FBI：2021年網(wǎng)絡(luò)犯罪報(bào)告

INTERNETCRIMEREPORT12FEDERALBUREAUOFINVESTIGATIONContentsUCTION THEIC3 4HEICROLEINCOMBATINGCYBERCRIME COREFUNCTIONS IC3COMPLAINTSTATISTICS 7LastYears 7Top5CrimeTypeComparison 8THREATOVERVIEWSFOR2021 9ailCompromiseBEC IC3RECOVERYASSETTEAM 10RATSUCCESSES 11RomanceScams Cryptocurrency(VirtualCurrency) 13re TechSupportFraud 17ytheNumbers ictimsbyAgeGroup TopInternationalVictimCountries 0tesbyNumberofVictims Millions 2021CRIMETYPES 22CrimeTypescontinued rison continued continued continued finitions nalInformationaboutICData EPORTINTRODUCTIONIn2021,Americaexperiencedanunprecedentedincreaseincyberattacksandmaliciouscyberactivity.ThesecyberattackscompromisedbusinessesinanextensivearrayofbusinesssectorsaswellastheAmericanpublic.Asthecyberthreatevolvesandbecomesincreasinglyintertwinedwithtraditionalforeignintelligencethreatsandemergingtechnologies,theFBIcontinuestoleverageouruniqueauthoritiesandpartnershipstoimposerisksandconsequencesonournation’scyberadversaries.TheFBI’sInternetCrimeComplaintCenter(IC3)providestheAmericanpublicwithadirectoutlettoreportcybercrimestotheFBI.Weanalyzeandinvestigatethereportingtotrackthetrendsandthreatsfromcybercriminalsandthensharethisdatawithourintelligenceandlawenforcementpartners.TheFBI,alongsideourpartners,recognizeshowcrucialinformationsharingofcyberactivitiesistoprepareourpartnerstocombatthecyberthreat,throughawhole-of-governmentapproach.CriticaltothatapproachispublicreportingtoIC3-enablingustofillinthemissingpieceswiththisvaluableinformationduringtheinvestigatoryprocess.Notonlydoesthisreportinghelptopreventadditionalcrimes,itallowsustodevelopkeyinsightsontheever-evolvingtrendsandthreatswefacefrommaligncyberactors.In2021,IC3continuedtoreceivearecordnumberofcomplaintsfromtheAmericanpublic:847,376reportedcomplaints,whichwasa7%increasefrom2020,withpotentiallossesexceeding$6.9billion.Amongthe2021complaintsreceived,ransomware,businesse-mailcompromise(BEC)schemes,andthecriminaluseofcryptocurrencyareamongthetopincidentsreported.In2021,BECschemesresultedin19,954complaintswithanadjustedlossofnearly$2.4billion.IC3’scommitmenttocybervictimsandpartnershipsallowforthecontinuedsuccessthroughprogramssuchastheIC3’sRecoveryAssetTeam(RAT).Establishedin2018,RATstreamlinescommunicationswithfinancialinstitutionsandFBIfieldofficestoassistfreezingoffundsforvictims.In2021,theIC3’sRATinitiatedtheFinancialFraudKillChain(FFKC)on1,726BECcomplaintsinvolvingdomestictodomestictransactionswithpotentiallossesof$443,448,237.Amonetaryholdwasplacedonapproximately$329million,whichrepresentsa74%successrate.In2021,heightenedattentionwasbroughttotheurgentneedformorecyberincidentreportingtothefederalgovernment.Cyberincidentsareinfactcrimesdeservingofaninvestigation,leadingtojudicialrepercussionsfortheperpetratorswhocommitthem.ThankyoutoallthosereaderswhoreportedcrimestoIC3throughouttheyear.Withoutthisreporting,wecouldnotbeaseffectiveinensuringconsequencesareimposedonthoseperpetratingtheseattacksandourunderstandingofthesethreatswouldnotbeasrobust.PleasevisitIC3.govtoaccessthelatestinformationoncriminalinternetactivity.TheFBI’sCyberDivisionisworkingharderthanevertoprotecttheAmericanpublicandtoinstillsafety,security,andconfidenceinadigitallyconnectedworld.WeencourageeveryonetouseIC3andreachouttotheirlocalFBIfieldofficetoreportmaliciousactivity.Togetherwecancontinuetocreateasaferandmoresecurecyberlandscape.ion4FEDERALBUREAUOFINVESTIGATIONTHEIC3espionage,cyberattacksandmajorcriminalthreats,andonsupportingourmanypartnerswithinformation,services,support,training,andleadership.TheIC3servesthoseneedsasamechanismtohethreatthan6.5millioncomplaintssinceitsinception.ItsmissionistoprovidethepublicwithareliableandconvenientreportingmechanismtosubmitinformationtotheFBIconcerningsuspectedcyberenabledcriminalactivity,andtodevelopeffectiveallianceswithlawenforcementandindustrypartnerstohelpwarenessTopromotepublicawareness,theIC3aggregatesthesubmitteddataandproducesanannualreporttoteonthetrendsimpactingthepublicThequalityofthedataisdirectlyattributabletotheinformationingestedviathepublicinterfacewwwicgovandthedatacategorizedbasedonthengyearEPORTeFederaleFederalandInternationalAgenciesreVictimsReportAidtheFreezingofAssetsiatheFBIsLEEPwebsiteTHEIC3ROLEedoINCOMBATINGCYBERCRIME1teSectorandwithLocalInternetInternetCrimeatralHubtoAlertthePublicComplaintReferralsandccessDatabaseforallLaw1Accessibilitydescription:ImagelistsIC3’sprimaryfunctionsincludingpartneringwithprivatesectorandwithlocal,state,federal,andinternationalagencies:hostingavictimreportingportalatwww.;providingacentralhubtoalertthepublictothreats;PerformAnalysis,ComplaintReferrals,andAssetRecovery;andhostingaremoteaccessdatabaseforalllawenforcementviatheFBI’sLEEPwebsite.6FEDERALBUREAUOFINVESTIGATIONIC3COREFUNCTIONS2COLLECTIONANALYSISAWARENESSalthecomplaintfvictimfundswebsite.schemesonline.teswtrator2Accessibilitydescription:Imagecontainsiconswiththecorefunctions.Corefunctions-Collection,Analysis,PublicAwareness,andReferrals-arelistedinindividualblocksascomponentsofanongoingprocess.EPORTLASTYEARS0ion36160ion36162.76MillionTotalComplaintsionionTotalLossesionionionComplaintsLosses3Accessibilitydescription:Chartincludesyearlyandaggregatedataforcomplaintsandlossesovertheyears2017to2021.Overthattime,IC3receivedatotalof2,760,044complaints,reportingalossof$18.7billion.8FEDERALBUREAUOFINVESTIGATIONTOP5CRIMETYPECOMPARSON4013030013030Pharming4Accessibilitydescription:Chartincludesavictimlosscomparisonforthetopfivereportedcrimetypesfortheyearsof2017to2021.EPORTBUSINESSEMAILCOMPROMISE(BEC)mpromiseBECEmailAccountormingtransfersoformingtransfersofemailaccountsthroughsocialengineeringorcomputerintrusiontechniquestoconductAsfraudstershavebecomemoresophisticatedandpreventativemeasureshavebeenputinplace,theompromisedvendoremailsrequestsforWinformationtargetingdspoofbusinessleaderscredentialstoinitiatethefraudulentultestrictionsoninpersonmeetingsledtoincreasesinteleworkorvirtualdcommunicationpracticescontinuedintoandtheIChasmpromisinganemployerorfinancialdirectorsemail,suchasaCEOorCFO,whichwouldthenbeusedtorequestemployeestoparticipateinvirtualnthosemeetingsthefraudsterwouldinsertastillpictureoftheCEOwithnoaudioora“deepfake”audiothroughwhichfraudsters,actingasbusinessexecutives,wouldthenclaimtheiraudio/videowasnotworkingproperly.Thefraudsterswouldthenusethevirtualmeetingplatformstoivescompromisedemailtoprovidestructions10FEDERALBUREAUOFINVESTIGATION5Accessibilitydescription:ImageshowsthedifferentstagesofacomplaintintheRATprocess.TheInternetCrimeComplaintCenter’sRecoveryAssetTeam(RAT)wasestablishedinFebruary2018tonwithfinancialinstitutionsandassistFBIfieldofficeswiththefreezingoffundsRATProcess5*Ifcriteriaismet,transactiondetailsareforwardedtotheidentifiedpointofcontactattherecipientbanktonotifyoffraudulentactivityandrequestfreezingoftheaccount.OnceresponseisreceivedheappropriateFBIfieldofficeslentaccountsacrossthesectorsamongfinancialfraudschemesopriatelysharedestarecalloringleEREPORTRemainingLossesFrozenFunds$115.12$328.32TheIC3RAThasproventobeavaluableresourceforfieldofficesandvictims.ThefollowingarethreeInDecember2021,theIC3receivedacomplaintfiledbyavictimroadwaycommissionregardingawiretherecipientfinancialinstitutionofthefraudulentaccountbyinitiatingthefinancialfraudkillchain.CollaborationbetweentheIC3RAT,therecipientfinancialinstitution,andthePhiladelphiaFieldofficeresultedinlearningthesubjectquicklydepletedthewiredfundsfromtheoriginalaccountintotwoseparateaccountsheldatthesameinstitution.ThefinancialinstitutionwasabletoquicklyidentifytheoverypossibleInJune2021,theIC3receivedacomplaintfiledbyavictimlawofficeregardingawiretransferofmoretherecipientfinancialinstitutionresultedinlearningthedomesticaccountwasacorrespondentaccountforafraudulentaccountinNigeria.IC3RATimmediatelyinitiatedtheinternationalFFKCtoFinCENandLEGATAbuja,whichresultedinfreezingthefullwiredamount.ThevictimforwardedanoteofgratitudeotheircasechsupportscamwhereanrofkwassentfromtheiraccounttoaUSdomesticcustodialaccountheldcollaboratedwiththeCEthatheldtheaccount.WiththeknowledgethatfundssenttocryptocurrencyofinitiatingthefinancialfraudkillchainwiththeCEresultedinthefreezingofthefundsinthecustodialthedomesticfinancialinstitutionandtheAlbanyFieldOfficeconfirmedthefundswerefrozeninthele 6Accessibilitydescription:ImageshowsSuccesstoDatetoinclude74%SuccessRate;1,726Incidents;$433.48MillioninLosses;and$328.32.MillionFrozen.12FEDERALBUREAUOFINVESTIGATIONRomancescamsRomancescamsoccurwhenacriminaladoptsafakeonlineidentitytogainavictim’saffectionaromanticorcloserelationshiptomanipulateand/orstealfromthevictim.ThecriminalswhocarryoutRomancescamsareexpertsatwhattheydoandwillseemgenuine,caring,andtothevictim,gaintrust,andeventuallyaskformoney.Scammersmayproposemarriageandmakeplanstomeetinperson,butthatwillneverhappen.Scamartistsoftensaytheyareinthemilitary,oratrades-basedindustryengagedinprojectsoutsidetheU.S.Thatmakesiteasiertoavoidmeetinginperson—andmoreplausiblewhentheyrequestmoneybesentoverseasforamedicalemergencyorunexpectedlegalfee.GrandparentScamsalsofallintothisConartistsarepresentonmostdatingandsocialmediasites.In2021,theIC3receivedthousandsofCONFIDENCEFRAUD/ROMANCESCAMS7ConfidenceFraud/Romancescamsencompassthosedesignedtopullonaswhoexperiencedmorethan$956millioninlossestoConfidenceedbyvictimscamportedAgeGroup15%15%16%%32%Under2020-2930-3940-4950-59Over60demandsarenotmetIntheICreceivedmorethansextortion-relatedcomplaints,withlossesover$13.6million.PleaseseetheSeptember2021IC3PSAonSextortionformoreover$429million,fromConfidenceFraud/Romancescamvictimswhoalsoreportedtheuseofinvestmentsandcryptocurrencies,or“pigbutchering”–sonamedbecausevictims’investmentaccountsarefattenedupbeforedraining,muchalikeapigbeforeslaughter.AdditionalononpigbutcheringcanbefoundintheSeptemberICPSAIPSA7Accessibilitydescription:ChartshowsConfidenceFraud/RomanceScamVictimbyReportedAgeGroup.Under202%;20-2910%;30-3915%;40-4915%;50-5916%;Over6032%8FBIWarnsaboutanIncreaseinSextortionComplaints./Media/Y2021/PSA2109029ScammersDefraudVictimsofMillionsofDollarsinNewTrendinRomanceScams.EREPORTCRYPTOCURRENCY(VIRTUALCURRENCY)In2021,theIC3received34,202complaintsinvolvingtheuseofsometypeofinICorethanbillionInitiallyworthonlyfractionsofpenniesonthedollar,severalcryptocurrencieshaveseentheirvalueselimitedtohackersransomwaregroupsandotherdenizensofthe“darkweb,”cryptocurrencyisbecomingthepreferredpaymentmethodforalltypesofescamsevensomeauctionfraudItisextremelypervasiveininvestmentscams,wherelossescanreachintothehundredsofthousandsof?CryptocurrencyATMs:AutomatedTellerMachines(ATMs)usedtopurchasecryptocurrencyarepoppingupeverywhere.Regulationsonthemachinesarelaxandpurchasesarealmostinstantaneousandirreversible,makingthispaymentmethodlucrativetocriminals.In2021,theIC3receivedmorethan1,500reportsofscamsusingcryptoATMs,withlossesofapproximately$28million.ThemostcommonscamsreportedwereConfidenceFraud/Romance,Investment,Employment,andGovernmentImpersonation.ReadmoreaboutcryptoATMscamsinIC3PSAI-withtheircryptowalletandareconvincedtoeithergiveaccesstotheircryptowalletortransfersearchingonlineforsupportwiththeircryptocurrencies.Ownerscontactfakesupportnumbersaccountsover$429million,fromConfidenceFraud/Romancescamvictimswhoalsoreportedtheuseofinvestmentsandcryptocurrencies,or“pigbutchering.”Thescammer'sinitialcontactistypicallythevictim,andthenclaimstohaveknowledgeofcryptocurrencyinvestmentortrading/Media/Y2021/PSA21091610TheFBIWarnsofFraudulentSchemesLeveragingCryptocurrencyATMsandQRCodestoFacilitatePayment/Media/Y2021/PSA21110414FEDERALBUREAUOFINVESTIGATIONceivedcomplaintsidentifiedasransomwarewithadjustedlossessatypeofmalicioussoftwareormalwarethatltheransomispaidIftheransomisnotpaidthevictimsdataremainstolicloballyAlthoughcybercriminalsuseavarietyoftechniquestoinfectvictimswithransomware,phishingemails,threeinitialinfectionvectorsforransomwareincidentsreportedtotheIC3.Oncearansomwarethreatincreaseexpandedtheremoteattacksurfaceandleftnetworkhing????teActionsYouCanTakeNowtotRansomwareUpdateyouroperatingsystemandsoftware.Implementusertrainingandphishingexercisestoraiseawarenessabouttherisksofsuspiciouslinksandattachments.IfyouuseRemoteDesktopProtocol(RDP),secureandmonitorit.Makeanofflinebackupofyourdata.dCriticalInfrastructureSectorsacriticalinfrastructuresector.Thereare16criticalinfrastructuresectorswhoseassets,systems,andnoursecuritynationaleconomypublichealthorsafetyeof11Accessibilitydescription:ImageshowsactionsyoucanTaketoProtectAgainstRansomware:Updateyouroperatingsystem.Implementusertrainingandphishingexercisestoraiseawareness,secureandmonitorRemoteDesktopProtocol(DDP)ifused,andmakeanofflinebackupofourdata.122021TrendsShowIncreasedGlobalizedThreatofRansomware./Media/News/2022/220209.pdfEREPORTInOctober2021,theIC3postedaJointCybersecurityAdvisory(CSA)toregardingongoingcyberthreatstoU.S.WaterandWastewaterSystems.InSeptember2021,theIC3postedaPrivateIndustryanFBILiaisonAlertSystem(FLASH)reportthatadvisedtheFBIidentifiedatleast16CONTIransomwaretagenciesSHwarningthatFBIreportingindicatedanincreaseinPYSAransomwarengdomTheIC3received649complaintsthatindicatedorganizationsbelongingtoacriticalinfrastructuresectorwerevictimsofaransomwareattack.Ofthe16criticalinfrastructuresectors,IC3reportingindicated14e12lBase124WaterandWastewaterSystems4ransportationFacilitiestFacilitiesnufacturingologyblicHealth13Accessibilitydescription:ChartshowsInfrastructureSectorsVictimizedbyRansomware.HealthcareandPublicHealthwashighestwith148followedbyFinancialServices89;InformationTechnology74;CriticalManufacturing65;GovernmentFacilities60;CommercialFacilities56;FoodandAgriculture52;Transportation38;Energy31;Communications17;Chemical12;WaterandWastewaterSystems4;EmergencyServices2;DefenseIndustrialBase16FEDERALBUREAUOFINVESTIGATIONOftheknownransomwarevariantsreportedtoIC3,thethreetopvariantsthatvictimizedamemberofatimizedtheCriticaltheGovernmentFacilities,HealthcareandPublicHealth,andFinancialServicessectors.REvil/SodinokibimostfrequentlyvictimizedtheFinancialServices,InformationTechnology,andHealthcareandPublicHealthsectors.Health,FinancialServices,andInformationTechnologysectorswerethemostfrequentvictims.TheIC3sencourageothercriminalactorstoengageinthedistributionofransomware,and/orfundillicitactivities.Payingtheransomalsodoesnotguaranteethatavictim’sfilesurgesyoutoreportransomwareincidentstoyourlocalFBIfieldofficeortheIC3.Doingsoprovidestacks14Accessibilitydescription:ChartshowstopvariantsVictimizingCriticalInfrastructure2021Incidents.REvil/Sodinokibi,Locbit,andCONTI.EREPORTtechnicalsupportorservicetodefraudunwittingindividuals.CriminalsmayposeassupportorservicerepresentativesofferingtoresolvesuchissuesasacompromisedewalManyvictimsreportbeingdirectedtomakewiretransferstooverseasaccountsorpurchaselargeamountsofprepaidcards.In2021,theIC3received23,903complaintsrelatedtoTechSupportFraudfromvictimsin70countries.Thelossesamountedtomorethan$347million,whichcentreporttobeoversalmostmillion2018201920202021$347,657,4322018201920202021$347,657,4322017$14,810,0802017$$38,697,026$54,041,053$146,477,709aniesofferingtofixnonexistentntsoftwareorsecuritysubscriptionsHoweverintheICichhastakenonndbankinginstitutionsutilitycompaniesorvirtualcurrencyexchanges.15Accessibilitydescription:ChartshowsTechSupportLossesOverPast5Years.2021$347,657,432;2020$146,477,709;2019$54,041,053;2018$38,697,026;2017$14,810,080.18FEDERALBUREAUOFINVESTIGATIONVictimlossesin2021veragecomplaintsreceiveddailyeragecomplaintsreceivedperyear(last5years)sreportedsinceinception16Accessibilitydescription:Imagedepictskeystatisticsregardingcomplaintsandvictimloss.Totallossesof$6.9billionwerereportedin2021.Thetotalnumberofcomplaintsreceivedsincetheyear2000isover6.5million.IC3hasreceivedapproximately552,000complaintsperyearonaverageoverthelastfiveyears,ormorethan2,300complaintsperday.EREPORT17Notallcomplaintsincludeanassociatedagerange—thosewithoutthisinformationareexcludedfromthistable.PleaseseeAppendixBformoreinformationregardingIC3data.Accessibilitydescription:ChartshowsnumberofcomplaintsandLossforVictimsbyAgeGroup.Under2014,919victims$101.4Millionlosses;20-2969,390Victims$431.1.Millionlosses;30-3988,448Victims$937.3Millionlosses;40-4989,184victims$1.19Billionlosses;50-5974,460Victims$1.26Billionlosses;60+92,371Victims$1.68Billionlosses.20FEDERALBUREAUOFINVESTIGATIONJapan