Sunday, February 16, 2020

IC3.gov 2019 Internet Crime Report: Its All About that BEC

For years I have been encouraging people to report their instances of Cybercrime to the FBI's Internet Crime & Complaint Center, IC3.gov.  Based on the number of reports, people are finally doing just that.  The growth in reporting over the last two years is remarkable -- driven in part by the desperation people are facing regarding two major cybercrime trends:  Ransomware and Business Email Compromise.  State and local authorities seem powerless to do anything about either of these, so finally they are encouraging (and in many cases helping) to get these crimes reported to the IC3, where we can use pattern matching to identify trends that reveal top criminals.

ic3.gov annual report

Comparing 2015 to 2019, cybercrime reports are up 61% ... with 467,361 complaints received just in calendar 2019.  An average of 1280 complaints per day!  But while the NUMBER of complaints has gone up by 61%, the dollars lost in those complaints has more than tripled!  While Ransomware is certainly an important topic, the key difference in the financial impact has been Business Email Compromise.   During calendar 2019, BEC complaints only accounted for 5% of the complaint volume (23,775 out of 467,361) that 5% of complaints accounted for 48.5% of all financial losses experienced by the victims ($1.7 Billion of 3.5 Billion!)

The good news on the BEC front is that the FBI has a stream-lined internationally successful process for recovering funds.  Started in February 2018, the FBI's Recovery Asset Team has been getting better and better at their process.  In Calendar 2019, the RAT was invoked on 1,307 cases, and were successful at recovering funds 79% of the time.  Out of $384,237,651 stolen, they recovered $304,930,696!  That is an amazing improvement over times past!

ic3.gov annual report

While Phishing, a crime that I've been personally invested in chasing for at least 15 years, remains the most commonly experienced crime, with 114,702 cases reported to the ic3.gov in 2019, from a financial perspective, it just isn't even close to BEC and Romance Scams, the two categories we also called out as most important in our review of the 2018 IC3.gov Report.  (See our blog post: IC3.gov: BEC Compromises and Romance Fraud 2018 from last April.)

By victim count, BEC came in as the #6 category, while Romance Scams came in at #7.
But by dollars lost, BEC is clearly #1 and Romance Scams are clearly #2.

Crime Type# Cases......Crime Type$$s Lost
Phishing114,702BEC$1,776,549,688
Non-Payment61,832Romance Scams$475,014,032
Extortion43,101Spoofing$300,478,433
Spoofing25,789Investment$222,186,195
BEC23,775Real Estate$221,365,911
Romance Scams19,473Non-Payment/Non-Delivery$196,563,497
......
Identity Theft16,053Credit Card Fraud$111,491,163
......
Credit Card Fraud14,378Phishing$57,836,379
......
Tech Support13,873Tech Support$54,041,053
......
Ransomware2,047Ransomware$8,965,847

While these losses seem staggering, please remember that these are ONLY THE REPORTED losses.  Especially in the area of Romance Scams, we believe the number is dramatically under-reported.  Often this is because the victim is an elderly person who either hides their victimization because they are embarrassed by the loss, or perhaps never realizes that they've been scammed, especially in the case of a person who may be experiencing mental decline, but has no caretaker.

The Financial Crimes Enforcement Network, FinCEN, used a far different approach to trying to identify the scale of BEC attacks, as we reported last year in our blog article: FinCEN: BEC far worse than previously believed.  FinCEN performed analysis on the Suspicious Activity Reports that are required of financial institutions in the United States and looked for tell-tale signs that the activity may have been a Business Email Compromise instance, whether reported to IC3 or not.  Based on FinCEN's numbers, we estimated the amount of money stolen by BEC criminals to be $8.7 Million per day -- JUST IN THE United States!

Our friends at Agari, (Hi John! Hi Crane! Hi Ronnie! Hi Patrick!), do a great deal of work in the BEC space, including running the Business Email Compromise Working Group.  Ronnie shared some stats in his blog last fall about how long it would take BEC crime to surpass each of several other crime types.  I encourage the interested reader to check it out here:   Business Email Compromise (BEC): Putting $26 Billion in Known Losses into Context.

