In 2020, while the American public was focused on protecting our families from a global pandemic and helping others in need, cyber criminals took advantage

656 KB – 30 Pages

PAGE – 2 ============
2 20 20 Internet Crime Report TABLE OF CONTENTS Introduction .. .. .. .. . 3 About the Internet Crime Complaint .. . 4 IC3 History .. .. .. .. .. 5 The IC3 Role in Combating Cyber Crime .. .. 7 IC3 Core Functions .. .. .. . 8 Hot Topics for 2020 .. .. .. .. . 9 Business Email Compromise (BEC) .. .. .. . 10 IC 3 R ecovery A sset Team (RAT) .. .. .. 11 RAT Successes .. .. .. .. . 12 Tech Support Fraud .. .. .. 13 Ransomware .. .. .. .. 14 2020 Victims by Age Group .. .. .. . 16 2020 – T op 20 Int ernational Victim C ountries .. .. .. 17 2020 – Top 10 States by Number of Victims .. .. .. 18 2020 – Top 10 States by Victim Loss .. .. .. 18 2020 Crime Types .. .. .. .. .. 19 Last 3 Year Comp laint Count Comparison .. .. . 21 2020 Overall State Statistics .. .. .. .. 23 Appendix A: Definitions .. .. .. . 27 Appendix B: Additional information about IC3 Data .. .. . 30

PAGE – 3 ============
3 INTRODU CTION Dear Reader, In 2020, while the American public was focused on protecting our families from a global pandemic and helping others in need , cyber c riminals took advantage of an opportunity to profit from our dependence on technology to go on an Internet crime spree . These criminals used phishing , spoofing, extortion, and various types of Internet – enabled fraud to target the most vulnerable in our society – medical workers searching for p ersonal p rotective e quipment , f amilies looking for information about stim ulus checks to help pay bills , and many others . Crimes of this type are just a small part of what the FBI combats through our c riminal a nd cyber investigative work . Key to our cyber mission is the Internet Crime Complaint Center (IC3) , which provide s the public with a trustworthy source for information on cyber criminal activity , and a way for the public to report directly to us when they suspect they are a victim of cyber crime . IC3 received a record number of complaints from the American public in 2020 : 791,790 , with reported losses exceeding $4.1 billion. This represents a 69% increase in total complaints from 2019. Business E – mail Co mpromise (BEC) schemes continued to be the costliest : 19,3 69 complaints with an adjusted loss of approximately $1. 8 billion. Phishing scams were also prominent: 241,342 complaints, with adjusted loss es of over $54 million . The number of ransomware incident s also continues to rise, with 2,474 incidents reported in 2020 . Public reporting is central to the mission and success of IC3. S ubmitting a cyber crime complaint to IC3.gov not only helps the FBI address specific complaints and provide support and assist ance to victims but also helps us prevent additional cri mes by finding and holding criminal actors accountable. Information repo rted to the IC3 helps the FBI be tter understand the motives of cyber – criminal s , the ev olving threat posed, and tactics utilized , enabling us to most effectively work with partners to mitigate the damage to victims . IC3 has continued to strengthen its relationships with industry and others in the law enforcement community to reduce financi al losses resulting from BEC scams. Thro ugh the Recovery Asset Team, IC3 worked with its partners to successfully freeze approximately $380 million of the $462 million in reported losses in 2020, representing a success rate of nearly 82%. In addition, IC3 has a Recovery and I nvestigative Develo pment Team which assists financial and law enforcement investigators in dism antling organizations that move and transfer funds obtained illicitly . With our dedicated resources focused on recovering fun ds and preventing further victimization, we are bette r aligned to confront the unique challenges faced in cyberspace. Visit IC3.gov to access the latest information on criminal Internet activity . W e strongly encourage readers to submit complaints to IC3 and to reach out to their local FBI field office to re port malicious cyber criminal activity. Together we will continue to build safety, security, and confidence in to our digitally connected world . Paul Abbate Deputy Director Federal Bureau of Investigation

