000 &#8211; so it has collected crime statistics for 23 years. Over those 23 years, the IC3 has received over 8 million complaints. In each of the last four years, the average annual number of complaints was around 800,000, meaning that 40% of total complaints over 23 years were received in the last four years. There was a significant jump from the year pre-covid (2019, 467K complaints) to the first year of covid (2020, 792K complaints).<\/li>\n\n\n\n<li><strong>$50 million BEC (business email compromise) incident<\/strong><br>The report includes an anonymized case study of a New York firm that suffered a $50 million BEC incident. Due to the rapid intervention of the FBI and its various units, $46 million of that was recovered. Overall, BEC incidents were the second most costly incident type reported to the FBI, at $2.9 billion.<\/li>\n\n\n\n<li><strong>Hardly anyone is reporting costly ransomware incidents to the FBI<\/strong><br>Only 2,825 complaints were reported, with losses pegged at $59.6 million, or just over $20,000 per incident. I thought the loss numbers would be higher. This is either due to underreporting of costly incidents or the non-existence of costly incidents (which seems out of place with other reporting).<\/li>\n\n\n\n<li><strong>Phishing incidents remain the most commonly reported crime type<\/strong> <strong>&#8230;<\/strong><br>Out of 880,418 complaints in 2023, 298,878 were of the phishing \/ spoofing type (34% of total). This is a consistent pattern in the data reported to the FBI.<\/li>\n\n\n\n<li><strong>&#8230; but it&#8217;s not the most costly crime type that&#8217;s reported<\/strong><br>That title belongs to investment fraud (1st place, $4.6 billion), business email compromise (2nd place, $2.9 billion), and tech support scams (3rd place, $0.9 billion).<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>The FBI&#8217;s 2023 internet crime report, based on IC3 data, revealed a surge in complaints, with 40% of the lifetime total received in the last four years. A $50 million BEC incident saw $46 million recovered. Ransomware incidents are underreported, with phishing being the most common crime type, but investment fraud remains the costliest.<\/p>\n","protected":false},"author":384585,"featured_media":4743,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_coblocks_attr":"","_coblocks_dimensions":"","_coblocks_responsive_height":"","_coblocks_accordion_ie_support":"","advanced_seo_description":"","jetpack_seo_html_title":"","jetpack_seo_noindex":false,"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[712027491],"tags":[712027521],"class_list":["post-4591","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity-reports","tag-research-reports-we-didnt-write"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/i0.wp.com\/ostermanresearch.com\/wp-content\/uploads\/2024\/04\/fbi2024.jpg?fit=1100%2C350&ssl=1","jetpack_likes_enabled":true,"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/pcHAk4-1c3","_links":{"self":[{"href":"https:\/\/ostermanresearch.com\/wp-json\/wp\/v2\/posts\/4591","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ostermanresearch.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ostermanresearch.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ostermanresearch.com\/wp-json\/wp\/v2\/users\/384585"}],"replies":[{"embeddable":true,"href":"https:\/\/ostermanresearch.com\/wp-json\/wp\/v2\/comments?post=4591"}],"version-history":[{"count":1,"href":"https:\/\/ostermanresearch.com\/wp-json\/wp\/v2\/posts\/4591\/revisions"}],"predecessor-version":[{"id":4673,"href":"https:\/\/ostermanresearch.com\/wp-json\/wp\/v2\/posts\/4591\/revisions\/4673"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ostermanresearch.com\/wp-json\/wp\/v2\/media\/4743"}],"wp:attachment":[{"href":"https:\/\/ostermanresearch.com\/wp-json\/wp\/v2\/media?parent=4591"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ostermanresearch.com\/wp-json\/wp\/v2\/categories?post=4591"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ostermanresearch.com\/wp-json\/wp\/v2\/tags?post=4591"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}