Facts + Statistics: Identity theft and cybercrime

The scope of identity theft

According to the Aite Group, 47 percent of Americans experienced financial identity theft in 2020. The group’s report, U.S. Identity Theft: The Stark Reality, found that losses from identity theft cases cost $502.5 billion in 2019 and increased 42 percent to $712.4 billion in 2020. The group explains that the huge increase was fueled by the high rate of unemployment identity theft during the pandemic, as increased and extended unemployment benefits made the sector an attractive target for fraudsters.

Losses are forecast to increase again in 2021 to $721.3 billion. The study narrowed the identity theft definition to include only application fraud, where criminals used a victim’s identity to open a new account of some type, and account takeover, where an account is taken so criminals can steal money or access rewards. Examples of accounts include rewards accounts for airlines, hotels, or merchants; insurance policies; and other accounts.

In the past two years, 37 percent of consumers have been victims of application fraud and 38 percent experienced account takeovers. The highest percentage of consumers who were victimized in 2020 were between 35 and 44 years of age and accounted for 30 percent of all identity theft victims. The findings are from an online survey conducted in December 2020 of 8,653 U.S. consumers age 18 and older.

Identity theft and fraud complaints

The Consumer Sentinel Network, maintained by the Federal Trade Commission (FTC), tracks consumer fraud and identity theft complaints that have been filed with federal, state and local law enforcement agencies and private organizations. There were 4.8 million identity theft and fraud reports received by the FTC in 2020, up 45 percent from 3.3 million in 2019, mostly due to the 113 percent increase in identity theft complaints.  In 2020, 1.4 million complaints were for identity theft, up from 651,000 in 2019. Identity theft complaints accounted for 29 percent of all complaints received by the FTC, up from 20 percent in 2019. About 2.2 million reports were fraud complaints and 1.2 million involved other complaints.  

Out of the total 4.8 million reports received by the FTC in 2020, the most by category were for identity theft complaints. Within identity theft, almost one-third were for scams involving government benefits applied for or received. According to Equifax, federal stimulus payments were an easy target for criminals and were the number one COVID-19 scam. New credit card accounts fraud were the next largest identity theft scam, about 30 percent of all identity theft complaints. Imposter scams were the second-worst overall category of FTC complaints, with almost one-half million reports.

Of the 2.2 million fraud cases, 34 percent reported money was lost. Consumers reported losing more than $3.3 billion related to fraud complaints, an increase of $1.5 billion from 2019. The median amount consumers paid in these cases was $311. Twenty-two percent of imposter scams reported money lost, totaling about $1.2 billion.

The top five states for identity theft ranked by the number of reports per population were Kansas, Rhode Island, Illinois, Nevada and Washington. (See chart below). For fraud and other complaints, the top five states were Nevada, Delaware, Florida, Maryland, and Georgia.

Identity Theft And Fraud Reports, 2016-2020 (1)

 

id_theft_and_fraud_complaints_2016-2020.gif

(1) Percentages are based on the total number of Consumer Sentinel Network reports by calendar year. These figures exclude "Do Not Call" registry complaints.

Source: Federal Trade Commission, Consumer Sentinel Network.

View Archived Graphs

See also the Identity Theft section of our Web site Click Here

Cybercrime

As businesses increasingly depend on electronic data and computer networks to conduct their daily operations, growing pools of personal and financial information are being transferred and stored online. This can leave individuals exposed to privacy violations, and financial institutions and other businesses exposed to potentially enormous liability, when a data security breach occurs. The Allianz Risk Barometer 2022 indicates that cyber risk has become the biggest concern for companies globally, topping the list of business threats for the second time in the survey’s history. Cyber incidents rank as a top three peril in most countries surveyed with the main driver being a recent surge in ransomware attacks. Such attacks use “double extortion” tactics that combine the encryption of systems with data breaches.

High-profile data breaches continue to threaten business with losses and consumers with exposure of their personal data. In 2021 more than 280 million Microsoft customer records were left unprotected on the web in January. By March, the U.S. Cybersecurity and Infrastructure Security Agency, a standalone United States federal agency in the Department of Homeland Security, advised all organizations across all sectors follow its guidance to address Microsoft’s email server vulnerabilities. According to the Triple-I, the number of U.S.-based organizations affected is estimated to be at least 30,000, while worldwide that number is close to 100,000. Other notable breaches in 2021 involved Colonial Pipeline Co., an East Coast gas utility that suffered a ransomware attack that shut down the company for six days, along with Facebook and Volkswagen of America breaches. A breach at Marriott Hotels in March 2020 reached a data system containing the personal information of about 5.2 million customers and MGM Resorts was hit by a February 2020 data breach that exposed the personal information of more than 10.6 million guests. Mimecast revealed in its 2021 State of Email Security Report that 61 percent of organizations suffered a ransomware attack that led to at least a partial interruption of business operations. In 2020, 51 percent of organizations stated that they underwent these types of malware attacks.