PAGE – 4 ============
4 ABOUT THE INTERNET CRIME COMPLAINT CENTE R Th e mission of the FBI is to protect the American people and uphold the Constitution of the United States. The mission of the IC3 is to provide the public with a reliable and convenient reporting mechanism to submit information to the FBI concerning suspecte d Internet – facilitated criminal activity, and to develop effective alliances with industry partners. Informa tion is analyzed and disseminated for investigative and intelligence purposes for law enforcement, and for public awareness. T o promote public awa reness, the IC3 produces this annual report to aggregate and highlight the data provided by the general publ ic. The quality of the data is directly attributable to the information ingested via the public interface , www.ic3.gov . The IC3 attempts to standard ize the data by categorizing each complaint based on the information provided. The IC3 staff analyzes the da ta to identify trends in Internet – facilitated crimes and what those trends may represent in the coming year. As a response to the increasing preval ence of fraud against the elderly, the Department of Justice and the FBI partnered to create the Elder Justi ce Initiative. Elder Fraud is defined as a financial fraud scheme which targets or disproportionately affects people over the age of 60. The FBI, in cluding IC3, has worked tirelessly to educate this population on how to take steps to protect themselves fro m being victimized. In 2020, the IC3 received 105,301 complaints from victims over the age of 60 with total losses in excess of $ 966 million. Since, a ge is not a required reporting field , t hese statistics only reflect complaints in targeted by perpetrators because they are believed to have significant fi nancial resources. Victims over the age of 60 may encounter scams in cluding Advance Fee Schemes, Investment Fraud Schemes, Romance Scams, Tech Support Scams, Grandparent Scams, Government Impersonation Scams, Sweepstakes/Charity/Lottery Scams, Home Repair Scams, TV/Radio Scams, and Family/Caregiver Scams. If the perpetrato rs are successful after initial contact, they will often continue to victimize these individuals. Further information about the Elder Justice Initiative is available at https://www.justice.gov/elderjusti ce . As a result of the significant increases and impact of scams targeting the elderly, IC3 is planning to release its first annual report focusing entirely on Elder Fraud in 2021.

PAGE – 5 ============
5 IC3 History In May 2000, the IC3 was established as a center to receiv e complaints of Internet crime. A total of 5,679,259 complaints have been reported t o the IC3 since its inception. Over the last five years, the IC3 has received an average of 440 ,000 complaints per year. The se complaints address a wide array of Inte rnet scams affecting victims across the globe. 1 1 Acces sibility description: Image includes yearly and aggregate data for complaints and losses over the years 2016 to 2020. Over that time, IC3 received a total of 2,211,396 complaints, reporting a loss of $13.3 billion. IC3 Complaint Statistics Last Five Years (Rounded to the nearest million)

PAGE – 6 ============
6 2 2 Accessibility description: Ima ge inc ludes a victim loss comparison for the top five reported crime types of 2020 for the years of 2016 to 2020. IC3 Complaint Statistics 2020 – Top 5 Crime Type Comparison Last Five Years 241,342 108,869 76,741 45,330 43,330 114,702 61,832 43,101 38,218 16,053 26,379 65,116 51,146 50,642 16,128 25,344 84,079 14,938 30,904 17,636 19,465 81,029 17,146 27,573 16,878 PHISHING/VISHING/ SMISHING/PHARMING NON – PAYMENT/NON – DELIVERY EXTORTION PERSONAL DATA BREACH IDENTITY THEFT 2020 2019 2018 2017 2016

PAGE – 8 ============
8 IC3 Core Functions IC3 Core Functions 4 4 Accessibility description: Image contains icons with the core functions. Core functions – Collection, Analysis, Public Awareness, and Referrals – are listed in individual blocks as components of an ongoing process. COLLECTION ANALYSIS PUBLIC AWAR E NESS REFERRALS The IC3 is the central point for Internet crime victims to report and alert the appropriate agencies to su spected criminal Internet activity. Victims are encouraged and often directed by law enforcement to file a complaint online at www.ic3.gov . Complainants are asked to document accurate and complete information related to Internet crime, as well as any other relevant information necessary to support the complaint. The IC3 reviews and analyzes dat a submitted through its website to identify emergi ng threats and new trend s. Public service announcements , industry alerts, and other publications outlining specific scams are posted to the www.ic3.gov website . As more people become aware of Internet crimes and the methods used to carry them out , potentia l victims are equipped with a broader understanding of the dangers associated with Internet activity and are in a be tter position to avoid falling prey to schemes online. T he IC3 aggregates related complaints to build referrals , which are forwarded to loc al, state, federal , and international law enforcement agencies for potential investigation. If law enforcement condu cts an investigation and determines a crime has been committed, legal action may be brought against the perpetrator.

