The short answer. Cyber fraud is not one crime. It is a dozen distinct industries, each with its own playbook, target profile, and recovery path. This guide covers every major category. Business Email Compromise, phishing, investment fraud and pig butchering, tech support scams, romance scams, synthetic identity fraud, account takeover, recovery scams, marketplace fraud, and deepfake-assisted fraud. For each, you get how it works, who it targets, and the single defense with the best payoff. The recovery section at the end covers how to report in the US, UK, and India.
The FBI’s Internet Crime Complaint Center logged a record $16.6 billion in losses in 2024, across 859,532 complaints. That is a 33% jump from 2023. India’s I4C (Indian Cyber Crime Coordination Centre) reported ₹11,269 crore (about $1.35 billion) in fraud for FY2024. The agency itself estimates actual losses are several times higher, given the severe underreporting that marks cybercrime across South Asia. The UK’s Action Fraud received over 380,000 reports in 2023, with losses exceeding £2.3 billion.
These figures represent only crimes that were reported. Only victims who knew they’d been defrauded. Only losses that could be quantified at the time of filing. The real numbers are larger.
A victim of Business Email Compromise needs different immediate actions than a victim of pig butchering. A person who received a tech support call faces a different threat than someone whose bank account was taken over by a credential-stuffing attack. Knowing which type you’re dealing with is the first step to responding correctly, and to defending against it before it happens.
Business Email Compromise
Business Email Compromise targets organizations rather than individuals, but the damage lands on the people inside them. The attack convinces an employee to authorize a fraudulent wire transfer or redirect payroll. It uses an email that appears to come from a trusted source: the CEO, the CFO, a vendor, or an attorney handling a transaction. The sender address is either spoofed (made to look like the real address without controlling it) or a genuine compromise of the executive’s real account through phishing or credential theft.
The most direct path to a BEC attack is LinkedIn. An attacker searches the target company and identifies the finance team. They find the CFO’s name and the accounts payable manager’s name, then infer the email format from a press release or team page. From there they build a wire transfer request that follows the real hierarchy. The request usually invokes urgency or confidentiality: a deal closing today, a legal matter that requires discretion. The social engineering is the attack. No malware is required.
Toyota’s Belgian subsidiary, Toyota Boshoku Corporation, lost about €37 million in a single BEC transfer in 2019. An attacker impersonated a business partner and convinced financial officers to change the bank account on a pending payment. The FBI reported $2.77 billion in BEC losses across US victims in 2024. This category consistently ranks among the highest-dollar-loss cybercrime types in the IC3 report, year after year.
The defense with the best payoff is a call-back policy. Any wire transfer request above a set threshold requires verbal confirmation with the requester over a phone number already on file. Pick a number that fits your organization, such as $5,000 or $10,000. Confirm it regardless of how convincing the email appears. This single control defeats most BEC attempts, because it cannot be bypassed through email alone.
Phishing, Vishing, and Smishing
Phishing is the baseline of online fraud. It is a fraudulent message that impersonates a trusted entity to harvest credentials, install malware, or direct you to a fraudulent payment. Today’s version has evolved a long way from the badly spelled Nigerian prince email.
Adversary-in-the-middle (AiTM) phishing is the technique that renders standard multi-factor authentication ineffective. Tools like Evilginx sit as a transparent proxy between the victim and the real service. The victim enters their credentials and their one-time password. The proxy relays both to the real site in real time and logs the resulting session cookie. The attacker then uses that cookie to authenticate without the victim’s knowledge. The MFA code was entered successfully. It just went to the wrong party. This technique drove the 2022 “0ktapus” campaign, which breached Twilio and targeted over 130 organizations. That breach compromised Signal SMS verification data for about 1,900 users. Cloudflare, also targeted, blocked the attack entirely with hardware security keys. FIDO2 verified the real domain, while the phishing proxy could not.
Voice phishing (vishing) exploits phone trust. Attackers impersonate bank fraud departments, IRS agents, or UIDAI officers. They walk victims through “securing” their account by reading back an OTP, transferring to a “secure” account, or installing remote access software. SMS phishing (smishing) has become the dominant consumer fraud vector in recent years. Think fake package-delivery texts from USPS, FedEx, India Post, or Royal Mail, carrying malicious links that harvest banking credentials or install Android malware.
