Crypto Investment Fraud: What FBI IC3 Data Shows and How to Spot It

The FBI calls crypto investment fraud the highest source of financial losses to Americans in 2025. The 2025 IC3 report counts 61,559 complaints and $7.228 billion in losses. That figure has grown every year since 2021, when it was $907 million. People aged 60 and over reported the most.

This post covers what the FBI's Internet Crime Complaint Center (IC3) data shows, how these scams work at a high level, and what individuals and businesses can do. It is about fraud and security, not investment advice. The second half is for security, fraud and IT teams.

What do the FBI IC3 reports show about crypto investment fraud?

IC3 is the FBI's public reporting point for internet crime. Each spring it publishes an annual report built from the complaints people file. The 2025 report covers 1,008,597 complaints and $20.877 billion in reported losses across all crime types.

Here is the five-year trend for crypto investment fraud, read from each year's report.

Year	Reported losses	Complaints	How IC3 described it	Source
2021	$907 million	not stated	Cryptocurrency investment fraud	2022 report
2022	$2.57 billion	not stated	Cryptocurrency investment fraud	2022 report
2023	$3.96 billion	not stated	Investment fraud with a reference to cryptocurrency	2023 report
2024	$5.8 billion	41,557	Crypto investment fraud	2024 report
2025	$7.228 billion	61,559	Crypto investment fraud	2025 report

The labels shift slightly between years, so read the table as a trend, not a precise series. The 2025 report says complaints rose 48% and losses rose 25% compared with 2024.

Crypto also shows up well beyond investment scams. IC3 tags any complaint where the information "contains some reference to virtual currency". In 2025 that tag covered 181,565 complaints and $11.366 billion in losses, more than half of all reported losses. The average loss was $62,604, and 18,589 people reported losing more than $100,000.

These are complaints that people chose to file. Many victims never report, so treat the numbers as a floor.

Who loses the most to crypto investment fraud, by age?

Older Americans lose the most. In 2025, people aged 60 and over filed 13,685 crypto investment fraud complaints and reported $2.76 billion in losses. That is about twice the losses of the next group, people in their fifties.

Age group	Complaints (2025)	Losses (2025)
Under 20	629	$12,582,997
20-29	4,627	$117,353,587
30-39	8,576	$412,626,617
40-49	10,750	$924,623,370
50-59	9,856	$1,383,263,248
60+	13,685	$2,763,921,910

Source: 2025 IC3 report. Not every complaint includes an age, so the rows add up to less than the $7.228 billion total.

This has shifted. In its 2022 report, IC3 said the most targeted age group for crypto investment scams was 30 to 49.

How does a crypto investment scam, or "pig butchering", work?

A crypto investment scam is a long con: the criminal builds trust over weeks, shows the victim fake profits, then takes everything. The FBI calls it "pig butchering"; its 2021 report explains that victims' accounts are "fattened up before draining". FinCEN, the US Treasury's financial intelligence unit, also lists the names "romance baiting" and "cryptocurrency confidence schemes" in its September 2026 release.

The 2025 IC3 report describes the usual shape:

First contact comes by text message, social media, an advert or a dating app. It often looks like a wrong number or a friendly stranger.
The chat moves quickly to a messaging app.
An "investment group" of supposed insiders offers guidance on trading crypto or gold.
The victim sends crypto to a fake platform or app that shows growing profits. They may be offered loans to invest more.
Withdrawal fails. The victim is told to pay "taxes and fees" first. Then the scammers disappear.

Who is behind it matters. The FBI says these scams are "largely perpetrated by organized criminal enterprises based in Southeast Asia", using victims of human trafficking as forced labour. FinCEN says the same about labour trafficking in its 2023 alert announcement.

A scam is different from a hack. In a scam the victim authorises every payment. In a hack, as in the Bybit theft, the attacker takes control of the signing process. The defences differ too.

Why are crypto ATMs and kiosks used in scams?

A crypto ATM (or kiosk) turns cash into cryptocurrency and sends it to a wallet address, often scanned from a QR code. For a scammer, that means cash from a victim becomes crypto in the scammer's wallet within minutes.

The IC3 numbers for kiosk use keep rising:

Year	Complaints	Losses	Change in losses	Source
2024	10,956	$246.7 million	+31% on 2023	2024 report
2025	13,460	$389 million	+58% on 2024	2025 report

Age is even more lopsided here. In 2025, people aged 60+ filed 6,188 kiosk complaints and reported $257,466,130 in losses, about two-thirds of the total.

Kiosks are not mainly an investment-scam tool. In 2024, the crime types most linked to kiosk use were tech support scams ($107.4 million), government impersonation ($44.6 million), investment ($38.1 million) and extortion ($5.6 million). FinCEN's August 2025 kiosk notice also names tech support and bank imposter scams, some of which "disproportionately impact older adults".

The FBI's kiosk advisory explains why this is so damaging. A bank transfer can stay pending for a day or two. A crypto payment goes straight to the recipient, who often moves it overseas fast, so it is hard to stop or reverse.

What are crypto recovery scams?

A recovery scam targets someone who has already lost money and offers to get it back, for a fee. In 2025, IC3 recorded 10,516 recovery scam complaints and $1.4 billion in losses. IC3 notes those losses may include money lost in the earlier scam.

The FBI's August 2025 advisory on fake law firms lists the red flags. The scammers use real lawyers' names on fake letterhead and claim to partner with government agencies. They cite regulators that don't exist and ask for payment in crypto or gift cards. Some know the exact dates and amounts of the victim's earlier transfers. The FBI is blunt: "There are no law firms which are officially authorized partners of US Government agencies."

