By account type, credit cards accounted for 41% of all attempted misuse, checking accounts account for 17.7%, and personal loans account for 8.5%.

9% of victims with any financial impact were able to resolve their cases.

Attempted misuse cases caught by financial institutions increase by 26.8%.

Losses due to scams globally reach nearly half a billion US dollars in 2025.

FAMOUS CHOLLIMA doubled its operations using AI-generated identities to infiltrate cryptocurrency exchanges, fintech platforms, and consumer banks.

81% of fraud prevention, risk, and compliance professionals report an increase in mule-related activity over the past year.

Billing account update requests have a 26.5% compromise rate.

Routine invoice inquiries have a compromise rate of less than 1%.

Financial fraud was the most common incident type for the third consecutive year, accounting for 30% of all claims.

The average amount stolen reached $285K, up 16% from the prior year and up significantly from $199K in 2023.

The single largest fraud loss in 2025 hit $9.7M.

Over 50% of fraud prevention, risk, and compliance professionals say account handover fraud, where control of a verified account shifts to someone else without authorization, is more difficult to detect than other types of fraud.

Android malware-driven financial transactions increase 67% year-over-year.

Thirty-four active malware families targeted 1,243 financial apps across 90 countries.

The United States had the highest concentration of targeted apps globally, with 162 banking applications under active targeting, up from 109 in 2023.

TsarBot, CopyBara, and Hook collectively targeted more than 60% of global banking and fintech apps.

65% of internal audit leaders identify fabricated invoices or financial documents as a leading AI-enabled fraud threat.

38% of consumers worry most about financial fraud.

AI fraud surged 1210% in 2025.

Fifty percent of affected consumers cite immediate financial fraud as their primary fear, and 54 percent of consumers report an increase in targeted phishing attempts after a breach (2025)