Top Cybercrime Trends Everyone Should Watch Right Now

What the Numbers Measure—and What They Do Not

The FBI’s April 2026 announcement of its 2025 Internet Crime Report describes more than one million complaints and nearly $21 billion in reported losses. Those are submissions to a particular reporting system, not a census of every victim. A rise can reflect changes in crime, reporting and classification. It is still important evidence, but it does not justify saying that every household’s personal risk increased by the same percentage.

The FTC’s Consumer Sentinel reporting system has a different scope and collection process. Do not add its losses to FBI totals as though they are separate, nonoverlapping sets of incidents. Similarly, the most frequently reported category may not be the category with the largest losses. This article separates prevalence, financial harm and a changing technique where the evidence allows it. For the broader explanation of why methods evolve, see our guide to changing cybercrime methods.

Impersonation Still Turns Trust Into a Payment

The FTC reported $3.5 billion in 2025 imposter-scam losses, nearly three times the 2020 amount. The category includes people pretending to represent familiar businesses, government agencies or other trusted parties. A common pressure point is a security warning that turns into instructions to move money. The protective decision is to break the communication path: contact the claimed organization independently instead of continuing through the caller’s number, link or chat.

Imagine a message saying your account is under attack and that a specialist has prepared a “safe” account for your savings. The story frames the transfer as protection, but the action moves control of your money toward someone you have not verified. Open the institution’s established app or use a number obtained independently. Do not let the person who created the emergency also define the only acceptable verification method.

This approach does not depend on spotting poor grammar. A fraudulent message may use your name, a plausible transaction and a professional explanation. It may even arrive during a real problem that makes the story feel timely. Ask what the message wants you to do, whether that action moves money or exposes access, and whether a trusted channel confirms it. Recognition is useful; a verification routine is what keeps a convincing story from becoming a transfer.

Social Media Is Both a Contact Channel and a Storefront

In its April 2026 social-media analysis, the FTC reported $2.1 billion in 2025 losses from scams beginning on social media, about eight times the 2020 figure. The platform can supply an advertisement, a friendly introduction, a shopping offer or a community of apparent supporters. These are different hooks sharing the same initial environment. An advertisement’s placement and a profile’s polished appearance do not establish the seller’s or adviser’s legitimacy. Keep the contact channel separate from the underlying proposition: a platform may be genuine while an advertiser is fraudulent. A friend may share an offer sincerely without having verified it. Neither the platform’s existence nor your friend’s good intentions establishes that the destination business will deliver what it promises.

For a purchase, leave the ad’s immediate path long enough to check the business and the actual website. Look for independently available information about delivery, returns and complaints rather than relying only on comments beside the promotion. A familiar brand’s pictures can be copied, and a discount can lead to an imitation storefront. If you already paid and the transaction appears fraudulent, contact the payment provider promptly; do not assume a disappearing social profile is the only possible recovery route.

Investment Fraud Can Build Confidence Before Taking More

Investment schemes remain a major loss category in the FBI’s 2025 annual report. A convincing dashboard is not independent proof that an investment exists. An account can display invented profits, and a small early withdrawal can make a later demand seem credible. Treat an unexpected adviser, a private group full of enthusiastic testimonials and a platform chosen by that contact as linked parts of one proposal. Verify through appropriate independent financial-regulatory resources for your jurisdiction, and do not pay additional “taxes” or “release fees” simply because the same contact says they unlock your balance.

AI Makes Familiar Deception Easier to Package

The FBI’s generative-AI fraud advisory describes synthetic text, images, audio and video supporting scams. The change is in the effort needed to create persuasive material, not the invention of an entirely new motive. A voice clone may support an emergency-payment story; a synthetic profile may support a relationship or investment pitch. The annual FBI report now includes AI-related complaint reporting, but that does not mean every fraud using polished language has been proved to involve AI.

Do not make your entire defense a visual deepfake test. Artifacts can be absent, and an ordinary low-quality call can also look or sound strange. A better response to a money request is to verify the person through a contact route you already trust. For a purported executive instruction, retain the normal payment approval process even when the voice sounds right. For a family emergency, independently contact the person or another reliable contact rather than sending money solely because the caller sounds familiar.

Payment Diversion Can Arrive Through Real Business Email

Business email compromise is not limited to an obviously fake sender. The FBI’s BEC guidance describes fraud targeting legitimate-looking business communications and transfers. A criminal may imitate an expected invoice or use a compromised mailbox to change payment instructions. A reply inside an existing conversation can therefore feel reassuring while remaining unsafe. The transaction needs its own check; confidence in the email thread should not automatically approve a new destination.

