Trusted Codes
BlogOctober 20265 min readENDEESFRITNL

Impersonation fraud in numbers: what the 2025 reports show

Reported losses, research and one figure that goes the other way, each with its source.

Most articles about deepfake fraud open with a forecast in the hundreds of billions. This one uses reported losses wherever possible, names the source of every figure, and says clearly where a number is a forecast. Two warnings before the numbers: reported losses are always too low, because many victims never report; and different reports count different things, so their figures cannot be added up.

Fake emails from known senders: $3 billion in one year

The FBI's Internet Crime Complaint Center (IC3) received 24,768 complaints about business email compromise in 2025, with losses of $3.05 billion. In this type of fraud, a criminal writes as a supplier, a colleague or a manager and asks for a payment, usually to new bank details. There is no malware and no break-in. There is only a message that looks right.

In 2024 the IC3 counted 21,442 such complaints. The number of cases is rising, and the average loss per complaint is about $123,000.

Across all fraud types, the IC3 recorded $20.9 billion in losses in 2025, 26 percent more than in the previous year.

People over 60 lost $7.7 billion

The same report shows who pays the most. Victims aged 60 and over filed 201,266 complaints in 2025 and reported losses of $7.75 billion. That is 37 percent more complaints and 59 percent more money than in 2024. 12,444 of these victims lost more than $100,000 each.

The US Federal Trade Commission counts separately and comes to a similar picture: in 2025 consumers filed more than one million reports about impostor scams, with $3.5 billion in reported losses. For the ninth year in a row, impersonation was the most reported type of scam.

AI appears in the statistics

For 2025 the FBI counted for the first time how many complaints mentioned artificial intelligence: 22,364 complaints, with losses of $893 million. Inside that group, business email compromise with AI elements caused more than $30 million in losses, and "emergency" scams with cloned voices, the classic call from a grandchild in trouble, more than $5 million.

These are small shares of the total. They are also only the cases in which the victim knew, or suspected, that AI was involved. With a well-made voice clone, most victims never find out.

Industry data shows the speed of the change. Pindrop, which secures call centres, reported that deepfake fraud attempts in the contact centres it monitors rose by more than 1,300 percent in 2024, from about one per month to about seven per day. Resemble AI documented 1,567 verified deepfake incidents in 2025 with known losses of $1.28 billion; more than 80 percent of the incidents disclosed no loss at all, so the real figure is higher.

And the forecast, clearly marked as one: in 2024 the Deloitte Center for Financial Services estimated that fraud losses enabled by generative AI in the United States could grow from $12.3 billion in 2023 to $40 billion in 2027.

Two cases that show the scale

In 2024 an employee of the engineering firm Arup in Hong Kong joined a video conference with the CFO and several colleagues. All of them were deepfakes. He transferred HK$200 million, about USD 25 million.

In February 2026 Fideuram, the private-banking arm of Intesa Sanpaolo, transferred about €95 million after a WhatsApp message in the name of the group CEO and a phone call with the AI-cloned voice of a lawyer the chairman knew personally. About €53 million was recovered, and according to Reuters around €36 million is still missing.

Neither of these companies was careless. Both had approval processes. The processes trusted faces, voices and familiar names.

People cannot hear the difference

The common advice is to listen carefully. Research says that does not work. In a study published in PLOS ONE in 2023, 529 participants recognised synthetic speech only 73 percent of the time. Training improved the result by less than four percentage points. In a test by the identity company iProov in 2025, 0.1 percent of 2,000 participants from the UK and the US identified every real and fake image and video correctly.

So one fake voice in four goes through, even when people know that fakes are part of the test. On a real call, nobody expects one.

A figure that goes the other way

Not every number rises. UK Finance reports that losses from criminals impersonating police officers or bank staff in the United Kingdom fell by 18 percent in 2025, to £55.5 million, the lowest value it has recorded. The banks attribute this to warnings in the payment process. At the same time, total authorised push payment fraud in the UK rose by 19 percent to £576.4 million, and CEO fraud had the highest average loss of any type, more than £28,000 per case.

The British numbers show that a check placed at the right moment works. A warning before the transfer stopped some fraud. A check that the person is real comes earlier still, before anyone reaches the transfer screen.

What the numbers mean

All of these losses share one cause: someone trusted what they saw or heard. An email from the right address, a voice that sounded right, a face in a video call. None of those things prove identity any more.

What does prove identity is something only the real person knows at that moment. That is the idea behind Trusted Codes: connected people see the same three words, the words change at a set interval, and when a request is unusual, you ask for them. A cloned voice cannot answer.

Sources

Verify the person, not the channel

Trusted Codes gives you and your contacts three shared words that change at a set interval. It works on every channel and takes one question.

Get Started Free