Losses due to scams globally reach nearly half a billion US dollars in 2025.

By account type, credit cards accounted for 41% of all attempted misuse, checking accounts account for 17.7%, and personal loans account for 8.5%.

9% of victims with any financial impact were able to resolve their cases.

Attempted misuse cases caught by financial institutions increase by 26.8%.

FAMOUS CHOLLIMA doubled its operations using AI-generated identities to infiltrate cryptocurrency exchanges, fintech platforms, and consumer banks.

Financial fraud was the most common incident type for the third consecutive year, accounting for 30% of all claims.

The single largest fraud loss in 2025 hit $9.7M.

The average amount stolen reached $285K, up 16% from the prior year and up significantly from $199K in 2023.

Routine invoice inquiries have a compromise rate of less than 1%.

81% of fraud prevention, risk, and compliance professionals report an increase in mule-related activity over the past year.

Billing account update requests have a 26.5% compromise rate.

Over 50% of fraud prevention, risk, and compliance professionals say account handover fraud, where control of a verified account shifts to someone else without authorization, is more difficult to detect than other types of fraud.

TsarBot, CopyBara, and Hook collectively targeted more than 60% of global banking and fintech apps.

The United States had the highest concentration of targeted apps globally, with 162 banking applications under active targeting, up from 109 in 2023.

Android malware-driven financial transactions increase 67% year-over-year.

Thirty-four active malware families targeted 1,243 financial apps across 90 countries.

65% of internal audit leaders identify fabricated invoices or financial documents as a leading AI-enabled fraud threat.

38% of consumers worry most about financial fraud.

AI fraud surged 1210% in 2025.

Fifty percent of affected consumers cite immediate financial fraud as their primary fear, and 54 percent of consumers report an increase in targeted phishing attempts after a breach (2025)