rkey entina ricatralia 07,00001,0002,0003,0004,0005,000fromAbove>TenThousand25,00250100000018Accessibilitydescription:Thechartslistthetop20countriesbynumberoftotalvictimsascomparedtotheUnitedStates.Thespecificnumberofvictimsforeachcountryarelistedinascendingordertotherightofthegraph.PleaseseeAppendixBformoreinformationregardingIC3data.EREPORTWashington exas 485510,00020,00030,00040,00050,00060,000gton rginia Texasa$7.5228.0$0$200$400$600$800$1,000$1,200$1,40019Accessibilitydescription:Chartdepictsthetop10statesbasedonnumberofreportingvictimsarelabeled.TheseincludeCalifornia,Florida,Texas,NewYork,Illinois,Nevada,Ohio,Pennsylvania,Washington,andNewJersey.PleaseseeAppendixBformoreinformationregardingIC3data.20Accessibilitydescription:Chartdepictsthetop10statesbasedonreportedvictimlossarelabeled.TheseincludeCalifornia,Texas,NewYork,Florida,Pennsylvania,NewJersey,Illinois,Michigan,Virginia,andWashington.PleaseseeAppendixBformoreinformationregardingIC3data.22FEDERALBUREAUOFINVESTIGATIONpepegSmishingNonNon-Payment/Non-Delivery82,478PersonalDataBreach51,829ConfidenceConfidenceFraud/Romance24,299TechingtCardFraudTerrorismTerrorismThreatsofViolence12,346GovernmentImpersonation11,335AdvancedAdvancedFeentntLotteryLottery/Sweepstakes/Inheritance5,991IPRCopyrightandCounterfeit4,270CrimesAgainstChildren2,167CorporateCorporateDataBreach1,287terDenialDenialofServiceTDoS,104ComputerIntrusion979MalwareMalware/Scareware/Virus810HealthCareRelated578ReReshipping516Gambling395riptorslMediairtualCurrencykingpurposesgICdataEREPORTCrimeTypeLossCrimeTypeLossInvestmentInvestment$1,455,943,193ConfidenceFraud/Romance$956,039,740PersonalPersonalDataBreach$517,021,289RealEstate/Rental$350,328,166TechTechSupport$347,657,432Non-Payment/Non-Delivery$337,493,071IdentityIdentityTheft$278,267,918CreditCardFraud$172,998,385CorporateCorporateDataBreach$151,568,225GovernmentImpersonation$142,643,253AdvancedAdvancedFee$98,694,137teringntComputerIntrusion$19,603,037IPRIPRCopyrightCounterfeit5,011HealthCareRelated$7,042,942MalwareMalwareScarewareVirus$5,596,889Terrorism/ThreatsofViolence$4,390,720DenialDenialofServiceTDos$217,981CrimesAgainstChildren$198,950*Regardingransomwareadjustedlosses,thisnumberdoesnotincludeestimatesoflostbusiness,time,wages,files,oravictimInsomecasesvictimsdonotreportanylossamounttotheFBI,therebycreatinganartificiallylowoverallransomwarelossrate.Lastly,thenumberonlyrepresentswhatvictimsportingtoFBIfieldofficesagentsBformoreinformationregardingICdata.24FEDERALBUREAUOFINVESTIGATIONvv=TrendfrompreviousYear910AdvancedFee11,034vv14,607vvter1,118908ceFraudRomanceteDataBreach1,287v1,795vtCardFraudvvAgainstChildren2,167v1,312vTDoSvv15,253v14,493vv01v395262tImpersonationvved578v65730v20,5613,999Counterfeit,2703Lottery/Sweepstakes/Inheritance5,991v8,5017,767reVirusvvvNon-Payment/Non-Delivery82,478v108,86961,832vvnt6,108vv15,395vaBreach30vPhishing/Vishing/Smishing/Pharming323,972241,342114,70211,578v11,677vving18,522v25,789TechTechSupportvTerrorism/ThreatsofViolence12,346v20,66915,563vETCRIMEREPORTvv=TrendfrompreviousYear202020212019Ad