For 25 years, the FBI's Internet Crime Complaint Center has tracked online fraud without singling out AI as a cause. That changed with the 2025 annual report, which added AI as its own category and counted 22,364 complaints and close to 893 million dollars in losses.
The agency itself says this is a floor, not a ceiling. The count only includes cases where a victim recognized AI was involved, which for something like a cloned voice or a fluent phishing email is often impossible to spot after the fact. Investment scams made up 632 million dollars of the total, and people over 60 accounted for 352 million dollars of it.
Deloitte's Center for Financial Services has been modeling this trend since 2024 and expects it to get much worse. The firm projects AI linked fraud losses in the US could reach 40 billion dollars a year by 2027, up from about 12 billion dollars in 2023.
What changed is not the con, it is the cost of running it. Cloning a voice used to require real effort. Now it takes a few seconds of audio from a social media video and a cheap app.
In one study, listeners could only tell a cloned voice from a real one about six times out of ten.
Video is catching up fast. In early 2024, an employee at the engineering firm Arup wired 25.6 million dollars after joining a video call where the CFO and several colleagues were all deepfakes, built from footage of real meetings and conference calls.
The employee had been suspicious of an email first. The video call is what removed the doubt.
None of this requires talking to a victim at all. Anthropic, the company behind the Claude AI model, shut down a campaign this year where a hacking group it believes was linked to the Chinese government used its AI to carry out 80 to 90 percent of an intrusion attempt across roughly 30 targets, including financial institutions, largely on its own.
Once a scammer is inside an account, instant payment apps make the money nearly impossible to get back, since transfers clear in minutes rather than days.
Simple defenses still work well against most of this. Hang up and call a number you already trust instead of one a caller gives you. Agree on a family code word for emergencies.
Require two signatures on large transfers and build in a short delay before sending money. None of this requires technical skill, just a household habit that outlasts a moment of panic.
The bigger question is who absorbs the loss when prevention fails, and the US and UK have taken opposite paths. Since October 2024, UK banks have had to reimburse most scam victims up to 85,000 pounds, split evenly between the sending and receiving institution. The regulator's own dashboard shows 88 percent of eligible losses have been returned to victims, and an independent review found the rule change itself reduced fraud, because banks now had a financial reason to build better detection.
In the US, the path has been messier. The Consumer Financial Protection Bureau sued Zelle's operator and three major banks over fraud handling in late 2024, then dropped the case the following March. New York's attorney general has since filed her own suit, which a judge has allowed to move forward, while Zelle's operator denies wrongdoing.
Until American rules catch up, the cost of a mistake sits almost entirely with whoever picks up the phone. That makes household habits, not bank policy, the only real protection most people have right now.