Data breach costs have only increased in recent years, with the average attack rising to $4.24 million in 2021, up from $3.86 million 2020. Costs remained highest in the U.S., rising to $9.05 million from $8.64 million in 2020. According to modeler CyberCube, rating agency AM Best and insurance and reinsurance broker Aon, a $12.5 billion industry loss from non-physical damage could transfer to property carriers if a major event occurs, triggering a one-in-100-year loss in the U.S. property insurance market. This loss figure suggests that the U.S. property insurance market is exposed to $9.5 billion of attritional losses and $3 billion of catastrophic losses. According to AM Best, the prospects for the cyber insurance market are “grim” due to rapid growth in exposure without adequate risk controls; growing sophistication of cyber criminals; and the cascading effects of cyber risks and a lack of geographic or commercial boundaries.

The Identity Theft Research Center (ITRC) reports a 17 percent increase in U.S. business data breaches in the first three quarters of 2021 compared with the 2020 total. There were 1,291 breaches, January to September, 2021, compared with 1,108 in 2020. The record high was 1,529 in 2017. The report estimates 250 million people will have their data compromised by the end of 2021, as opposed to 310 million people in 2020. In the second quarter of 2021, the ITRC found that there was a 38 percent increase in data compromises from the first quarter.

According to Accenture, insurance companies were most affected by ransomware attacks in the first half of 2021, totaling almost 25 percent of all ransomware attacks on Accenture’s clients. Consumer goods and services, and telecommunications ranked second and third.

The (ITRC) also reported in early 2021 that cybercriminals remain less invested in taking large amounts of personal information directly from consumers, instead manipulating poor consumer behaviors to perpetrate identity-related crimes against businesses using stolen credentials, such as logins and passwords. Criminals then utilize these stolen logins and passwords to perpetrate ransomware and phishing attacks against businesses.

Additionally, organizations often leave their cybersecurity teams understaffed, according to ISACA, a global IT professional organization. In its 2021 State of Cybersecurity report, ISACA found that 61 percent of cybersecurity professionals consider their organization’s cybersecurity team understaffed. This understaffing among organizations, which includes business and government, creates a burden on existing staff and can consequently cause an increased risk from malware threats. The study found that 47 percent stated that their organizations were “somewhat” understaffed, while 14 percent reported they were “significantly” understaffed. Additionally, 34 percent reported that their organization is “appropriately” staffed, with only 4 percent stating that they are either “somewhat” or “significantly” overstaffed.

According to the 2021 Cost of a Data Breach Report, a global study sponsored by IBM Security and conducted by the Ponemon Institute, the average data breach cost rose from $3.86 million in 2020 to $4.24 million in 2021. Ransomware attacks cost an average of $4.62 million, surpassing the average data breach cost. The percentage of companies where ransomware was a factor in the breach was 7.8%. Malicious attacks that destroyed data in destructive wiper-style attacks cost an average of $4.69 million. The study utilized results from 537 organizations across 17 countries and regions, as well as 17 industries, providing global averages. The costs of these breaches included escalation, notification, lost business and response costs. Cost factors included in the survey included legal, regulatory and technical activities related to breaches. Customers’ personally identifiable information (PII) was exposed in 80 percent of the breaches that occurred in 2021, and 20 percent of breaches were caused by stolen or compromised credentials and cloud misconfigurations.

Cyber insurance evolved as a product in the United States in the mid- to late-1990s as insurers had to expand coverage for a risk that is rapidly shifting in scope and nature. In 2020, 203 insurer groups reported writing cyber insurance at one or more of their subsidiaries, up from 197 in 2019, according to data sourced from S&P Global Market Intelligence. Direct premiums written totaled $2.8 billion in 2020, from companies that can report premiums for stand-alone and coverage provided as part of package policies, up from $2.2 billion in 2019. For more information on cyber insurance see Insurance Facts, Commercial Lines.

Number Of Data Breaches And Individuals Impacted, 2015-2020

 

num_of_data_breaches_and_rec_exp_15-20.gif

Source: Identity Theft Resource Center, 2020 year in review, Data Breach Report.

View Archived Graphs

The IC3 says that 2020 complaints and dollar losses were the highest since the center began tracking cybercrime statistics in 2000. In 2020 the IC3 received and processed 791,790 complaints, a 69 percent increase from 467,361 in 2019. Losses to individuals and businesses totaled $4.2 billion, up 20 percent from 2019 . Business email compromise continued to cause the most losses, with about $1.8 billion in losses, followed by confidence or romance fraud, with $600.2 million in losses. Business email compromise typically involves a criminal mimicking a legitimate email address. For example, an employee might receive a message that appears to be from an executive within their company requesting a payment or wire transfer that funnels money directly to a criminal. About 19,400 people were victims of email account scams. Confidence fraud occurs when a criminal deceives a victim into believing they have a trust relationship and the victim is persuaded to send money or personal and financial information. In 2020 about 23,750 people reported confidence scams.

Cybercrime Complaints, 2016-2020 (1)

 

cyb_crime_comp_16-20.gif

(1) Based on complaints submitted to the Internet Crime Complaint Center.

Source: Internet Crime Complaint Center.

View Archived Graphs

Additional resources

Federal Trade Commission

Internet Crime Complaint Center