The most-cited account takeover fraud statistics for 2025 come from the FBI: more than 5,100 complaints and over $262 million in losses reported between January and late November 2025, and, in its annual report published in April 2026, about 4,700 complaints and $359.7 million for the year. Beneath those sit FinCEN's analysis of suspicious activity reports, where 18% of identity-related filings describe compromised credentials, and a federal survey finding that about 2.8% of Americans aged 16 or older had an existing bank account misused in a year. None of these is a complete count of account takeover: each counts complaints, filings or survey answers, and most takeovers are never reported to anyone outside the bank. For a fraud team the numbers explain why the problem matters; the bank's own cases, counted by where each takeover began, are what tell it which control to fix. That is the count Botminds' Account Takeover Fraud Prevention keeps for every confirmed case.
Every public figure below is linked to its source. The few product figures are sample data from a fictional bank, Corvane National Bank, and are labelled as such.
Account takeover fraud statistics for 2025 and the latest years available: what each number measures, and who measured it
5,100+ complaints · $262M+
What it countsComplaints to the FBI reporting account takeover, January 2025 to the warning's date, in a warning about criminals impersonating bank support
Who measured itFBI IC3, public service announcement, 25 Nov 2025
Kind of dataSelf-reported complaints
~4,700 complaints · $359.7M
What it countsAccount takeover complaints and losses for 2025, in the annual report's fraud trends
Who measured itFBI IC3, 2025 Annual Report, April 2026
Kind of dataSelf-reported complaints
18% · ~446,000 reports
What it countsIdentity-related suspicious activity reports describing compromised credentials used to get into legitimate customers' accounts
Who measured itFinCEN, Financial Trend Analysis, 2021 data, published Jan 2024
Kind of dataBank and other filings
32% · $112B
What it countsShare and amount of identity-related suspicious activity in those compromised-credential reports
Who measured itFinCEN, same analysis
Kind of dataReported amounts, may include attempts
2.8% · ~7.4M people
What it countsPeople aged 16 or older whose existing bank account was misused in the past year
Who measured itBureau of Justice Statistics, 2021 survey, published Oct 2023
Kind of dataNational household survey
50 or more transfers
What it countsHow many ACH transactions to different banks one takeover incident can contain
Who measured itFBI IC3 Recovery Asset Team, 2025
Kind of dataIncidents worked by the FBI
12% (ACH) · 14% (wire)
What it countsFinancial institutions reporting account takeover increasing in that channel
Who measured itFederal Reserve Financial Services risk officer survey, Q4 2025
Kind of dataSurvey of 403 institutions, ±6%
How common is account takeover fraud? About 7.4 million people in one year, by the government's survey
The best government measure of how many people are affected is the Bureau of Justice Statistics' identity theft survey: in 2021, about 7.4 million people aged 16 or older, 2.8% of that population, had an existing bank account misused in the previous 12 months (BJS, Victims of Identity Theft, 2021, appendix table 1). It is a household survey of completed incidents, so it counts victims whether or not they told a bank or the police.
Two cautions keep the figure honest. The survey counts any completed unauthorized use of an existing bank account that the victim reports, whatever the method, so it covers more than hijacked online banking; it is an upper bound on takeover in the online-banking sense. And it is the latest edition: the survey was redesigned for 2021, and BJS says the results are not comparable with earlier years, so it cannot show a trend. The same survey's comparison with new-account fraud is set out in the guide to account takeover fraud vs identity theft.
How much is lost to account takeover? Two FBI figures for 2025, and why they differ
The FBI published two figures for account takeover losses in 2025, and they do not match. Its public service announcement of 25 November 2025 said: "Since January 2025, the FBI Internet Crime Complaint Center (IC3) received more than 5,100 complaints reporting ATO fraud, with losses exceeding $262 million" (FBI IC3, I-112525-PSA). Its 2025 annual report, published in April 2026, lists account takeover among its cyber-enabled fraud trends at "Approximately 4,700 complaints" and "$359.7 million in losses" (FBI IC3, 2025 Annual Report).
The annual report explains why such figures move. Its notes on the data say descriptive data such as crime type and loss "is variable and can evolve based upon investigative or analytical proceedings", that "Statistics are an assessment taken at a point in time, which may change", and that "Each complaint will only have one crime type." A complaint about a takeover that began with a tech-support call or a phishing text can be classified under either, and losses grow as victims add amounts after filing. The safe way to cite them is with their dates and the word "reported", and never to add them together.
