IC3.gov 2019 Internet Crime Report: Its All About that BEC

For years I have been encouraging people to report their instances of Cybercrime to the FBI's Internet Crime & Complaint Center, IC3.gov.  Based on the number of reports, people are finally doing just that.  The growth in reporting over the last two years is remarkable -- driven in part by the desperation people are facing regarding two major cybercrime trends:  Ransomware and Business Email Compromise.  State and local authorities seem powerless to do anything about either of these, so finally they are encouraging (and in many cases helping) to get these crimes reported to the IC3, where we can use pattern matching to identify trends that reveal top criminals.

ic3.gov annual report

Comparing 2015 to 2019, cybercrime reports are up 61% ... with 467,361 complaints received just in calendar 2019.  An average of 1280 complaints per day!  But while the NUMBER of complaints has gone up by 61%, the dollars lost in those complaints has more than tripled!  While Ransomware is certainly an important topic, the key difference in the financial impact has been Business Email Compromise.   During calendar 2019, BEC complaints only accounted for 5% of the complaint volume (23,775 out of 467,361) that 5% of complaints accounted for 48.5% of all financial losses experienced by the victims ($1.7 Billion of 3.5 Billion!)

The good news on the BEC front is that the FBI has a stream-lined internationally successful process for recovering funds.  Started in February 2018, the FBI's Recovery Asset Team has been getting better and better at their process.  In Calendar 2019, the RAT was invoked on 1,307 cases, and were successful at recovering funds 79% of the time.  Out of $384,237,651 stolen, they recovered $304,930,696!  That is an amazing improvement over times past!

ic3.gov annual report

While Phishing, a crime that I've been personally invested in chasing for at least 15 years, remains the most commonly experienced crime, with 114,702 cases reported to the ic3.gov in 2019, from a financial perspective, it just isn't even close to BEC and Romance Scams, the two categories we also called out as most important in our review of the 2018 IC3.gov Report.  (See our blog post: IC3.gov: BEC Compromises and Romance Fraud 2018 from last April.)

By victim count, BEC came in as the #6 category, while Romance Scams came in at #7.
But by dollars lost, BEC is clearly #1 and Romance Scams are clearly #2.

Crime Type	# Cases	......	Crime Type	$$s Lost
Phishing	114,702		BEC	$1,776,549,688
Non-Payment	61,832		Romance Scams	$475,014,032
Extortion	43,101		Spoofing	$300,478,433
Spoofing	25,789		Investment	$222,186,195
BEC	23,775		Real Estate	$221,365,911
Romance Scams	19,473		Non-Payment/Non-Delivery	$196,563,497
...			...
Identity Theft	16,053		Credit Card Fraud	$111,491,163
...			...
Credit Card Fraud	14,378		Phishing	$57,836,379
...			...
Tech Support	13,873		Tech Support	$54,041,053
...			...
Ransomware	2,047		Ransomware	$8,965,847

While these losses seem staggering, please remember that these are ONLY THE REPORTED losses.  Especially in the area of Romance Scams, we believe the number is dramatically under-reported.  Often this is because the victim is an elderly person who either hides their victimization because they are embarrassed by the loss, or perhaps never realizes that they've been scammed, especially in the case of a person who may be experiencing mental decline, but has no caretaker.

The Financial Crimes Enforcement Network, FinCEN, used a far different approach to trying to identify the scale of BEC attacks, as we reported last year in our blog article: FinCEN: BEC far worse than previously believed.  FinCEN performed analysis on the Suspicious Activity Reports that are required of financial institutions in the United States and looked for tell-tale signs that the activity may have been a Business Email Compromise instance, whether reported to IC3 or not.  Based on FinCEN's numbers, we estimated the amount of money stolen by BEC criminals to be $8.7 Million per day -- JUST IN THE United States!

Our friends at Agari, (Hi John! Hi Crane! Hi Ronnie! Hi Patrick!), do a great deal of work in the BEC space, including running the Business Email Compromise Working Group.  Ronnie shared some stats in his blog last fall about how long it would take BEC crime to surpass each of several other crime types.  I encourage the interested reader to check it out here:   Business Email Compromise (BEC): Putting $26 Billion in Known Losses into Context.