The only defense that reliably defeats AiTM phishing is a FIDO2 hardware security key, such as a YubiKey or Google Titan. These keys cryptographically verify the domain you’re authenticating to. If the site is a proxy rather than the real login page, the key refuses to sign. SMS-based 2FA and authenticator-app codes do not provide this protection. Treat them as a usability improvement over passwords, not a security guarantee. For financial accounts, Google accounts, and any service holding sensitive data, hardware keys are the right choice.
Investment Fraud and Pig Butchering
The FBI IC3 logged $6.57 billion in investment fraud losses in 2024, the single largest category by dollar loss. The dominant method driving that figure is pig butchering (sha zhu pan in Mandarin, “slaughter the pig”). It is a long-form relationship fraud that has industrialized in compound operations across Southeast Asia, primarily in Myanmar, Cambodia, and Laos.
The structure is systematic. Contact begins through LinkedIn, Instagram, dating apps, or WhatsApp. The opening message often claims to be a wrong number or a business-networking mistake. Over weeks to months, the scammer builds a relationship, discusses investments, and eventually introduces a platform. The platform’s screen shows real-time prices. The victim deposits money and sees fabricated profits pile up. Small withdrawals are allowed early to build confidence. At the point of maximum investment, the victim tries to withdraw. The scammer has encouraged this with stories of their own large positions. The victim then discovers that taxes or fees of 20–30% must be paid before any withdrawal is released. Those taxes and fees are additional fraud. The platform is entirely fake, controlled by the scammer operation, and the money is gone.
The US Department of Justice has prosecuted several pig butchering networks. A 2023 indictment alleged losses to US victims exceeding $80 million from a single operation. The victims include technically sophisticated people: engineers, doctors, finance professionals. The fraud targets emotional trust, not technical naivety.
The defense: verify any investment platform against FINRA’s BrokerCheck (brokercheck.finra.org) and the SEC’s EDGAR database before transferring a dollar. Any platform not registered with a national securities regulator is operating illegally in a regulated jurisdiction. No legitimate platform imposes taxes or fees as a precondition of withdrawal. Real taxes on investment gains are reported to regulators and paid to governments, not to the platform itself.
Tech Support Scams
A browser window fills with a red warning. It claims your computer is infected, your files are at risk, and your IP address has been reported to Microsoft or the TRAI. A phone number is displayed. The instruction is to call immediately.
Legitimate operating systems, antivirus software, and security services never display a phone number in an error or warning message. Windows Defender does not show a phone number. macOS security alerts do not show a phone number. TRAI does not send browser warnings. The popup is built with JavaScript or HTML. It can appear on any website, including through malicious advertising on legitimate sites.
Callers in tech support scams walk the victim through granting remote desktop access. AnyDesk and TeamViewer are the most common tools, because they’re legitimate software that antivirus doesn’t flag. Once remote access is established, the attacker harvests browser-saved credentials, banking sessions, and stored documents. They sometimes install persistent tools that allow return access after the call ends. They may also stage a fake screen showing “your funds being transferred” to demand immediate payment for “cleaning” the malware. For the full breakdown, see the guide to tech support scams.
Microsoft receives millions of tech support scam complaints a year and has partnered with law enforcement on takedowns. In 2021, the FTC brought actions against multiple operations and secured over $30 million in judgments. The model persists anyway. It is cheap to run, hard to trace, and effective against any victim who doesn’t know the basic tell: no real software alert ever includes a call-back phone number.
If you encounter one of these popups, close the browser. If it doesn’t close normally, force-quit it from Task Manager or Activity Monitor. Do not call the number. If you already called and granted remote access, disconnect from the internet immediately. Change your passwords from a separate device, and contact your bank to watch for unauthorized access.
Romance Scams
Romance fraud is mechanically distinct from pig butchering, though the two increasingly overlap. The classic romance scam does not involve a fake investment platform. The endpoint is a direct request for money, through wire transfer, gift cards, cryptocurrency, or money-transfer services. It follows a relationship of two to six months of online contact.
The most common personas are military officers on overseas deployment, offshore oil-platform engineers, international surgeons with relief organizations, and UN or NATO officials on peacekeeping missions. Each persona explains why meetings are impossible. Each also explains why the person has access to compelling assets, such as equipment, salaries, or medical supplies, that could be “stranded” and require a financial intervention.
The FBI IC3 recorded $734 million in romance fraud losses in 2022. Victims range across every demographic. The most consistent factor is recent social isolation from divorce, bereavement, or relocation, which creates genuine loneliness an attacker can exploit. The scam is not predicated on stupidity. It is predicated on loneliness and the human tendency to trust people we have emotional investment in.