State By State: BEC Statistics (2019)

The 2019 Annual IC3.gov report also has a break-down of state losses.  As we did last year (see: http://garwarner.blogspot.com/2019/04/ic3gov-bec-compromises-and-romance.html ) , we've tried to normalize these numbers by allowing you to compare the number of BEC victims and losses per state, but also expressing those as an average loss per victim and the number of victims per 100,000 population in that state.

To allow the reader to easily see if their state number of victims or their average victims per loss is far above or below the average, we'll share that information here.

The national average was $71,569 loss per BEC victim.
The average state had 6.8 victims per 100,000 population.

So, for example, my state, Alabama, has far less than the average loss, and also fewer victims per 100,000 than the national average.

The ten states (or territories) with the highest average BEC loss per victim were:
Ohio $395,000
Puerto Rico $206,004
Virgin Islands $188,544
Arkansas $142,841
New Mexico $118,006
New Jersey $107,687
Nevada $83,777
Illinois $83,421
Kansas $77,160
California $74,732

And the states (or territories) with the highest rate of victimization per 100,000 population were:
DC 25.8
Alaska 12.8
Colorado 10.6
Virgin Islands 10.3
Rhode Island 10.2
Virginia 9.8
Connecticut 9.1
Massachusetts 9.0
California 8.8
Maryland 8.2

Here is the BEC data for each state from IC3.gov (plus the population and average that we calculated here:) -- click for BEC Data by State in a sortable Excel spreadsheet

StateBEC VictimsBEC LossesAvg LossVics/10,0000
Alabama 218$7,581,736$34,7794.4
Alaska94$6,762,874$71,94512.8
Arizona447$23,530,353$52,6416.1
Arkansas112$15,998,213$142,8413.7
California3523$263,280,775$74,7328.8
Colorado620$35,640,598$57,48510.6
Connecticut324$19,084,050$58,9019.1
Delaware74$3,191,516$43,1297.5
DC186$6,870,085$36,93625.8
Florida1546$96,235,703$62,2487
Georgia570$36,817,673$64,5925.3
Hawaii79$4,948,948$62,6455.6
Idaho96$2,318,883$24,1555.3
Illinois782$65,235,477$83,4216.2
Indiana298$11,544,682$38,7414.4
Iowa157$9,910,940$63,1274.9
Kansas130$10,030,805$77,1604.5
Kentucky181$10,404,075$57,4814
Louisiana230$11,002,217$47,8365
Maine62$554,976$8,9514.6
Maryland501$24,535,672$48,9738.2
Massachusetts625$45,944,094$73,5119
Michigan579$24,733,625$42,7185.8
Minnesota428$23,256,989$54,3397.5
Mississippi82$5,846,230$71,2952.7
Missouri319$10,285,655$32,2435.2
Montana55$2,497,998$45,4185.1
Nebraska110$5,177,581$47,0695.6
Nevada195$16,336,581$83,7776.2
New Hampshire109$4,180,792$38,3567.9
New Jersey680$73,227,280$107,6877.6
New Mexico106$12,508,677$118,0065.1
New York1544$112,212,230$72,6767.9
North Carolina535$23,134,683$43,2425
North Dakota42$2,355,277$56,0785.5
Ohio613$242,135,013$395,0005.2
Oklahoma161$10,110,690$62,7994.1
Oregon317$12,231,269$38,5847.4
Pennsylvania826$53,899,517$65,2546.4
Puerto Rico24$4,944,094$206,0040.8
Rhode Island108$7,007,312$64,88310.2
South Carolina270$7,433,141$27,5305.2
South Dakota34$879,695$25,8733.8
Tennessee331$12,938,403$39,0894.8
Texas2149$124,223,441$57,8057.3
Utah229$12,631,528$55,1607
Vermont51$1,131,002$22,1778.1
Virgin Islands11$2,073,984$188,54410.3
Virginia842$53,190,542$63,1729.8
Washington606$33,304,309$54,9587.8
West Virginia48$879,043$18,3132.7
Wisconsin296$8,908,811$30,0975.1
Wyoming22$711,872$32,3583.9
TOTAL$71,5696.8


State By State: Romance Scam Statistics (2019)

For "Confidence/Romance Scams"
the national average loss was $25,911 per victim.
the average number of victims per 100,000 population was 4.9.

