Criminal movers and shakers, according to the FBI’s IC3

On May 7, the FBI released their annual IC3 report. In it, you can read up on reported internet crime. We like the report, it’s simple and straightforward and based on data. It’s, of course, US-centric, which means there’s more credit card theft and other subtle differences with Europe, but the bigger picture is interesting and relevant.

Since the report offers the numbers with little context, we aim to dive into them, do some comparing between 2016 and 2017, look at some anomalies, interesting tidbits and offer some context. We hope it helps.

Bear the following in mind: it’s about crime. Not about nation-state attacks, espionage, hacktivism and so on. Criminals are our most predictable adversary. They’re after our money, and they’ll choose low hanging fruit and proven technologies when they can. Furthermore, these numbers are only the reported crimes, which means that “low yield” crime numbers are likely to be reported less than they’ve occured.

First look at the numbers

Let’s look at the list, sorted by a cumulative loss in dollars. The top 4 contains Business Email Compromise (CEO e.g. fraud), Romance fraud, Non-payment, Investment. Personal data breach is the first one with a tech component, in the 5th place. Credit card fraud is number 9. It is the first automated crime type in the list. Malware and ransomware are number 24 and 25. According to these numbers, there are 24 better ways than ransomware for criminals to make money. Maybe that’s why our Cyber Defense Centers show that ransomware is slowly being pushed aside by cryptojacking since January of this year.

Total reported losses when we add them up is a bit over 1.7 billion dollars, although IC3 reports 1.4 billion. Maybe because the list doubles some things. BEC is responsible for 39% of these losses. Romance fraud is another 12%, and the other 49% are divided among 31 other crime types.

Based on individual complaints, the pie chart sliced differently. When people are hit by a scam, they will probably tell you one of these two stories: the most common one is that they bought something online, but never got the goods. The second one is about how their personal data was stolen or leaked.

Criminal money makers

Which is the most profitable attack type? To get some insight, we divided the total loss per crime type by the number of reported incidents. On the low end, if you’re scamming kids, you’re only making a small amount of money (and be a miserable person in the process), while going after the big enterprises with CEO fraud yields an average of $ 43,094. Investment fraud complements the top 3 at number 2 (averaging $ 31,351), and Corporate Data Breach at number 3, averaging $ 16,101.

Obviously, this doesn’t mean every criminal will stop what they’re doing and go BEC tomorrow. Social engineering type attacks require time, effort and diligence, whereas some of the automated malware attacks are close to fire-and-forget. It all depends on the criminals’ work ethic and their risk appetite. Each to his own.

Loss, profitability, and volume

Next, we aimed to visualize the 33 crime types in one graph; the number of attacks versus average loss. The data points are sized by total loss (and thus the FBI’s ranking). We observe four quadrants; the most dangerous is empty: attacks with a high yield that happen a lot. The cash cows are BEC and investment fraud. Most likely to happen is non-payment, although you probably won‘t lose sleep over it. Romance fraud is in the middle and apparently seems to be a well-balanced attack, as it heads the mainstream (and some rare attacks seldom reported).

Changes of the past year ranked by loss

The top 4 (BEC, Romance fraud, Non-Payment, Investment fraud)  didn’t change. The total reported crime losses went up from $1.6B to $1.7B (with the caveat, FBI themselves mention 1.4B). If this were a music top 33, it would be a boring one, with few movers and shakers. Tech support scams are number 17 in the list (up from 22), and Civil matter dropped down from 10 to 21. This is the biggest anomaly we could find, as IC3 reports total losses on the Civil matter going down by 90% while the number of victims is almost the same, around 1000. We suspect a digit got shifted in the IC3 numbers.

Changes of the past year ranked by the number of complaints

If we sort the numbers by the number of complaints, then we get a different picture. Most attacks yield way less than the above mentioned top three, as a matter of fact, the average across all attacks is a bit over 4,500$. That said, for the top 3: Nonpayment averages the criminal $1,678, personal data breach averages almost $2,500 and Phishing averages a bit over $1,100. It seems, the mainstream internet criminal still has an appetite for these mid-level amounts. Maybe their proven ways of laundering the money drive this appetite, or maybe criminals in the B-leagues just like to do it this way.

Some final thoughts

From 2016 to 2017, nothing much changed. Ransomware is not the big criminal money maker people think it is, and in 2017 this has been confirmed. Some numbers seem to be counterintuitive: our observations in our Cyber Defense Center show that the number of malware infections is steadily increasing, for example. A first explanation for this is organizations see malware (such as ransomware and crypto miners) as an operational nuisance. They cut their operational losses, but they do not pursue the event with law enforcement. Especially in larger organizations, with multiple malware infections per day, this makes sense. Secondly, for attacks like ransomware, the impact is determined more by collateral damage rather than by the criminals‘ profit.

This said, the highest amounts of money are not stolen by hacking and tools, but by social engineering. The bulk of internet crime was done in a mid-range segment, criminals aiming to rob a few thousand from you and launder it in traditional ways. BEC was and remains the biggest moneymaker. It shows that, despite our efforts to become more resilient, criminals eagerly exploit that which is so difficult to patch: our behavior.

Links

• FBI announcement
• 2017 IC3 report
• 2016 IC3 report
• SecureLink blog on coin mining

Data sources from FBI IC3. Data compiled from the FBI’s reports by Glenn Fryklund. Analysis by Glenn Fryklund and Eward Driehuis.