Criminals also pose as IC3 itself, sometimes with AI-generated video of FBI leaders. The July 2026 advisory says "IC3 will never ask for payment to recover lost funds". My explainer on spotting deepfake scams covers the video side.

What are the warning signs of crypto investment fraud?

Every item below comes from the FBI advisories and reports linked above.

A stranger you met by text, on social media or on a dating app starts talking about investing.
You are moved to a messaging app or a private "investment group".
A platform shows big profits but you can't withdraw without paying "taxes" or "fees".
You are offered a loan to invest more.
Someone asks you to take cash to a crypto ATM, or to scan a QR code they sent.
A "government agency", "law firm" or "IC3" contacts you offering to recover lost money.
Anyone asks for payment in crypto or gift cards to fix a problem.

If a kiosk operator warns that your transaction looks like fraud, the FBI says to stop or cancel it. If you have been targeted, report it at ic3.gov, typed directly into your browser. People aged 60 or over can get help filing from the DOJ Elder Justice Hotline at 1-833-FRAUD-11, per the July 2026 advisory.

What should businesses do about crypto investment fraud?

Most of these losses fall on individuals, but businesses carry them too. Your staff are targets, your customers are targets, and if you run a bank, fintech or exchange, your platform is the payment rail.

Brief staff in plain terms. Include family members and older relatives. The FBI's Operation Level Up found 78% of the victims it contacted in 2025 did not know they were being scammed, according to the IC3 2025 report.
Add SMS and messaging apps to your "report a scam" channel. Many of these scams never touch work email.
Protect payroll and retirement changes. Verify any unusual request to cash out or redirect funds by phone, using a number you already hold.
Check who you are dealing with. For EU crypto firms, the MiCA register check applies.
Plan for leaked customer data. Recovery scammers who know a victim's transfer history got that data from somewhere. If it came from you, breach notification deadlines may apply.

More on wallets, exchanges and scams sits on the Crypto Security hub.

Going deeper: for security and IT teams

This section is for fraud, security and IT teams at banks, fintechs, exchanges and employers. I list only what I read at IC3 and FinCEN. I could not open the text of FinCEN's PDF alerts, so I don't quote their red-flag lists or SAR key terms. Get those from the PDFs directly.

Threat model. The attacker is an organised group with staff, scripts and patience, per the FBI's 2025 description. What they need is the victim's trust and a payment rail that settles fast. What they get is funds the victim authorised themselves, so fraud controls built around account takeover often miss it. The victim passes MFA and wants the payment to go through.

The money-laundering view. FinCEN's September 3, 2026 release announced an alert on money laundering linked to digital asset investment scam centers. It tied about $12.7 billion in financial activity to suspected scams, across 33,904 Bank Secrecy Act reports filed between September 8, 2023, and December 31, 2025. FinCEN encourages voluntary information sharing under Section 314(b) of the USA PATRIOT Act. If your institution is eligible and not registered for 314(b), that is the first gap to close, because scam funds hop between institutions.

Kiosk operators and their banks. FinCEN Notice FIN-2025-NTC1 (August 4, 2025) asks institutions to identify and report suspicious activity involving kiosks, naming tech support and bank imposter scams. If you bank a kiosk operator, ask how it detects first-time, high-value cash purchases by older customers, and whether it pauses transactions that look like scams. The FBI's 2021 advisory also says kiosks advertising anonymity, or asking only for a phone number or email, may not comply with US federal rules.

Speed decides recovery. IC3's Recovery Asset Team runs the Financial Fraud Kill Chain (FFKC), which asks banks to freeze fraudulent transfers. In 2024 it acted on 3,020 complaints involving $848.4 million, freezing $469.1 million domestically and $92.5 million internationally, a 66% success rate, per the 2024 report. Most FFKC cases are business email compromise wires. Once funds become crypto in a scammer's wallet, the kill chain has much less to hold. Your intervention window is before the bank wire or cash purchase, not after.

In practice: early warning works. Operation Level Up uses IC3 data to find victims who are still paying. In 2025 it notified 3,780 victims, with estimated savings of $225,871,319. The 2025 report lists stopped losses, including a victim about to cash out $750,000 from a 401(k) and another about to sell a house to invest $500,000. Since January 2024 the operation has notified more than 8,000 victims. The lesson for banks and employers: a call from a trusted person, at the moment of the large transfer, can stop the loss.

Blocking infrastructure. The 2025 report lists an FBI advisory on infrastructure used to manage domains for crypto investment fraud between October 2023 and April 2025, linked to Funnull Technology Inc., with an attributed domain list. Feed lists like that into DNS filtering and secure web gateway blocks, and record the source and date of each import.

Evidence to preserve. When a customer or employee reports a scam, capture wallet addresses, transaction IDs, platform URLs, app names, chat exports and the timeline. IC3 says transaction details in complaints help the FFKC process when filed quickly.

What to ask:

Do our fraud rules flag first-time transfers to crypto platforms after a large retirement or savings withdrawal?
Are we registered for 314(b), and do we use it on scam cases?
Who calls the customer, and how fast, when a scam pattern fires?
Does our crypto platform or kiosk partner warn and pause on likely scam payments?

Key takeaways

Crypto investment fraud cost Americans $7.228 billion across 61,559 IC3 complaints in 2025, up from $907 million in 2021.
Crypto-related complaints of all kinds reached $11.366 billion, more than half of all losses reported to IC3.
People aged 60+ reported the largest losses, both for investment scams and crypto ATM scams.
Crypto ATM scam losses reached $389 million in 2025, up 58% on 2024.
Anyone offering to recover lost crypto for a fee is a red flag. IC3 never charges for it.
For banks and employers, the best control is an interruption before the money moves.

Display and accessibility