For a small business, write one concrete rule: a bank-detail change must be confirmed through an established contact method and approved through the agreed process. A second reviewer needs to verify the relevant information rather than merely click approval. The same principle matters to individuals making large payments, such as a home purchase. Instructions that redirect a transfer deserve independent confirmation even when the amount and surrounding paperwork look expected.

Separate fraud prevention from mailbox recovery. If someone has already accessed a business account, responders may need to examine forwarding rules, active sessions and related access in addition to blocking the payment. The finance team can contact its bank while IT investigates the account. Waiting for the technical explanation before reporting the transfer can lose valuable time. These are coordinated tasks with different purposes, not competing theories about what happened.

Job Offers That Require You to Fund the Work

The FTC’s task-scam warning describes schemes that make simple online work appear to generate earnings, then demand deposits to continue or withdraw. The account balance and progress meter can turn the experience into a game in which the next payment seems necessary to finish. A job that requires you to send money to unlock your own supposed pay deserves a stop, not another deposit. Check the employer through independently established channels, and distinguish an application process from a money-transfer demand.

Ransomware and Data Extortion Still Need Separate Preparation

The FBI’s 2025 report continues to document ransomware complaints. Its reported-loss figures do not capture every cost of downtime and restoration, so a small number in a table should not be mistaken for the full business impact. Ransomware can block access to systems, while data-extortion pressure can involve threatened disclosure. An organization should consider both availability and confidentiality rather than assume that restoring files settles every consequence.

Backups are useful when they can actually be restored and are protected from the same access that an intruder might abuse. Test the restoration of a small, representative business function instead of only checking that a backup job completed. Also know how to reach a response provider and maintain critical operations if ordinary systems are unavailable. This is a continuing threat priority, not a claim that one complaint dataset establishes the fastest-growing ransomware trend everywhere.

The Next Scam May Target the Person Already Harmed

After a loss, an unsolicited recovery offer can exploit the desire to undo it. The FTC’s refund and recovery scam guidance warns about people promising to recover money in exchange for advance payment or sensitive information. A person who knows details of the original incident has not proved that they are a legitimate investigator. Treat the new approach as a separate request that needs verification, especially when it demands another payment.

Keep records of the original contact and transactions, then use the payment service’s official process and the appropriate reporting channels. Do not give a self-appointed recovery agent remote access to your device or account merely because they claim to trace funds. Cryptocurrency transaction details may be useful to investigators, but possession of an address or screenshot does not guarantee that the person offering help can return the money.

Support from family, colleagues or a trusted adviser can also help break the pressure. Shame is useful to scammers when it keeps the victim isolated and willing to follow another secret instruction. A constructive conversation focuses on what happened, how to stop further payments and which verified organizations can help. It avoids promising a recovery outcome that nobody has established. Reporting remains useful even when the final financial result is uncertain.

Choose the Protective Rule That Matches the Request

The common thread across this watchlist is control of a sensitive action. For money, independently confirm the destination. For a login, use the service’s known entry point instead of the message link. For software installation, verify the source and requested access. For a business interruption, use the response and recovery arrangements already prepared. These rules address the decision the scammer is trying to influence. A household can rehearse one example: an unexpected call asks for immediate money, so the recipient ends that conversation and checks through the established family contact. A business can rehearse a changed supplier account using its actual approval process. Practice makes the pause usable when urgency is real. They remain useful when the message, voice or platform changes, without requiring everyone to recognize the latest criminal brand name.

If the Request Has Already Succeeded

Contact the bank, payment provider or affected service through a verified route promptly and explain the actual transaction or account event. Ask what containment or recovery options are available; do not assume a reversal is guaranteed. If credentials were entered into a fraudulent site, secure the affected account from a trusted device and examine recovery and session settings. If a work account or business payment is involved, notify the responsible internal team as well. Preserve useful messages and transaction records without continuing to engage the suspected scammer.

For U.S. reporting, use IC3 for suspected internet crime and ReportFraud.ftc.gov for fraud reports; readers elsewhere should use their own official services. Return to the dated evidence when updating a watchlist, rather than simply replacing the year in the headline. A useful trend article explains the reporting period, the behavior worth recognizing and the action that fits it. That is more valuable than declaring every new technology the largest threat or treating familiar fraud as yesterday’s problem.