Both are a small slice of the whole. The same annual report counted 1,008,597 complaints and $20.877 billion in reported losses across all cyber-enabled crime in 2025. People who are reimbursed by their bank under Regulation E have little reason to file with the FBI at all, which is one reason complaint data understate takeover losses borne by banks; who carries those losses is set out in the guide to Reg E and account takeover.
What percent of fraud is account takeover? What suspicious activity reports show
The closest thing to a share comes from FinCEN's analysis of identity-related suspicious activity reports. Of about 1.6 million identity-related reports filed in 2021, "Eighteen percent of identity-related BSA reports (approximately 446,000 filings) describe attackers using compromised credentials to gain unauthorized access to legitimate customers' accounts" (FinCEN, Identity-Related Suspicious Activity: 2021 Threats and Trends).
Which identity failure the 2021 suspicious activity reports describe
The compromised-credential reports are fewer but larger. FinCEN wrote that "Compromises are disproportionally costly as they accounted for 32% of the total suspicious activity amount or $112 billion." Read that with FinCEN's own caution: reported amounts can include attempted transactions and can count the same money in more than one filing. The point is relative, not absolute: when credentials are compromised, the sums involved are larger than the report count suggests.
Is account takeover increasing? What 403 risk officers reported for 2025
The most recent read on direction comes from the Federal Reserve Financial Services survey of 403 financial institutions, fielded in the fourth quarter of 2025. It found "a 7% increase in financial institutions reporting that an unauthorized party took over the account", and described "a notable rise in account takeover activity as criminals exploit stolen or compromised credentials" (FRFS, 2026 Risk Officer Report).
How risk officers described account takeover in ACH and wire, fourth quarter 2025
ACH
- Never or not applicable · 28%
- Declining · 23%
- Persistent · 38%
- Increasing · 12%
Wire
- Never or not applicable · 33%
- Declining · 24%
- Persistent · 29%
- Increasing · 14%
The split is the honest picture: for most institutions takeover is a persistent problem rather than a surging one, and for a minority it is getting worse. Respondents were more alarmed by scams in which the account holder is deceived; 41% said those were increasing in ACH. Takeover and scams also overlap: a customer talked out of a one-time code by a caller posing as the bank is a takeover victim, even though the conversation looked like a scam.
Where the money goes: 50 or more transfers at once
Takeover money moves fast and wide. The FBI's Recovery Asset Team, which works with banks to freeze funds through its Financial Fraud Kill Chain, reported that in 2025 it "saw a rise in Tech Support and Account Takeover (ATO) initiations", and that a single takeover can now send 50 or more ACH payments at once, to different recipient accounts at several banks (FBI IC3, 2025 Annual Report).
That pattern changes what detection has to do. A single fraudulent wire is one decision; fifty ACH credits to fifty receiving banks is one decision before the batch and fifty recall requests after it. The FBI's November 2025 warning described the other common route: wires sent quickly to accounts the criminals control, many tied to cryptocurrency wallets, which makes the money hard to trace. In both, the time to act is before settlement; after it, recovery depends on how fast other banks respond.
Older customers: takeover inside elder scams
Account takeover is the typology banks most often describe when they report scams against older customers. FinCEN's analysis of 155,415 elder financial exploitation reports filed between June 2022 and June 2023 found that "The majority of elder scam-related filings also referenced account takeover activity" (FinCEN, Elder Financial Exploitation FTA, 2024). Banks typically reported unauthorized transactions out of the customer's account, followed by closing the account or issuing new credentials or cards.
The FBI's 2025 figures point the same way. Of the 642 Kill Chain incidents involving victims aged 60 or older, the most common type was "Tech Support/ATO scams", with 360 incidents. Across all 642, reported losses were $65.4 million, of which the FBI helped freeze $32.9 million. For a fraud team, older customers are not a separate problem from takeover: they are where impersonation calls most often end in a hijacked account.
Account takeover trends in 2025: impersonating bank support, poisoned search ads and lockouts
The FBI's November 2025 warning describes three tactics that define the year. First, impersonation: criminals posing as bank staff or support personnel to obtain credentials and one-time codes, in some cases telling the customer their information was used to buy firearms and handing them to a second criminal posing as law enforcement. Second, search engine optimisation poisoning, in which criminals buy ads "that imitate legitimate business ads" so that a customer searching for their bank lands on a phishing page. Third, lockout: "In some cases, including nearly all social engineering cases, the cyber criminals change the online account password, locking the owner out of their own financial account(s)."