The primary detection technique is reverse image search. Scammers use stolen profile photos, often taken from the Instagram accounts of real models, soldiers, or professionals. Running a profile photo through Google Images or TinEye usually reveals the real source within seconds. A photo that returns results under a different name, country, or context is a definitive warning. One more rule of thumb. Anyone who claims romantic interest but never appears in unscripted live video, and never meets in person despite months of contact, and eventually asks for money is running a script. The size of the first request does not matter.
Synthetic Identity Fraud
Synthetic identity fraud does not immediately damage your existing credit, because it doesn’t use your identity. It uses only your national ID number, attached to a fabricated name and address. The dedicated post on synthetic identity fraud covers the 12–24 month construction process, the bust-out mechanics, and why children’s identities are the primary target. The short version: the attack runs invisibly. The fraudulent credit file sits under a name you’ve never heard, and most credit-monitoring services scan by name rather than by SSN.
The financial system loses an estimated $20 billion a year to synthetic identity fraud in the US alone. Detection requires SSN-level monitoring, not name-level monitoring. The primary defense is a credit freeze at all three bureaus. It prevents any new credit file from being opened using your SSN. For children, that means freezing their credit before they’re old enough to need it. The window between birth and first credit application is the entire period of exposure, which can run 18 years.
Account Takeover
Account Takeover (ATO) covers every method of authenticating as you on a service you legitimately use. The attack vectors divide roughly three ways. Credential-based uses stolen passwords from breaches or stealer-log markets. Session-based uses stolen browser cookies that bypass login entirely. Social engineering tricks you, or customer support, into giving access.
The fastest-growing vector in recent years is the browser infostealer. This malware spreads through malicious advertising, cracked software, fake game mods, and YouTube-linked installer packages. It exfiltrates every saved password and active session cookie from the victim’s browser. Traditional credential stuffing requires finding a working password and beating login controls. Session cookie theft skips that: it authenticates straight to an already-logged-in session. The victim’s bank account can be reached without a password ever being entered. FinCEN flagged $25.9 billion in suspicious activity reports tied to account takeover in 2023. For a deeper walkthrough, see the guide to bank account takeover fraud.
Each vector has its own defense. Against credential-based ATO, a password manager that generates unique, long passwords for every site removes the reuse that credential stuffing depends on. Against session theft, use anti-malware that targets infostealers, avoid downloads from unofficial sources, and use hardware security keys that lock sessions to registered devices. Against social engineering, freeze your mobile account at your carrier to block unauthorized SIM swaps. On top of your account password, register a verbal passcode or PIN with the carrier.
Recovery Scams
Recovery scams target people who have already lost money to fraud, the most vulnerable population in the fraud ecosystem. The pitch arrives by phone, email, or social media ad. A “fraud recovery specialist,” a law firm that specializes in cryptocurrency recovery, or a government-affiliated “victim assistance” service claims it can recover the lost funds for an upfront fee. The fee ranges from a few hundred dollars to tens of thousands.
The fee is the fraud. There is no recovery service. There is no recovered money. The attacker has either bought a list of prior fraud victims from a criminal marketplace, or is the operation that defrauded the victim in the first place. Either way, it is running a second round against the same person.
The FTC has brought enforcement actions against multiple recovery scam operations. The FBI IC3’s annual report warns that online “cryptocurrency recovery services” are predominantly fraudulent. The tell: any legitimate attorney or forensic firm working on fraud recovery operates on contingency or charges verifiable court-filing fees. They do not demand large upfront fees before doing any work. For more, see the guide to recovery scams.
If you lost money to fraud, the legitimate path is to file with the FBI IC3 (ic3.gov), file with the FTC (reportfraud.ftc.gov), and contact your bank immediately. If the fraud involved crypto, consult a forensic blockchain analytics firm like Chainalysis or CipherTrace. Verify their credentials independently before paying anything.
Marketplace and Rental Fraud
On consumer marketplace platforms, fraud runs in both directions. This includes Facebook Marketplace, Craigslist, Gumtree, OLX, and rental listing sites. Buyers hit fake listings that collect a deposit or full payment and deliver nothing. Sellers hit fake payment confirmations.
