The FBI's Internet Crime Complaint Center reported US$16.6 billion in losses for 2024, up 33 percent from 2023, across 859,532 complaints. It is a count of what victims chose to report, so it understates the real total and cannot be read as the cost of cybercrime overall.
The headline numbers
The 2024 IC3 annual report states that complaints totaled 859,532 and losses reached US$16.6 billion. Of those complaints, 256,256 reported an actual loss, and the average reported loss per complaint was US$19,372. Since 2000, the center says it has received more than 9 million complaints.
Which crimes carry the money
The report ranks crime types by reported loss. The top of the list is dominated by fraud, not by intrusion.
- Investment fraud: about US$6.57 billion
- Business email compromise: about US$2.77 billion
- Tech support fraud: about US$1.46 billion
- Personal data breach: about US$1.45 billion
- Non-payment or non-delivery: about US$785 million
The director's foreword says fraud represented the bulk of reported losses and that ransomware was again the most pervasive threat to critical infrastructure.
Why ransomware looks small
Ransomware shows only about US$12.5 million in adjusted losses in the loss table. That looks tiny next to other sources, and the report explains why: the figure does not include estimates of lost business, time, wages, files or equipment, or any third party remediation services. It also covers only victims who reported to IC3.
This is the lesson for anyone using the number in a risk model. A reported loss is a floor with a narrow definition, not a measure of total harm.
What the data cannot tell you
- Reporting is voluntary. Victims who never file are missing.
- Definitions differ. Different crime categories count different cost types.
- Some victims report no amount. The report notes that in some cases entities give no loss figure, which makes ransomware losses artificially low.
- Dollars are not causes. A large loss category says nothing about how the attack worked or which control would have stopped it.
How an engineering leader can use it
Use it to see where money is actually lost in the reporting population. For many organizations, a payment redirected by a convincing email is a bigger expected loss than an exotic exploit. That points to controls such as callback verification for payment changes and phishing resistant sign in.
Pair it with your own incident history. If your own data differs from the public pattern, trust yours and ask why.
Quick check
Is US$16.6 billion the total cost of cybercrime in 2024?
No. It is the sum of losses reported to IC3 by complainants. Unreported losses and indirect costs are not included.
Why is the ransomware loss figure so small?
The adjusted figure leaves out lost business, time, wages, files and remediation costs, and counts only reported cases.
Sources
Last reviewed: 19 October 2026.
