What official figures do and do not tell you about identity theft losses

Articles about the cost of identity theft almost always open with a number: the average victim loses this much, small businesses lose that much, the total is some enormous figure. Very few of them say where the number came from. This one does the opposite — it starts from the figures that are actually published, explains what they count, and is explicit about what nobody can tell you.

The number you have probably been quoted

There is a genre of statistic that circulates without a source: the average cost of identity theft to a victim, or the annual cost to small businesses in a particular region. These figures get repeated between articles until they acquire the authority of common knowledge.

If you cannot trace one to a named report with a year attached, treat it as unusable. That includes figures in this article’s own subject area, which is why the box above names its source and its year rather than offering a tidy average.

What the IC3 figures actually are

The FBI’s Internet Crime Complaint Center publishes an annual report built from complaints filed with it. In the 2025 report there were 1,008,597 complaints and $20.877 billion in reported losses.

Broken down by crime type, phishing and spoofing led by volume with 191,561 complaints and $215,843,126 in losses. Personal data breach was fourth by volume with 67,456 complaints. Ransomware, which occupies a disproportionate share of the coverage, drew 3,611 complaints and $32,320,105.

The most striking figures in the report concern age. Complainants aged 60 and over filed 201,266 complaints, a 37% increase on 2024, and reported $7.748 billion in losses, up 59%. That works out at an average of $38,500 per complainant in that group, and 12,444 of them lost more than $100,000.

What these numbers are not

They are complaint data, not a survey of the population. They count what was reported to one agency, in dollars the complainant stated. Anything unreported is absent, and there is no way to know from the report itself how much that is.

They are also not a per-victim average for the general public. The $38,500 figure above is specific: it is the average reported loss among complainants aged 60 and over in that year’s data. Lifting it out of that context and presenting it as “the average identity theft costs $38,500” would be wrong, and that kind of transplant is how most unsourced averages are born.

And they do not measure time. A recovery that takes a person forty hours of phone calls and produces no dollar loss appears in these tables as nothing at all.

One last caution, about direction. A rise in complaints can mean more crime, better reporting, or both, and the report does not separate them. That is not a reason to ignore the figures. It is a reason to quote them as what they are — counts of complaints filed in one year, and the dollar losses those complainants stated — rather than converting them into a national total or a per-person average.

What a small business owner should take from it

Two things, neither of which requires a cost estimate.

First, the volume ordering. Phishing dwarfs ransomware in complaint counts, and personal data breach is close behind it. Effort spent on message-handling habits and on account security addresses the common case.

Second, the age skew. If your business serves older customers, or if you have older relatives whose finances you help manage, the sharpest single-year increase in the report is in that group. The free protections — a credit freeze at each bureau, weekly credit reports, the prescreen opt-out — are worth walking through with them in person.

What to do rather than estimate

• Place a free credit freeze at Equifax, Experian and TransUnion. It lasts until you lift it and does not affect your credit score.
• Check credit reports at AnnualCreditReport.com — free weekly from each bureau, permanently extended.
• Opt out of prescreened credit and insurance offers at optoutprescreen.com or 1-888-5-OPT-OUT.
• Report identity theft at IdentityTheft.gov or 877-438-4338, fraud at ReportFraud.ftc.gov, and internet crime at IC3.gov.
• File the report even when the loss is small. The figures above are only as complete as the complaints behind them.

Sources: FBI IC3 — 2025 Internet Crime Report · FTC — What to know about identity theft · FTC — What to know about credit freezes and fraud alerts · FTC — Free credit reports · FTC — What to know about prescreened offers of credit and insurance

Reviewed 27 August 2026 by the CyberArtical editorial team against primary guidance from the FBI and the FTC. Security guidance changes over time; where our earlier version of this page said something different, we say so in the article rather than editing it out quietly.