Fake rental listings are especially costly. A scammer posts photos of a real property, copied from a real listing or Google Street View. They set a below-market rent to create urgency. Then they ask for a security deposit and first month by wire or Venmo, before a “viewing” that never happens. The FBI IC3 logged over 11,000 rental fraud complaints in 2023, with $350 million in losses. The check: never pay a security deposit without a signed lease on letterhead, confirmed by a call to a phone number you sourced yourself, not the one in the listing.
For sellers, the dominant pattern is fake payment screenshots. These are fabricated Venmo, Zelle, or bank-transfer confirmation images, convincing enough to make you hand over goods before you check your account. Zelle has become a significant fraud vector on Facebook Marketplace. Zelle transactions are not reversible once completed, and Facebook provides no buyer protection for Marketplace deals. The rule: verify funds in your own account before releasing any goods, and never trust a screenshot of a payment confirmation.
Deepfake-Assisted Fraud
In February 2024, a finance employee at a multinational company in Hong Kong was convinced to transfer HK$200 million, about $25 million USD. The employee did so after joining a video conference in which every other participant was a deepfake. They had initial doubts about the request. Then they saw what looked like the familiar faces of company executives on the call. Hong Kong police confirmed the case and the loss amount.
That case showed deepfake fraud had moved from theoretical to operational at scale. It is no longer limited to low-quality face-swapped images. Real-time video deepfakes, built from publicly available footage of the target, can impersonate faces well enough to defeat a casual look. Voice cloning from as little as three seconds of audio has been commercially available since 2023. It now shows up in vishing calls impersonating family members and executives. For more, see the guides to deepfake video verification and AI voice-cloning scams.
The defense is out-of-band verification. For any large or unusual financial transaction, confirm the request by calling back on a phone number already on file before you execute it. Do this no matter how convincing the person on the call appears. It is the same call-back policy that defeats BEC. The addition for deepfakes: agree on a shared code word or passphrase with family and close colleagues that is not in any public record. Use it to authenticate real-time requests when the stakes are high.
How to report fraud and what recovery actually looks like
United States. File with the FBI IC3 at ic3.gov. This opens federal investigations, and it’s required before federal law enforcement can act. File a parallel report with the FTC at reportfraud.ftc.gov. These reports feed enforcement actions and consumer-protection rulemaking. For bank-related issues, file with the CFPB at consumerfinance.gov/complaint. Report to your state attorney general if the fraud is regionally specific.
United Kingdom. Report to Action Fraud at actionfraud.police.uk. Bank-related Authorised Push Payment (APP) fraud is where you were deceived into authorizing a transfer yourself. UK banks are subject to mandatory reimbursement rules under the Payment Systems Regulator framework. The rules took effect in October 2024 and cover losses up to £85,000. If your bank denies your APP fraud claim, escalate to the Financial Ombudsman Service.
India. File at cybercrime.gov.in (the National Cyber Crime Reporting Portal) or call the 1930 helpline. Calls within the first hour of a fraud give the best chance of freezing the transaction before funds move offshore. File an FIR with your local police cyber crime cell. For bank-related fraud, the RBI’s Banking Ombudsman Scheme covers unauthorized transactions, and the mandatory reporting timeline is within three days of discovery.
Recovery prospects vary sharply by payment method. Card transactions carry the strongest recovery mechanism through chargeback. Card-network rules allow reversal for fraudulent transactions, and disputes filed within 60 to 120 days usually succeed. Bank wire transfers are harder. Regulation E in the US covers unauthorized electronic transfers. But “authorized” transactions, where you were deceived into sending money yourself, are being contested in court, and banks vary in their willingness to reimburse. The UK’s mandatory APP reimbursement rules (effective October 2024) are a significant consumer-protection advance. Zelle, Venmo, and Cash App transactions are the most difficult. These platforms treat transactions you initiated as authorized regardless of fraud, and reversal rates stay low despite regulatory pressure. Cryptocurrency is almost never recovered without specialist forensic tracing firms. Even with tracing, recovery requires a jurisdiction with legal authority over the exchange and a receivable asset. That is rarely achievable quickly enough to matter.
If you’ve been defrauded through any of these channels, report immediately, whether or not you believe recovery is possible. Reports feed intelligence that leads to enforcement actions. They create official records that some bank reimbursement processes require. In aggregate, they can also identify patterns that stop the same fraud operation from targeting someone else.
KnytX Scam Shield screens incoming calls, links, and contacts against known fraud patterns → It isn’t live yet; join the waitlist to get in early.