PAGE – 9 ============
9 HOT TOPICS FOR 20 20 COVID – 19 The year 2020 will forever be remembered as the year of the COVI D – 19 pandemic. The global impact was unlike anything seen in recent history, and the virus permeated all aspects of life. Fraudsters took the opportunity to exploit the pandemic to target both business and individuals. In 2020 , the IC3 received over 28,500 complaints rel ated to COVID – 19 . Fraudsters targeted t he Coronavirus Aid, Relief, and Economic Security Act (CARES Act), which included provisions to help small businesses during t he pandemic . The IC3 received thousands of complaints reporting emerging fin ancial crime r evolving around CARES Act stimulus funds, specifically targeting unemployment insurance, Paycheck Protection Program (PPP) loans, and Small Business Economic Injury Disaster Loans , as well as other COVID – related fraud. Most of the IC3 compla ints related t o CARES Act fraud involved grant fraud, loan fraud, and phishing for Personally Identifiable Information ( PII ) . Complaints have been filed from citizens in several states describing fraud ulently submitted online unemployment insurance claims using their id entities. Many victims of this identity theft scheme did not know they had been targeted until they attempted to file their own legitimate claim for unemployment insurance benefits. At that time, they received a notification from the state unemployment ins urance agency, received an IRS Form 1099 – G showing the benefits collected from unemployment insurance, or were notified by their employer that a claim had been filed while the victim is still employed. People are encouraged to pr otect themselves from scamm ers by: Using extreme caution in online communication. Verify the sender of an email . C riminals will sometimes change just one letter in an email address to make it look like one you know. Also, be very wary of attachments or links . H over your mouse over a link before clicking to see where it i s sending you. Questioning anyone offering you something that i advice. Relying on trusted sources , like your own doctor, the Center for Diseas e Control , and your local health departme nt for medical information and agencies like the Federal Trade Commission and Inter nal Revenue Service for financial and tax information . One of the most prevalent schemes seen during the pandemic has been governmen t impersonators. Criminals are reaching out to people through social media, emails, or phone calls pretending to be from the government. The scammers attempt to gather personal i nformation or illicit money through charades or threats. As the response to C OVID – 19 turned to vaccinations, scams emerged asking people to pay out of pocket to receive the vaccine, put their name s on a vaccine waiting, or obtain early access . Fraudulent a dvertisements for vaccines popped up on social media platforms, or came via e mail , telephone calls, online, or from unsolicited/unknown sources. As we continue to battle COVID – 19, protect yourself from fraud and scams. Do not give out your personal informa tion to unknown sources . I f you are a victim of a n online crime involving COV ID – 19, report it. very opportunistic. They see a vulnerable population out there Section Chief Steven Merrill, Financial Crimes Section.

PAGE – 10 ============
10 Business Email Compromise (BEC) In 2020, the IC3 received 19,3 6 9 Business Email Compromise (BEC) / Email Account Compromise (EAC) complaints with adjusted losses of over $1.8 billion. BEC/EAC is a sophisticated scam targeting both busine sses and individuals performing transfer s of funds. The scam is frequently carried out when a subject compromises legitimate business email accounts through social e ngineering or computer intrusion techniques to conduct unauthorized transfers of funds. As the fraudsters have become more sophisticated, the BEC/EAC scheme has evolved in kind. In 2013, BEC/EAC scams routinely began with the hacking or spoofing of the email accounts of chief executive officers or chief financial officers, and fraudulent emai ls were sent requesting wire payments be sent to fraudulent locations. Over the years, the scam evolved to include compromise of personal emails, compromise of v endor emails, spoofed lawyer email accounts, requests for W – 2 information, the targeting of the real estate sector, and fraudulent requests for large amounts of gift cards. In 2020, the IC3 observed an increase in the number of BEC/EAC complaints related to the use of identity theft and funds being converted to cryptocurrency. In these variations, we saw an initial victim being scammed in non – BEC/EAC situations to include Extortion, Tech Support, Romance scams , etc., that involved a victim providing a for m of ID to a bad actor. That identifying information was then used to establish a bank account to receive stolen BEC/EAC funds and then transferred to a cryptocurrency account.

PAGE – 11 ============
11 IC3 RECOVERY ASSET TEAM in February 2018 to streamline communication with financial inst itutions and assist FBI field offices with the freezing of funds for victims who made transfers to domestic acco unts under fraudulent pretenses. RAT Process 5 The RAT functions as a liaison between law enforcement a nd financial institutions supporting sta tistical and investigative analysis. Goals of RAT – Financial Institution Partnership Assist in the identification of potentially fraudulent accounts across the sector. Remain at the forefront of emerging trends among financial fraud schemes. Foster a sym biotic relationship in which information is appropriately shared. Guidance for BEC Victims Contact the originating f inancial i nstitution as soon as fraud is recognized to request a recall or reversal and a Hold Harmless Letter or Letter of Indemnity. F ile a detailed complaint with www.ic3.gov. It is vital the complaint contain all required data in provided fields, including banking information. Visit www.ic3.gov for updated PSAs regarding BEC trends as well as other fraud schemes targeting specific popu lations , like trends targeting real estate, pre – paid cards, and W – 2 s , for example. Never make any payment changes without verifying the change with the intended recipient ; V erify email addresses are accurate when checking e mail on a cell phone or other mob ile device. 5 Accessibility description: Image shows the different stages of a complaint in the RAT process. * If criteria is met, transaction details are forwarded to the identified point of contact at the recipient bank to notify of fraudulent activity and request freezing of the account. Once response is received from the recipient bank, RAT contacts the appropriate FBI field office(s). Success in 2020 Incidents : 1,303 Losses: $462,967,963.72 Frozen : $380,211,432.04 Success Rate: 82% * IC3 Analyst FBI Fie ld Office Victim Financial Institution IC3 Database

656 KB – 30 Pages