Cybercriminals Stole $6.9 Billion In 2021, Using Social Engineering To Break Into Remote Workplaces

Topline

The number of cybercrime complaints to the Federal Bureau of Investigation rose 7% in 2021 to 847,376 and total money lost to cybercrime increased 64% to $6.9 billion, the FBI said Tuesday in its annual Internet Crime Report, which highlighted how remote communication and virtual meetings can leave businesses and individuals vulnerable to social engineering attacks by fraudsters.

Money lost to online scams hit a new high in 2021, the FBI reported.

getty

Key Facts

Cybercriminals stole $2.4 billion by compromising business email accounts, which are often used to initiate fraudulent wire transfers; $1.46 billion through investment scams, which often involved bogus cryptocurrency investment opportunities; and $956 million through confidence fraud and romance scams, in which a scammer may pose as a potential romantic partner before demanding money to remedy a supposed emergency.

The rise of remote work and virtual meetings led to an increase in online scams:one new technique involved scammers inviting company employees to a virtual meeting and then using “deepfake” simulated audio of an executive’s voice to instruct employees to transfer money to a fraudulent account, according to the report.

Scammers are increasingly turning to difficult-to-trace cryptocurrency transactions enabled by crypto-compatible ATMs, which the FBI describes as poorly regulated and offering instantaneous and irreversible transactions.

Senior citizens, whom the FBI says are more vulnerable to scammers because they are often relatively trusting and financially well-off, lost significantly more to cybercrime than younger people—people age 60 and over filed 92,371 complaints in 2021 and reported $1.68 billion lost, while people age 20-29 filed 69,390 complaints but reported only $431 million lost.

California—historically the most cybercrime-prone state, and the site of high-profile incidents including celebrity account breaches and multi-million-dollar “SIM swapping” scams—was hardest hit in 2021, with 67,095 victims reporting $1.23 billion in losses, followed by Texas, with 41,148 victims reporting $606 million in losses, and New York, with 29,065 victims reporting $560 million in losses.

Almost all cybercrime metrics have increased dramatically since 2017—money lost increased by 393% and the overall number of complaints increased by 191%, while reports of phishing—in which a scammer sends an email pretending to represent a reputable company in order to trick the victim into revealing passwords or other information—were up by a whopping 1,178%.

Key Background

As fraud countermeasures advanced, scammers moved from simple email spoofing to sophisticated social-engineering schemes, posing as customer service representatives, law enforcement officials and even victims’ own family members to gain access to victims’ accounts or to prompt money transfers to fraudulent accounts. The FBI Internet Crime Complaint Center’s Recovery Asset Team (RAT), established in 2018, acts as a liaison between law enforcement and banks, investigating emerging cybercrime strategies and attempting to rapidly freeze funds fraudulently sent to U.S.-based accounts. Since its inception, the RAT has succeeded in freezing $328 million, or about 74%, of a total $443 million transferred in 1,726 fraud incidents, the FBI reported. Reported personal data breaches affected 51,829 people in 2021, up 14% from the previous year, though personal data leaks were not always instigated by scammers—an investigation by cybersecurity news site CyberNews found that numerous Android users had their personal and financial information leaked due to unintentional security flaws in popular apps.

Big Number

466,501. That’s how many cybercrime victims filed reports with the FBI in the U.S., compared to 303,949 victims in the U.K. and 25,002 victims in all other countries combined.

Tangent

Maine reported just $7.26 million in losses, the least of any state, followed by West Virginia with $9.45 million in losses and Vermont with $9.83 million in losses. North Dakota was home to just 670 cybercrime victims, followed by Vermont with 715 victims and Wyoming with 735 victims. However, American Samoa—a territory with a population of about 46,366—reported the lowest numbers of any U.S. state or territory, with $177,533 in losses to 25 victims.

Contra

Not all forms of cybercrime have increased since 2020. In 2021, the FBI received 49% fewer reports of online extortion and 24% fewer reports of online non-payment/non-delivery scams.