In my state, we were about normal for victimization rate, with a slightly lower 4.1 victims per 100,000.  We were also slightly below the national average loss per victim, with $21,166 lost per victim or Romance Scams.

The ten states that the highest average losses per victim for Romance Scams were:
Oklahoma $70,288
Montana $68,102
Massachusetts $62,018
California $48,891
Louisiana $44,859
Washington $33,700
Florida $31,916
Rhode Island $29,300
Delaware $28,007
Colorado $25,382

While the states with the highest number of romance scam victims per 100,000 population were:

Nevada 9.4
Wyoming 7.8
Alaska 7.1
Washington 7.0
Utah 6.9
New Hampshire 6.4
Minnesota 6.4
Florida 6.2
Maryland 6.1
Oregon 6.1
Colorado 6.0


StateRomance Scam
Victims
LossesAvg LossVics/10,000
Alabama 201$4,254,420$21,1664.1
Alaska52$621,265$11,9477.1
Arizona419$5,605,375$13,3785.7
Arkansas124$2,805,097$22,6224.1
California2206$107,853,977$48,8915.5
Colorado353$8,959,763$25,3826
Connecticut176$3,362,156$19,1034.9
Delaware44$1,232,292$28,0074.5
DC36$199,106$5,5315
Florida1363$43,500,838$31,9166.2
Georgia437$6,524,578$14,9304.1
Hawaii75$1,705,801$22,7445.3
Idaho92$1,421,497$15,4515
Illinois518$11,047,440$21,3274.1
Indiana288$3,249,354$11,2824.3
Iowa107$1,650,707$15,4273.4
Kansas107$1,710,339$15,9843.7
Kentucky195$1,941,242$9,9554.3
Louisiana160$7,177,382$44,8593.4
Maine49$187,176$3,8203.6
Maryland372$7,707,631$20,7196.1
Massachusetts285$17,675,211$62,0184.1
Michigan433$6,384,635$14,7454.3
Minnesota363$6,846,879$18,8626.4
Mississippi93$1,286,258$13,8313.1
Missouri304$5,157,304$16,9654.9
Montana53$3,609,397$68,1024.9
Nebraska72$942,695$13,0933.7
Nevada294$4,195,843$14,2729.4
New Hampshire88$1,513,143$17,1956.4
New Jersey363$7,780,273$21,4334.1
New Mexico114$1,648,758$14,4635.4
New York931$19,695,267$21,1554.8
North Carolina422$5,924,081$14,0384
North Dakota36$335,781$9,3274.7
Ohio456$5,728,118$12,5623.9
Oklahoma182$12,792,492$70,2884.6
Oregon261$4,351,573$16,6736.1
Pennsylvania607$14,126,697$23,2734.7
Puerto Rico59$357,154$6,0531.9
Rhode Island55$1,611,497$29,3005.2
South Carolina212$4,695,662$22,1494.1
South Dakota27$351,153$13,0063
Tennessee293$4,948,521$16,8894.2
Texas1287$32,414,594$25,1864.4
Utah228$4,543,173$19,9266.9
Vermont23$286,638$12,4633.7
Virgin Islands4$10,301$2,5753.7
Virginia468$8,032,153$17,1635.4
Washington548$18,467,450$33,7007
West Virginia89$1,454,180$16,3395
Wisconsin291$3,671,646$12,6175
Wyoming44$320,267$7,2797.8
TOTAL$25,9114.9







1 comment:

  1. Anonymous8:59 AM

    Hi Gary! Thanks for the shout-out to our team for their ongoing and relentless work around BEC. Jean

    ReplyDelete

Trying a new setting. After turning on comments, I got about 20-30 comments per day that were all link spam. Sorry to require login, but the spam was too much.