On April 22, 2019, the FBI’s Internet Crime Complaint Center (“IC3”) released its Internet Crime Report (the “Report”) for 2018. IC3 issues the Report annually as a means to highlight data and identify key trends about Internet crimes.
IC3 was established in May 2000 as a central repository to receive complaints from the public about Internet crimes. Since its inception, over 4.4 million complaints have been reported to IC3. IC3’s core functions include the collection of data from Internet crime victims, the review and analysis of data submitted by victims, the issuance of alerts and publications to notify the public about Internet crimes and the methods used to carry them out, and the referral of Internet crimes to local, state, federal, and international law enforcement partners for investigation and criminal prosecution.
According to the Report, in 2018, IC3 received 351,937 complaints, resulting in over $2.7 billion in losses to victims. Both the number of complaints and the amount of losses represented significant increases over 2017. The most frequently reported complaints in 2018 were non-payment/non-delivery scams, extortion schemes, and data breaches. The most financially costly complaints involved business email compromise (“BEC”) scams, romance or confidence frauds, and investment scams.
In addition, the Report highlighted several “Hot Topics” for 2018, including:
- BEC Scams: In 2018, IC3 received over 20,000 BEC complaints, resulting in losses of over $1.2 billion. BEC scams typically involve criminal actors who compromise legitimate email accounts through social engineering or computer intrusion techniques to cause unauthorized transfers of funds.
- Payroll Diversion Scams: In 2018, IC3 received over 100 payroll diversion complaints, resulting in losses of over $100 million. In these scams, criminals target employees through phishing emails designed to capture the employee’s login credentials, and the stolen credentials are then used to access the employee’s payroll account. The criminals then change the employee’s direct deposit information and redirect payroll funds to accounts they control.
- Extortion Schemes: In 2018, IC3 received over 51,000 complaints – a 242% increase over 2017 – about Internet extortion schemes, with losses totaling over $83 million. Extortion schemes occur when a criminal demands something of value from a victim by threatening physical or financial harm or the release of sensitive data, or by causing the victim to be unable to access critical data. These schemes typically take the form of ransomware, DDoS attacks, network intrusions, and sextortion.
- Tech Support Fraud: In 2018, IC3 received over 14,000 complaints related to tech support fraud, resulting in losses of approximately $40 million – an increase of over 160% from 2017. The majority of the victims in these schemes were elderly.
- Creation of IC3 Recovery Asset Team: In February 2018, IC3 created a Recovery Asset Team (“RAT”) to streamline communications with financial institutions and assist the FBI with the recovery of funds for victims. Since its inception, RAT assisted in the recovery of over $192 million for victims of Internet crimes.
The Report serves as a reminder that threats from Internet crimes are ever present and increasing. Businesses and individuals would be well served to ensure that they understand the threats detailed in the Report and that they have adequately protected themselves in order to forestall or limit the significant financial and reputational damages that these Internet crimes can cause.
The material contained in this communication is informational, general in nature and does not constitute legal advice. The material contained in this communication should not be relied upon or used without consulting a lawyer to consider your specific circumstances. This communication was published on the date specified and may not include any changes in the topics, laws, rules or regulations covered. Receipt of this communication does not establish an attorney-client relationship. In some jurisdictions, this communication may be considered attorney advertising.