State By State: BEC Statistics (2019)

The 2019 Annual IC3.gov report also has a break-down of state losses.  As we did last year (see: http://garwarner.blogspot.com/2019/04/ic3gov-bec-compromises-and-romance.html ) , we've tried to normalize these numbers by allowing you to compare the number of BEC victims and losses per state, but also expressing those as an average loss per victim and the number of victims per 100,000 population in that state.

To allow the reader to easily see if their state number of victims or their average victims per loss is far above or below the average, we'll share that information here.

The national average was $71,569 loss per BEC victim.
The average state had 6.8 victims per 100,000 population.

So, for example, my state, Alabama, has far less than the average loss, and also fewer victims per 100,000 than the national average.

The ten states (or territories) with the highest average BEC loss per victim were:

Ohio	$395,000
Puerto Rico	$206,004
Virgin Islands	$188,544
Arkansas	$142,841
New Mexico	$118,006
New Jersey	$107,687
Nevada	$83,777
Illinois	$83,421
Kansas	$77,160
California	$74,732

And the states (or territories) with the highest rate of victimization per 100,000 population were:

DC	25.8
Alaska	12.8
Colorado	10.6
Virgin Islands	10.3
Rhode Island	10.2
Virginia	9.8
Connecticut	9.1
Massachusetts	9.0
California	8.8
Maryland	8.2

Here is the BEC data for each state from IC3.gov (plus the population and average that we calculated here:)

State	BEC Victims	BEC Losses	Avg Loss	Vics/10,0000
Alabama	218	$7,581,736	$34,779	4.4
Alaska	94	$6,762,874	$71,945	12.8
Arizona	447	$23,530,353	$52,641	6.1
Arkansas	112	$15,998,213	$142,841	3.7
California	3523	$263,280,775	$74,732	8.8
Colorado	620	$35,640,598	$57,485	10.6
Connecticut	324	$19,084,050	$58,901	9.1
Delaware	74	$3,191,516	$43,129	7.5
DC	186	$6,870,085	$36,936	25.8
Florida	1546	$96,235,703	$62,248	7
Georgia	570	$36,817,673	$64,592	5.3
Hawaii	79	$4,948,948	$62,645	5.6
Idaho	96	$2,318,883	$24,155	5.3
Illinois	782	$65,235,477	$83,421	6.2
Indiana	298	$11,544,682	$38,741	4.4
Iowa	157	$9,910,940	$63,127	4.9
Kansas	130	$10,030,805	$77,160	4.5
Kentucky	181	$10,404,075	$57,481	4
Louisiana	230	$11,002,217	$47,836	5
Maine	62	$554,976	$8,951	4.6
Maryland	501	$24,535,672	$48,973	8.2
Massachusetts	625	$45,944,094	$73,511	9
Michigan	579	$24,733,625	$42,718	5.8
Minnesota	428	$23,256,989	$54,339	7.5
Mississippi	82	$5,846,230	$71,295	2.7
Missouri	319	$10,285,655	$32,243	5.2
Montana	55	$2,497,998	$45,418	5.1
Nebraska	110	$5,177,581	$47,069	5.6
Nevada	195	$16,336,581	$83,777	6.2
New Hampshire	109	$4,180,792	$38,356	7.9
New Jersey	680	$73,227,280	$107,687	7.6
New Mexico	106	$12,508,677	$118,006	5.1
New York	1544	$112,212,230	$72,676	7.9
North Carolina	535	$23,134,683	$43,242	5
North Dakota	42	$2,355,277	$56,078	5.5
Ohio	613	$242,135,013	$395,000	5.2
Oklahoma	161	$10,110,690	$62,799	4.1
Oregon	317	$12,231,269	$38,584	7.4
Pennsylvania	826	$53,899,517	$65,254	6.4
Puerto Rico	24	$4,944,094	$206,004	0.8
Rhode Island	108	$7,007,312	$64,883	10.2
South Carolina	270	$7,433,141	$27,530	5.2
South Dakota	34	$879,695	$25,873	3.8
Tennessee	331	$12,938,403	$39,089	4.8
Texas	2149	$124,223,441	$57,805	7.3
Utah	229	$12,631,528	$55,160	7
Vermont	51	$1,131,002	$22,177	8.1
Virgin Islands	11	$2,073,984	$188,544	10.3
Virginia	842	$53,190,542	$63,172	9.8
Washington	606	$33,304,309	$54,958	7.8
West Virginia	48	$879,043	$18,313	2.7
Wisconsin	296	$8,908,811	$30,097	5.1
Wyoming	22	$711,872	$32,358	3.9
TOTAL			$71,569	6.8

State By State: Romance Scam Statistics (2019)

For "Confidence/Romance Scams"
the national average loss was $25,911 per victim.
the average number of victims per 100,000 population was 4.9.

