FBI 2025 Report: $20.8B Lost, and Email Is Still the Door

Introduction: A Record Year, and Email Owns the Front Door

The FBI's Internet Crime Complaint Center (IC3) released its 2025 Internet Crime Report, and the headline number is staggering: $20.8 billion in reported losses, a 26% jump over 2024, built on more than one million complaints--the first time IC3 has crossed that threshold in a single year.

But the most important finding for anyone who manages an inbox isn't the total. It's the conclusion the report draws about how the money is lost. In the FBI's framing, social engineering, not technical exploitation, is now the primary driver of financial impact. Attackers didn't break in. They logged in, or they asked--by email.

The 2025 Numbers That Matter

Business Email Compromise: The $3 Billion Email Problem

BEC is the purest example of why email is still the most dangerous surface in any organization. There's no malware, no exploit, no breached firewall. There's an email--often from a spoofed or compromised account--asking someone to wire money, change banking details, or approve an invoice. As we explained in the BDR spam problem and SpamGPT, the same AI tooling that mass-produces cold sales pitches also produces flawless, context-aware fraud.

The $3 billion in 2025 BEC losses didn't come from sloppy "Nigerian prince" emails. They came from messages that read like a real CFO, a real vendor, a real follow-up on a real thread--because attackers now scrape breach data and generate tailored language at scale. That's the data-breach-to-inbox pipeline in action, and the IC3 numbers are its receipts.

The New Line Item: AI-Enabled Crime

For the first time, the FBI broke out AI-enabled attacks as a distinct category--roughly $900 million in losses. That's notable not because the number is the largest (it isn't yet), but because it's now large enough and distinct enough to track separately. It confirms what we've been documenting all year: AI didn't just speed up content creation, it changed the economics of social engineering.

"They Didn't Break In, They Logged In"

The most quoted observation from the 2025 cycle is that almost every major incident began with a person, not a flaw: a help desk agent talked out of a credential, an employee who surrendered a single sign-on token to a convincing email, a vendor whose inherited access was simply reused. The reporting on the April 2026 broadband provider breach and the Microsoft-tracked phishing campaign that hit 35,000 users across 26 countries tells the same story.

Email authentication--SPF, DKIM, DMARC--verifies who sent a message, not whether its intent is legitimate. As we covered in the 2026 email authentication crisis, a compromised-but-authenticated mailbox sails through every check. That's why the front door stays open.

What This Means for Your Inbox

The IC3 report is a macro confirmation of a micro reality: the message that costs you isn't the obvious scam--it's the well-written one that looks like it belongs. The defenses that work are the ones that evaluate intent and trust, not surface features:

• Detect unsolicited outreach by behavior, not keywords. This is the heuristic, intent-based approach Email Ferret is built on.
• Treat polish as a non-signal. Perfect grammar is now the norm for both real mail and AI-generated fraud, as we showed in 5 Signs an Email Was Written by AI.
• Verify high-risk requests out of band. Payment changes and credential resets should never be approved on the strength of an email alone.
• Reduce inbox surface area. Every unsolicited message routed away is one fewer chance for a human--or, increasingly, an AI assistant--to act on it.