The FBI put $893 million next to AI fraud

The FBI's Internet Crime Complaint Center took 1,008,597 complaints in 2025 and counted $20.877 billion in losses, a 26% jump over the year before. Buried in that report is a dedicated section on artificial intelligence, and with it a line item for complaints that reference it. There were 22,364 of them, and the adjusted losses came to $893,346,472.

Most coverage read that as the size of the AI fraud problem. It is not. It is the size of the part victims recognized as AI — and the same report quietly shows how small a fraction that is.

The lesson is not that we need better fake-spotting. It is that fake-spotting is the wrong control to be investing in, because by the time anyone is looking, the decision has already been made.

What the report actually says

The IC3's section, "Artificial Intelligence (AI) Used in Cybercrime," is blunt about the trajectory: "AI-enabled synthetic content is becoming increasingly difficult to detect and easier to make, which allows criminal actors to potentially conduct successful fraud schemes against individuals, businesses, and financial institutions."

The breakdown by scheme is where it gets useful:

• Investment fraud with a reported AI nexus: over $632 million. This is the bulk of the $893 million, and the report describes the mechanics — "AI-generated videos and voices of celebrities, CEOs, or trusted figures" used to manufacture endorsements, delivered on social media or in video calls.
• Business email compromise involving AI: over $30 million. Chat generators produce official-sounding mail in a CEO's register; the report notes voice cloning is then used "to request wire payment."
• Confidence and romance fraud with a likely AI nexus: over $19 million, of which over $5 million came from distress scams — the grandparent call, where "voice cloning technology is used to mimic the sound of a loved one in distress."
• Employment fraud involving AI: almost $13 million. Here the report is candid that money is not the goal: the tells it lists are a candidate whose "lip movement... do not completely coordinate with the audio," and the objective is "gaining access to private computer networks."

The $893 million is a floor, and the report says so

One sentence in the AI section deserves more attention than the headline number. Investment fraud with a flagged AI component ran to $632 million. But, the IC3 writes, "overall losses to Investment complaints exceeded $8 billion, demonstrating that many victims do not realize the extent AI may be involved in scams."

Sit with the ratio. In the single category where AI-driven impersonation is most heavily documented, the AI-flagged share is under 8% of the total losses — and the FBI's own reading is not that the other 92% was AI-free. It is that victims could not tell.

That is the finding underneath the statistic. This is a self-reported dataset, and the field being reported is whether the victim noticed the content was synthetic. Every number in the AI section is therefore a measurement of a different thing than it appears to measure: not how much AI fraud happened, but how much of it was legible as AI to the person it happened to. The gap between $632 million and $8 billion is the size of our collective inability to tell.

You cannot build a control on a signal humans demonstrably cannot read.

Training people to spot fakes is a control that expires

The standard enterprise response to this report is awareness training. Watch for unnatural blinking. Listen for flat prosody. Check whether the lips match the audio. The IC3 itself lists the coughing-and-sneezing mismatch as an employment-fraud tell, which was sound advice for the generation of models that produced it.

The evidence on whether people can be trained into this is not good. Reviewing 22 experimental studies on human and machine deepfake identification, Birrer and Just found that human participants identified deepfakes with an average accuracy of 63.3% — and the review, cited in Professor Rebecca Delfino's rules proposal to the federal Advisory Committee on Evidence Rules, notes that accuracy swung with image resolution, familiarity with the person depicted, and the demographic similarity between viewer and subject. Participants also consistently overestimated their own ability, a Dunning-Kruger pattern that awareness training tends to reinforce rather than correct. Sixty-three percent is barely better than a coin flip, and it is measured on people who knew they were being tested.

Every one of those tells is also a bug that gets fixed. The artifacts people are trained to notice are artifacts of the current model generation, and they disappear on the release cadence of the labs — which is to say, faster than an annual security-awareness refresh. A control whose accuracy degrades every time a vendor ships is not a control. It is a depreciating asset.

The deeper problem is where in the process the check sits. In a BEC wire fraud, the synthetic artifact is a phone call from the CFO at 4:40pm on a Friday. There is no file to inspect, no metadata to read, no time to run an analysis. The employee is being asked to make a real-time authenticity judgment about a human voice, under manufactured time pressure, with no instrument. That is not a detection problem that better detection solves. It is a problem of having nothing to check against.

