2 2017 Internet Crime Report 2017 INTERNET CRIME REPORT Table of Contents Introduction . 3 About the Internet Crime Complaint Center . 4 IC3 History . 4 The IC3 Role in Combating Cyber Crime . 5 Collection . 5 Analysis . 6 Public Awareness . 6 Referrals . 6 Supporting Law Enforcement . 7 IC3 Database Remote Access . 7 Successes . 7 Operation Wellspring (OWS) Initiative . 9 Hot Topics for 2017 . 12 Business Email Compromise (BEC) . 12 Ransomware . 13 Tech Support Fraud . 14 Elder Justice Initiative. 15 Extortion.16 2017 Overall Statistics . 17 2017 Victims by Age Group . 17 Top 20 Foreign Countries by Victim . 18 Top 10 States by Number of Victims . 19 Top 10 States by Victim Loss . 19 2017 Crime Types . 20 2017 Overall State Statistics . 22 Appendix A: Crime Type Definitions . 26 3 Internet Crime Complaint Center Introduction Dear Reader, 2017 was a milestone year for the FBIs Internet Crime Complaint Center (IC3). On October 12, 2017, at 4:10pm, the IC3 received its 4 millionth consumer internet crime complaint. As the lead federal agency for investigating cyber-attacks by criminals, overseas adversaries, and terrorists, the FBIs IC3 provides the public with a trustworthy and convenient reporting mechanism to submit information concerning suspected Internet- facilitated criminal activity. The IC3 also strengthens the FBIs partnerships with our law enforcement and private industry partners. As cyber criminals become more sophisticated in their efforts to target victims, we must continue to transform and develop in order to address the persistent and evolving cyber threats we face. The 2017 Internet Crime Report emphasizes the IC3s efforts in monitoring trending scams such as Business Email Compromise (BEC), Ransomware, Tech Support Fraud, and Extortion. The report also highlights the Elder Justice Initiative promoting justice for the nations seniors. In 2017, IC3 received a total of 301,580 complaints with reported losses exceeding $1.4 Billion. This past year, the most prevalent crime types reported by victims were Non-Payment/Non- Delivery, Personal Data Breach, and Phishing. The top three crime types with the highest reported loss were BEC, Confidence/Romance fraud, and Non-Payment/Non-Delivery. This years report features success stories from two different successful cases initiated from IC3 complaints. Additionally, the Operation Wellspring (OWS) Initiative continues to build the cyber investigative capability by utilizing Cyber Task Force officers, thus strengthening state and local law enforcement collaboration. We hope this report provides additional information of value as we work together to protect our nation against cyber threats. Scott S. Smith Assistant Director Cyber Division Federal Bureau of Investigation 4 2017 Internet Crime Report About the Internet Crime Complaint Center The mission of the FBI is to protect the American people and uphold the Constitution of the United States. The mission of the IC3 is to provide the public with a reliable and convenient reporting mechanism to submit information to the FBI concerning suspected Internet-facilitated criminal activity, and to develop effective alliances with industry partners. Information is analyzed and disseminated for investigative and intelligence purposes, for law enforcement, and for public awareness. In an effort to promote public awareness, the IC3 produces this annual report to aggregate and highlight the data provided by the general public. The quality of the data is directly attributable to the information ingested via the public interface ic3.gov. The IC3 attempts to standardize the data by categorizing each complaint based on the information provided. The IC3 staff analyzes the data to identify trends in Internet-facilitated crimes and what those trends may represent in the coming year. IC3 History In May 2000, the IC3 was established as a center to receive complaints of Internet crime. There have been 4,063,933 complaints reported to the IC3 since its inception. Over the last five years, the IC3 has received an average of more than 284,000 complaints per year. The complaints address a wide array of Internet scams affecting victims across the globe. 11Accessibility description: Image includes yearly and aggregate data for complaints and losses over the years 2013 to 2017. Over that time period, IC3 received a total of 1,420,555 complaints, and a total reported loss of $5.52 billion. 5 Internet Crime Complaint Center The IC3 Role in Combating Cyber Crime 2WHAT WE DO Central Hub to Alert the Public Partner with Private Sector and with Local, State, Federal, and International Agencies Host Remote Access Database for all Law Enforcement via the FBIs LEEP 3website Victims Report Internet Crime via Increase Victim Reporting via Outreach ic3.gov Collection Victims are encouraged and often directed by law enforcement to file a complaint online at ic3.gov. Complainants are asked to document accurate and complete information related to the Internet crime, as well as any other relevant information necessary to support the complaint. In addition to reporting the crime via ic3.gov, complainants should take steps to mitigate further loss. Victims can take actions such as contacting banks, credit card companies, and/or credit bureaus to block accounts, freeze accounts, dispute charges, or attempt recovery of lost funds. Victims should be diligent in reviewing credit reports to dispute any unauthorized transactions and should also consider credit monitoring services. 2Accessibility description - image depicts what IC3 does to include providing a central hub to alert the public: partner with private sector and with local, state, federal, and international agencies; host a remote access database for all law enforcement via the FBIs LEEP website; victim reporting at ic3.gov; and increase victim reporting via outreach. 