Lockout is the trend with the clearest lesson for banks. A customer who cannot log in may call to report it, and that call is the earliest notice the bank will get. It is also the moment a criminal may be on the phone to the same contact center asking for a reset. How the reset desk tells the two apart is the subject of the guide to contact center fraud prevention.
Figures to treat with care before you quote them
Many account takeover statistics in circulation come from vendors' own surveys and are not reproduced here. Some figures that look official also need tracing. The table shows four common problems and how to handle each.
Account takeover figures that need tracing, and what stands behind them
| Claim you may see | What stands behind it | How to use it |
|---|---|---|
| Deepfake attacks up twentyfold in three years | Said in an April 2025 speech by a Federal Reserve Governor; the speech's own footnote cites a vendor's press release reporting a 2,137% rise | Not as a statistic: the underlying count is a vendor's, not a government measure |
| A single annual total of takeover losses | Usually a vendor survey extrapolated to the population, with its method in a paid report | Prefer the FBI's complaint figures, labelled as reported complaints |
| FBI complaint counts as the number of takeovers | Complaints filed with IC3; one crime type per complaint; many victims never file | As a floor, with the date and the word "reported" |
| FinCEN amounts as losses | Suspicious activity amounts, which can include attempts and the same money in several filings | As a measure of scale relative to other typologies, not of losses |
What a bank can count for itself with Account Takeover Fraud Prevention: entry points and outcomes
The numbers that change a bank's controls are its own. Three counts matter most: where each confirmed takeover began, how many were stopped before money left, and which control failed first. The Federal Reserve's FraudClassifier model gives a shared vocabulary for the first: its "Unauthorized Party Took Over Account" branch separates takeovers via compromised credentials from those where the criminal impersonated the account holder, for example through a call center (FedPayments Improvement, FraudClassifier).
Account Takeover Fraud Prevention keeps those counts for every case. In the fictional sample bank's 90 days, 452 takeovers were confirmed: 185 began with a phone reset on knowledge questions, 149 with a phished password and passcode, 63 with a mobile number port, 36 with password guessing and 19 otherwise. In its week of 12 to 18 October, 33 of 35 confirmed takeovers were stopped before money left. The SIM-swap share is the subject of the guide to SIM swap fraud prevention.
A bank's own takeover statistics in Account Takeover Fraud Prevention: where each began, how many were stopped
Counts like these are also what a supervisor will ask for. The FFIEC's 2021 guidance notes that data from actual fraud events can show which authentication controls are "ineffective or degraded", and a bank that can say which share of its takeovers began at the reset desk has the first line of its next risk assessment. To see your own past cases counted this way, start from Account Takeover Fraud Prevention.
Questions people ask
What are the FBI statistics on account takeover?
The FBI's November 2025 warning reported more than 5,100 account takeover complaints and over $262 million in losses since January 2025. Its 2025 annual report, published in April 2026, gives about 4,700 complaints and $359.7 million for the year. Both are self-reported complaints to IC3 and should be cited with their dates, not combined.
How many people have had a bank account taken over?
The Bureau of Justice Statistics found that about 7.4 million people aged 16 or older, 2.8%, had an existing bank account misused in the 12 months before their 2021 interview. The survey counts any completed misuse of an existing bank account, not only online banking takeover, so it overstates takeover in the narrow sense.
Is SIM swapping still a big part of account takeover?
Complaints to the FBI about SIM swapping have fallen: 1,611 complaints and more than $68 million in 2021, against 971 complaints and about $17.4 million in 2025. Complaint counts are only a floor, and in the fictional sample bank 14% of confirmed takeovers began with a number port, so it remains a channel worth controlling.
Are account takeover statistics for 2026 available?
Not yet in government data. The FBI publishes annual figures in the spring of the following year, FinCEN's trend analyses lag their data by two years or more, and the Bureau of Justice Statistics' latest identity theft survey covers 2021. Until they appear, a bank's own confirmed cases are the most current numbers it has.
What share of takeovers start with phishing?
No government source publishes a national share by entry point. FinCEN's 2021 data show compromised credentials described in 18% of identity-related reports, and the FBI's 2025 warning describes phishing websites and texts as common routes. In the fictional sample bank, a third of confirmed takeovers began with a phished password and passcode.