The FBI Started Counting AI Fraud. The Number Is Nothing Like What You've Been Sold

In its 2025 annual report, the FBI's Internet Crime Complaint Center did something it had never done before: it added "AI Related" as a formal descriptor and counted it.

That matters because until now, every claim about the scale of AI-enabled fraud came from companies selling protection against AI-enabled fraud. There was no denominator. Now there is one, published by the organisation that actually receives the complaints.

The number is much smaller than what you have probably been told. It is also, by the FBI's own explicit admission, an undercount. Both of those are true at once, and the gap between them is where the useful thinking lives.

01What the FBI actually counted

The 2025 report breaks the AI-related total down by scam type. Setting each against the total for that whole category is the part nobody quotes.

Read from the FBI IC3 2025 Annual Report, section "Artificial Intelligence (AI) Used in Cybercrime", on 9 September 2026. Dashes mark categories where the report gives the AI-nexus figure but we did not extract a comparable category total; do not infer a ratio for those rows. All figures are victim-reported and adjusted by IC3.

The row that should stop a small business owner is the second one. Business email compromise — the fake-invoice, changed-bank-details, urgent-wire-transfer family of fraud — is the thing most likely to actually happen to you. It is a three-billion-dollar problem. The portion where a victim reported AI involvement is about one percent of it.

02Why that clashes with what you are being sold

Search this topic and you will find figures in wide circulation that are difficult to reconcile with the above: that around 40% of business email compromise attacks now include AI-generated voice or video, up from under 5% in 2023; and that the average AI-augmented BEC loss exceeds $4.1 million against roughly $1.3 million for traditional BEC.

We could not trace either to a primary source. They appear on vendor blogs and in security-marketing content, usually without a named dataset, sample size or method. That does not make them invented. It does mean nobody reading them can check them.

Run the arithmetic, though. If 40% of BEC attacks involved AI, and AI-involved incidents cost several times more, then AI-involved BEC would account for the majority of a $3 billion problem. The FBI's own count says just over $30 million. Those cannot both describe the same world.

03The honest half: this is a floor, not a ceiling

It would be easy to stop there and conclude AI fraud is hype. That would be the wrong conclusion, and the report says so itself.

The "AI Related" tag is a descriptor. The report is explicit that it is applied when the information reported contains a reference to artificial intelligence, and that descriptors exist "for tracking purposes only". In other words, it counts complaints where somebody mentioned AI. It does not count incidents where AI was used and nobody realised.

That distinction is enormous, and the FBI draws attention to it directly. On investment fraud, having noted more than $632 million with a reported AI nexus, the report observes that overall investment losses exceeded $8 billion, "demonstrating that many victims do not realize the extent AI may be involved in scams".

Think about what that means for BEC in particular. If you receive a convincing email from a supplier and wire the money, you have no way of knowing whether a machine wrote it. If you take a call from someone who sounds like your bookkeeper, you cannot tell a cloned voice from a decent impersonation. The victim is structurally the worst-placed person to know whether AI was involved, which makes a victim-reported AI figure close to useless as a measure of actual prevalence.

So the honest position is narrow and, we think, more useful than either extreme:

• $893 million is a real, authoritative floor, and the first one that has ever existed.
• The true figure is certainly higher, and unknowable with current reporting.
• Neither of those justifies the specific unsourced multiples being used to sell products.

04Why the distinction barely changes what you should do

Here is the part that makes the whole argument practical. Whether the voice on the phone was cloned or merely a good impersonation does not change a single control you should have.

The defences against a fake payment instruction are identical either way, because they defend the process rather than trying to detect the artefact:

• Call back on a number you already had. Not a number in the email, not one the caller gives you. From your own records. This one control defeats voice cloning and ordinary impersonation equally, and it costs nothing.
• Treat any change of bank details as a separate, verified event. New account details are the single highest-risk message your business receives. Verify out of band, every time, no exceptions for urgency or seniority.
• Two people on payments above a threshold you set. Pick a number that would hurt and require a second pair of eyes above it.
• Kill the urgency lever. Almost every one of these frauds requires the target to skip a step because it is urgent and someone senior is impatient. Say out loud, in advance, that nobody will ever be criticised for verifying — that sentence is the control.
• Agree a verification word for phone requests involving money, if you are small enough that this is practical. Low-tech, effective against a cloned voice, and free.

Note that none of these mention AI. That is the point. A business with these controls is protected against the version of this fraud that existed in 2015 and the version that exists now. A business without them is exposed to both, and no detection product closes that gap.

05What not to buy

• Deepfake detection, as a first purchase. If you have no callback rule, a detection tool is protecting a process that has no floor. Fix the process; it is free and it works on more attacks.
• Anything sold on the unsourced multiples. A vendor quoting "40% of BEC" without a dataset is either not checking their own marketing or hoping you will not. That is a reasonable thing to judge a security supplier on.
• Staff training that teaches spotting fakes. Training people to detect artefacts in audio is training for a task that gets harder every quarter. Train the procedure instead: what you do when money is requested, regardless of how convincing the request is.
• A separate "AI security" budget line. This is BEC with better grammar. It belongs with your existing payment controls and your existing fraud awareness, not in a new category.

06The honest summary

For the first time there is an authoritative number: 22,364 complaints and $893 million in 2025, roughly 4% of all reported cybercrime losses, with AI-involved business email compromise at just over $30 million against a $3 billion category. That is dramatically less than the figures circulating in security marketing, and those figures cannot be traced to a primary source.

It is also an undercount, by design and by the FBI's own statement, because the person filing the complaint is the last person able to tell whether a machine was involved.

Both things being true is not a contradiction, and it resolves into something simple: do not buy the panic, and do not skip the callback. The controls that stop this are a phone call to a number you already had, a rule about changed bank details, and permission for your staff to slow down. None of it is about AI at all.

07Common questions

---

Sources: the FBI IC3 2025 Annual Report, read directly from the published PDF on 9 September 2026 — every dollar figure, complaint count and quoted phrase about descriptors and victim awareness comes from that document and is first-party. The circulating vendor claims described in section 02 are quoted as we found them and are explicitly unverified; we could not locate a primary source, sample size or method for either, and we are not asserting they are false. The five controls in section 04 are ordinary payment-fraud practice, not our invention. Figures are victim-reported and adjusted by IC3, which means they exclude unreported crime entirely. Related: An AI Agent Breached a Real Company and Which Decisions You Should Never Hand to an AI Agent.

Hero image from Unsplash, used under the Unsplash License.