In my state, we were about normal for victimization rate, with a slightly lower 4.1 victims per 100,000.  We were also slightly below the national average loss per victim, with $21,166 lost per victim or Romance Scams.

The ten states that the highest average losses per victim for Romance Scams were:

Oklahoma	$70,288
Montana	$68,102
Massachusetts	$62,018
California	$48,891
Louisiana	$44,859
Washington	$33,700
Florida	$31,916
Rhode Island	$29,300
Delaware	$28,007
Colorado	$25,382

While the states with the highest number of romance scam victims per 100,000 population were:

Nevada	9.4
Wyoming	7.8
Alaska	7.1
Washington	7.0
Utah	6.9
New Hampshire	6.4
Minnesota	6.4
Florida	6.2
Maryland	6.1
Oregon	6.1
Colorado	6.0

State	Romance Scam Victims	Losses	Avg Loss	Vics/10,000
Alabama	201	$4,254,420	$21,166	4.1
Alaska	52	$621,265	$11,947	7.1
Arizona	419	$5,605,375	$13,378	5.7
Arkansas	124	$2,805,097	$22,622	4.1
California	2206	$107,853,977	$48,891	5.5
Colorado	353	$8,959,763	$25,382	6
Connecticut	176	$3,362,156	$19,103	4.9
Delaware	44	$1,232,292	$28,007	4.5
DC	36	$199,106	$5,531	5
Florida	1363	$43,500,838	$31,916	6.2
Georgia	437	$6,524,578	$14,930	4.1
Hawaii	75	$1,705,801	$22,744	5.3
Idaho	92	$1,421,497	$15,451	5
Illinois	518	$11,047,440	$21,327	4.1
Indiana	288	$3,249,354	$11,282	4.3
Iowa	107	$1,650,707	$15,427	3.4
Kansas	107	$1,710,339	$15,984	3.7
Kentucky	195	$1,941,242	$9,955	4.3
Louisiana	160	$7,177,382	$44,859	3.4
Maine	49	$187,176	$3,820	3.6
Maryland	372	$7,707,631	$20,719	6.1
Massachusetts	285	$17,675,211	$62,018	4.1
Michigan	433	$6,384,635	$14,745	4.3
Minnesota	363	$6,846,879	$18,862	6.4
Mississippi	93	$1,286,258	$13,831	3.1
Missouri	304	$5,157,304	$16,965	4.9
Montana	53	$3,609,397	$68,102	4.9
Nebraska	72	$942,695	$13,093	3.7
Nevada	294	$4,195,843	$14,272	9.4
New Hampshire	88	$1,513,143	$17,195	6.4
New Jersey	363	$7,780,273	$21,433	4.1
New Mexico	114	$1,648,758	$14,463	5.4
New York	931	$19,695,267	$21,155	4.8
North Carolina	422	$5,924,081	$14,038	4
North Dakota	36	$335,781	$9,327	4.7
Ohio	456	$5,728,118	$12,562	3.9
Oklahoma	182	$12,792,492	$70,288	4.6
Oregon	261	$4,351,573	$16,673	6.1
Pennsylvania	607	$14,126,697	$23,273	4.7
Puerto Rico	59	$357,154	$6,053	1.9
Rhode Island	55	$1,611,497	$29,300	5.2
South Carolina	212	$4,695,662	$22,149	4.1
South Dakota	27	$351,153	$13,006	3
Tennessee	293	$4,948,521	$16,889	4.2
Texas	1287	$32,414,594	$25,186	4.4
Utah	228	$4,543,173	$19,926	6.9
Vermont	23	$286,638	$12,463	3.7
Virgin Islands	4	$10,301	$2,575	3.7
Virginia	468	$8,032,153	$17,163	5.4
Washington	548	$18,467,450	$33,700	7
West Virginia	89	$1,454,180	$16,339	5
Wisconsin	291	$3,671,646	$12,617	5
Wyoming	44	$320,267	$7,279	7.8
TOTAL			$25,911	4.9