FBI-Reported U.S. Cybercrime Losses

A primary consideration for forecasters is whether AI will disproportionately advantage attackers or defenders. Many high-loss respondents argue the advantage lies with the attackers: “Defenders have to cover a widening attack surface, while attackers only need to find one vulnerability, one moment of misplaced trust, or one pathway into a financial relationship.”; “Defenders remain structurally disadvantaged…institutions move slowly, legacy systems remain everywhere, and human beings continue to be remarkably exploitable firmware.” A few low-loss respondents, however, argue the opposite is likely to be true: “Probably contrary to the typical rationale, I think rapid advancement in AI would actually produce counter scam technology. AI could analyze voices, speaking patterns, IP addresses, and other information and then prevent people from falling for scams.” Still others argue that, while attackers are likely to be disproportionately advantaged in the near term, defenders may win the day in the long term: “At least initially AI will accelerate losses. Maybe by 2031 AI will make systems secure enough to reverse the trend.”

High-loss respondents often anchor on the recent growth in reported cybercrime losses, focusing in particular on the recent spike: “Internet Crime Complaint Center losses grew from $1 billion in 2015 to nearly $21 billion in 2025, and the growth continues apace. Extrapolation is a poor guide for long horizons, but for five years out it seems like a natural starting point.” Low-loss respondents tend to think the curve is likely to flatten before then. One writes, “There is a negative feedback loop on these numbers: the larger they get, the more efforts will be made to guard against these crimes,” while another argues that "the latest trend has us going to infinity too quickly…this curve will soon become a sigmoid.”

Many respondents treat AI-enabled deception as the primary driver of future losses: “AI can make phishing, impersonation, romance scams, investment fraud, and business-email-compromise schemes more scalable and more convincing. Deepfakes, automated targeting, and personalized messages may also increase the success rate of fraud.”; “AI directly scales the attack side with automated phishing, deepfakes, voice cloning, and large-scale social engineering.” Others express skepticism, with one writing, “I'm not really sure I see much connection between the AI progress and the level of cybercrime. I guess there are ways that advancing AI could increase or decrease cybercrime. But it seems pretty orthogonal to me.” Another argues that “an important factor for the growing cybercrime losses is due to the simple fact that more and more business and money stuff is handled through cyberspace.”

Many high-loss respondents expect victims and institutions will be slow to adapt, with one pointing to the “aging US population” and noting that “aging, asset-rich people are the most vulnerable cohort (ie, mental decline makes people vulnerable)” and another that the future is likely to resemble “a giant whack-a-mole ecosystem of criminal creativity that mutates faster than institutions can realistically adapt.” Low-loss respondents typically express more optimism: “I expect systems to be introduced to counter AI-enabled fraud at pace—things like multi-factor authentication, passkeys and hardware-backed authentication. Behavioral biometrics like typing rhythm, device handling, mouse patterns, and navigation habits add a signal that is harder for synthetic identities to imitate.”; “Trust may become less of a default social condition online and more of an operational achievement, something produced through verification, platform design, bank controls, and new habits of suspicion.”

Echoing points made when considering whether AI will disproportionately advantage attackers or defenders, several high-loss respondents predict rapid progress will result in, as one puts it, the emergence of “highly capable agents that can conduct large-scale fraud, social engineering, and cyber-enabled financial crime with very little human labor.” Whereas a low-loss respondent “suspect[s] that persistent personalized AI assistant agents will be deployed at scale in the next two years, and that one of their functions will be to screen inbound communications for scams.”

Many respondents point to the potential for the gap between reported losses and actual losses to distort future reports. High-loss respondents often see reporting growth leading to higher numbers: “There is significant underreporting which could be mitigated if AI makes reporting easier, so I'm modeling a substantial upwards tail.” One low-loss respondent offers a counterpoint: “If US enforcement and reporting capacity remains constrained by resource pressures, and if broader conflicts of interest around crypto or financial regulation weaken incentives for aggressive fraud enforcement, reported IC3 losses may grow more slowly than underlying cybercrime.”