UMACHA 50 years of guiding payments

Insights from the FBI’s 2023 IC3 Report

Published on May 3, 2024




AUTHOR

Eric Wester, AAP, APRP, NCP
Associate Director of Education Services



The Internet Crime Complaint Center (off-site) (“IC3”), provides a centralized method for individuals and organizations alike who have fallen victim to cybercrime to report the crime to the FBI and its criminal justice partners. In 2023, IC3 received a record 880,418 complaints from the American public, with potential losses exceeding $12.5 billion. This reflects nearly a 10% increase in complaints received and represents a 22% increase in losses suffered compared to 2022. The release of the FBI’s annual report provides valuable insights not only into the number of cybercrimes occurring and the dollar amount of damages but also sheds light on fraud trends.

Business Email Compromise
Business Email Compromise (“BEC”) is a sophisticated scam that may target both businesses and individuals performing a transfer of funds. The scam is frequently carried out when a fraudster compromises legitimate business email accounts through social engineering or computer intrusion techniques resulting in an unauthorized transfer of funds.

Oftentimes criminals will target a business or individual that remits payments either through wire transfer or ACH credit transfer, although any payment mechanism that allows for the transmission of a credit-push payment may become a target.


The IC3 received 21,832 BEC complaints in 2022, with adjusted losses exceeding $2.7 billion. In 2023, there were 21,489 complaints (a decrease of 343 complaints), resulting in adjusted losses of over $2.9 billion (an increase of $0.2 billion).

While the number of complaints decreased only slightly, there was an increase in financial losses year-over-year. These figures underscore the persistent threat of BEC attacks, with perpetrators continually finding ways to exploit vulnerabilities in organizations' processes, procedures, and controls, causing significant financial harm.

The FBI offers the following recommendations to businesses or individuals that have fallen victim to Business Email Compromise:
  1. Contact the originating financial institution as soon as fraud is recognized to request a recall or reversal as well as a Hold Harmless Letter or Letter of Indemnity.
  2. File a detailed complaint with www.ic3.gov (off-site). It is vital the complaint contains all required data in provided fields, including banking information.
    1. In addition to submitting the report online, contact your local FBI field office (off-site) to report the crime.
  3. Visit www.ic3.gov (off-site) for updated public service announcements regarding BEC trends as well as other fraud schemes targeting specific populations (real estate, pre-paid cards, W-2, etc.).
  4. Never make any payment changes without verifying with the intended recipient; verify email addresses are accurate when checking mail on a cell phone or other mobile device.​

The IC3 Recovery Asset Team (RAT)
The Internet Crime Complaint Center’s Recovery Asset Team (RAT) was established to assist in streamlining communication between financial institutions and the FBI and to assist in freezing funds that were transferred to domestic accounts under fraudulent pretenses, such as BEC.


It is important to note that the FBI will not generally seize funds; rather, they will aid in having the beneficiary financial institution freeze the funds so they can be returned to the sending financial institution. Because of this, it is essential that a sending financial institution communicates its request to the beneficiary financial institution that it is seeking the return of funds due to fraud.

Investment Fraud Trends, Including Cryptocurrency
In 2023, the losses reported due to investment scams became the highest of any crime type tracked by the IC3. Investment fraud losses rose from $3.31 billion in 2022 to $4.57 billion in 2023, representing a 38% increase. Investment fraud related to cryptocurrency surged from $2.57 billion in 2022 to $3.96 billion in 2023, reflecting a 53% increase and constituting a majority of the investment scams reported.

Cryptocurrency scams are often designed to entice targeted victims into believing they can receive lucrative returns on their initial investments. Individuals aged 40-49 filed the most investment scam complaints, followed by those aged 30-39, and finally those over the age of 60.

The FBI provides the following guidance to those who may be a victim of a cryptocurrency scam:
  1. Immediately submit a report to the IC3 at www.ic3.gov (off-site) or contact your local FBI field office (off-site) and provide as much transaction information as possible. Be prepared to share the following information: 
    1. Transaction details including cryptocurrency addresses, amount and type of cryptocurrency, date and time, and transaction ID (hash). These unique identifiers vary in length and look like long strings of random letters and numbers.
    2. Where and how you first encountered the scammer.
    3. Your communications with the scammer (for example, emails or texts) and associated identifiers such as names, email addresses, and phone numbers.
    4. What domain names, website addresses, or applications the scammer instructed you to use.
    5. Any two-factor authentication or "one time passcode" information.
    6. Which cryptocurrency exchanges you used to send or receive funds.
    7. The timeline of the scam.
  2. Be wary of anyone claiming they can recover your funds as this may be another scam.

Other Fraud Trends
In 2023, the IC3 received 2,825 complaints identified as ransomware, with adjusted losses totaling more than $59.6 million. Among these complaints, 122 were submitted by the financial services sector. The healthcare and public health sector, constituting the most targeted sector, accounted for 249 of the submitted complaints. These figures represent an increase from 2022, when the IC3 received 2,385 complaints identified as ransomware, with adjusted losses exceeding $34.3 million.

In its 2022 IC3 Report, the FBI provided the following recommended immediate actions to take to protect against ransomware:  In 2023, the IC3 received 51,750 impersonation scam complaints, comprised of 14,190 government impersonation complaints and 37,560 tech and customer support impersonation complaints. While both types of impersonation scams are trending upward, government impersonation scams are significantly on the rise, experiencing a 63% increase.

UMACHA is Here to Help
As your key partner in helping you understand electronic payments, UMACHA is pleased to offer several fraud-related education offerings available from our on-demand library: Explore even more webinars available in our on-demand library, and consider joining us for an in-person Fraud Symposium on October 1, 2024, in Bismarck, ND, brought to you in cooperation with the FRPA and ICBND. 

Remember you can always reach out to our Member Hotline by sending an email to info@umacha.org or giving us a call at (763) 549-7000. There’s nothing we love more than diving into a question or issue and helping bring clarity by providing guidance. 

Stay connected with Eric Wester and UMACHA on LinkedIn!

References