Automated detection inherits the same structural weakness from the other direction. A classifier hands back a probability, and probabilities are unusable as the basis for releasing or blocking a payment — a 70% reading tells a treasury team nothing actionable, and the false positives land on legitimate transactions. We have argued this at length in why provenance beats detection, and the IC3 data is the strongest argument yet: if the victims of nearly $8 billion in investment fraud could not tell, the answer is not a sharper guess.

The control is a reference, not a judgment

Every mature anti-fraud control in banking works the same way: it replaces a judgment with a reference to a record. You do not train tellers to intuit whether a signature is genuine; you compare it to one on file. You do not ask a payments team to assess whether a wire instruction feels legitimate; you call back on a number from the vendor master, out of band.

Content has had no equivalent, which is precisely why synthetic media works as an attack. There is no record to refer to.

That is the gap provenance closes, and the reason it belongs in the fraud stack rather than in the content-moderation stack. A proof of origin makes an inbound artifact checkable against something: a signed statement of what produced it, bound to the content by a perceptual fingerprint — derived from what the content looks or sounds like rather than from its bytes — and recorded in an append-only public log. The check returns evidence, not a score. Either there is a matching record and it says what it says, or there is not.

Three properties matter for this use case specifically:

It survives the channel. Fraud arrives forwarded, screenshotted, re-encoded, and clipped. A signature over a byte hash breaks on the first re-compression. A perceptual fingerprint is designed for exactly that journey, which is the mechanism we walk through in how a fingerprint survives what the file cannot.

The record cannot be backdated. An attacker who could write a plausible-looking history after the fact would have gained a forgery tool rather than a defense. An append-only Merkle log with independently verifiable inclusion proofs is what removes that possibility — the same structure Certificate Transparency uses.

Verification is free and account-free. Fraud controls get used when they are frictionless. Any employee, bank, or platform can check a file without onboarding, an API key, or a vendor relationship — try it.

Where this genuinely does not reach

A live voice on a phone call is not stamped content, and no provenance system stamps it. The 4:40pm CFO call remains a callback-procedure problem, and the right control there is still an out-of-band verification against a number you already hold. Anyone selling provenance as an answer to real-time voice fraud is overselling it.

What provenance does cover is the growing share of these schemes that runs on artifacts: the fabricated CEO endorsement video in an investment pitch, the AI-generated executive on a recorded call, the doctored proof-of-life media the IC3 flags in virtual-kidnapping extortion, the synthetic identity documents in an onboarding flow. Those are files. Files can carry records.

And the absence of a record is never proof of fraud. An unstamped file is unstamped, nothing more — the same asymmetry we described in Content Credentials solve half the problem. Provenance raises the floor for honest senders; it does not convict the silent.

Where to put it in an actual stack

For a security or fraud team, the practical question is which flows change. Three are worth the work, and they share a shape: content arrives from outside, and a decision follows.

Onboarding and identity documents. A submitted ID photo, a selfie, a proof-of-address document. These are files, they are the front door for synthetic identity fraud, and today they are assessed by a model guessing at manipulation. A provenance check adds an independent line: whether this artifact carries a record, and what it says.

Anything used to authorize a payment. Recorded calls, video-conference captures, scanned invoices, signed authorizations. The IC3's $30 million in AI-involved BEC losses runs through documents that look right. A record of origin is checkable in a way that "looks right" is not.

Published material about your own brand. The $632 million in AI-nexus investment fraud is largely fabricated endorsements by executives and public figures. You cannot stop someone generating a video of your CEO. You can make sure every genuine appearance carries a signed record in a public log, so the verification a suspicious investor runs returns something for the real ones and nothing for the fake — and so your communications team has a citable reference rather than a denial. The SDKs make this a build-step change rather than a project.

Note what all three have in common: the provenance check never renders a judgment. It returns evidence, which then feeds the risk logic already in place. It behaves like a sanctions-list lookup, not like a fraud score.

What the number is really telling you

The FBI put $893 million next to AI in 2025 and, in the same section, showed the figure is an undercount by roughly an order of magnitude in the category where it looked hardest.

Read that as a verdict on detection. The one variable the IC3 could measure was whether people noticed, and mostly they did not. Spending the next budget cycle teaching them to notice harder is optimizing the control that already failed.

Stop asking whether content looks real. Start asking what it can prove about where it came from — and build the systems that let it answer.

Further reading: 2025 IC3 Annual Report (FBI) · IC3 alert: criminals use generative AI to facilitate financial fraud · Invisible image watermarks are provably removable using generative AI (NeurIPS 2024) · C2PA content provenance standard · Certificate Transparency (RFC 6962)