3Federal Bureau of Investigation. Law Enforcement Enterprise Portal (LEEP) 6 2017 Internet Crime Report Analysis The IC3 is the central point for Internet crime victims to report and alert the appropriate agencies to suspected criminal Internet activity. The IC3 reviews and analyzes data submitted through its website, and produces intelligence products to highlight emerging threats and new trends. Public Awareness Public service announcements (PSAs), scam alerts, and other publications outlining specific scams are posted to the ic3.gov website. As more people become aware of Internet crimes and the methods utilized to carry them out, potential victims are equipped with a broader understanding of the dangers associated with Internet activity and are in a better position to avoid falling prey to schemes online. Analysis Public Awarness Referrals CollectionIC3 Core Functions 4Referrals The IC3 aggregates related complaints to build referrals, which are forwarded to local, state, federal, and international law enforcement agencies for potential investigation. If law enforcement conducts an investigation and determines a crime has been committed, legal action may be brought against the perpetrator. 4Accessibility description: image contains the IC3 logo against a digital background. Core functions are listed in individual blocks- Collection, Analysis, Public Awareness, and Referrals as components of an ongoing process. 7 Internet Crime Complaint Center Supporting Law Enforcement IC3 Database Remote Access All sworn law enforcement can remotely access and search the IC3 database through the FBIs Law Enforcement Enterprise Portal (LEEP). LEEP is a gateway providing law enforcement agencies, intelligence groups, and criminal justice entities access to beneficial resources all in one centralized location. These resources can be used to strengthen case development for investigators and enhance information sharing between agencies. This web-based access additionally provides users the ability to identify and aggregate victims and losses within a jurisdiction. The IC3 expanded the remote search capabilities of the IC3 database by allowing users to gather IC3 complaint statistics. Users now have the ability to run city, state, county, and country reports and sort by crime type, age, and transactional information. The user can also run overall crime type reports and sort by city, state, and country. The report results can be returned as a portable document format (PDF) or exported to Excel. This search capability allows users to better understand the scope of cyber crime in their area of jurisdiction and enhance cases. Successes International Investment Scam: FBI Houston Beginning in 2015, the IC3 provided multiple complaints to FBI Houston regarding an elaborate investment scheme. The scheme involved the impersonation of Branch Banking & Trust (BB&T) and JPMorgan Chase (Chase) executives, the fabrication of U.S. government documents, the creation of fraudulent investment agreements in the name of BB&T and Chase, and the purchase of luxury vehicles to launder the proceeds of the scheme. It was perpetrated by individuals primarily living in West Africa, who impersonated U.S. bank officials and financial consultants, and made fraudulent offers of investment funding to victims all over the world via the Internet and phone. Victims were deceived into believing they would receive millions of dollars of investment funding as part of joint ventures with U.S. banks, usually BB&T or Chase. The perpetrators utilized false domain names to make it appear their emails were affiliated with BB&T or Chase. To convince victims the opportunities were authentic, the perpetrators recruited U.S. citizens to pose as bank “representatives” at in-person meetings with the victims. If the victims lived outside the U.S., the perpetrators orchestrated bogus visits to the local U.S. embassy or consulate and fabricated U.S. government documents to convince the victims the U.S. government was sponsoring the investment agreements. The victims were then induced to pay tens of thousands, and often hundreds of thousands, of dollars to U.S.-based bank accounts on the belief that such payments were necessary to effectuate their investment agreements. 8 2017 Internet Crime Report Once the funds hit the U.S.-based accounts, money movers controlling the accounts used various means to liquidate the proceeds and move the funds to West Africa, including outgoing wire transfers to exporters, cash withdrawals, and the purchase of luxury vehicles which were shipped to West Africa. The scheme allegedly resulted in losses of more than $7 million from victims in more than 20 countries. To date, a house in Richmond, vehicles and approximately $200,000 in cash, all directly traceable to victims payments, have been seized 5 . Harassment/Extortion: FBI Los Angeles Since October 2017, FBI Los Angeles has been investigating a reported intrusion of a companys network that also involved harassment and extortion by an unknown subject. This individual continuously harassed the company with emails and phone calls that greatly impacted the victim companys business. The harassment continued until the company agreed to make payments for the attacks to stop. The case was initiated by an IC3 complaint sent to FBI Los Angeles. During the course of the investigation, IC3 linked another complaint to the victim company and provided that information to FBI Los Angeles as well. The information contained within the linked IC3 complaint was instrumental in providing probable cause for a search warrant and then used in the interview of a subject, which ultimately led to a full confession. 5 International Investment Scam Details 9 Internet Crime Complaint Center Operation Wellspring (OWS) Initiative Operation Wellspring builds the cyber investigative capability and capacity of the state and local law enforcement community. Through close collaboration with FBI field offices, IC3 helps state and local law enforcement partners identify and respond to malicious cyber activity. Key Components Serves as a national platform to receive, develop, and refer Internet-facilitated fraud complaints. Coordinates with FBI Cyber and Criminal components.