Internet fraud is any scheme that uses email, websites, apps, texts, or other digital channels to steal money or personal information, and it cost Americans $16.6 billion in 2024, a 33 percent jump over the prior year.1Internet Crime Complaint Center (IC3). 2024 IC3 Annual Report Federal law treats most of it as wire fraud or computer fraud, with prison terms reaching 20 or 30 years and mandatory restitution to victims. How much of your money you can recover often depends on what you do in the first 48 hours.
The Forms It Most Often Takes
Phishing and Smishing
Phishing emails impersonate banks, government agencies, or companies you already use. The message manufactures urgency — a locked account, a suspicious charge, a missed delivery — and pushes you toward a link that steals credentials or installs malware. Spoofed sender addresses and lookalike websites defeat a quick glance. Smishing runs the same play by text message, and because people trust texts more than email, those campaigns have grown fast. Generative AI now lets scammers produce endless slight variations, which makes spam filters less effective.
Business Email Compromise
Scammers hack or spoof an executive’s email and send instructions to reroute a wire transfer or update a vendor’s bank details. The request looks like it came from someone with authority, so the employee processing payment often does not question it. By the time accounting catches the discrepancy, the money has moved through several accounts.
Ransomware
Ransomware encrypts your files and demands payment, usually in cryptocurrency, for the decryption key. Paying does not guarantee you get your data back, and it funds the next attack. Hospitals, businesses, and local governments draw frequent attacks because downtime pressures them to pay quickly.
Investment and Crypto Platform Scams
Fake trading platforms show fabricated gains until you try to withdraw. At that point the site demands “taxes” or “fees” before releasing funds, or it vanishes. Cryptocurrency compounds the problem because transfers are often irreversible and harder to trace than bank wires.
Romance Scams and AI Voice Cloning
Romance scams build emotional trust through a fake dating or social media profile over weeks or months, then introduce a fabricated emergency that requires money. A newer variant uses AI voice cloning: a scammer pulls a few seconds of audio from a social media video, generates a convincing clip of a family member in distress, and calls asking for help. If you get an urgent call like that, hang up and call the person back on a number you already have.
Federal Laws and Penalties
Wire Fraud
Most internet fraud is prosecuted under the federal wire fraud statute, 18 U.S.C. § 1343, which covers any scheme to defraud using electronic communications across state or international lines. A conviction carries up to 20 years in federal prison.2Office of the Law Revision Counsel. 18 USC 1343 – Fraud by Wire, Radio, or Television The general federal fines statute caps individual fines at $250,000 per felony count.3Office of the Law Revision Counsel. 18 US Code 3571 – Sentence of Fine If the fraud affects a financial institution, the prison maximum rises to 30 years and the fine ceiling to $1 million.
The Computer Fraud and Abuse Act
The Computer Fraud and Abuse Act, 18 U.S.C. § 1030, covers unauthorized access to computers and networks: hacking databases, deploying malware, or stealing protected data. Unauthorized access for financial gain or to further another crime carries up to 5 years for a first offense and up to 10 for a repeat. Knowingly transmitting malware that damages a protected computer carries the same tiers. Fines apply on top of prison time.4Office of the Law Revision Counsel. 18 US Code 1030 – Fraud and Related Activity in Connection With Computers The FBI is the lead federal investigator and has jurisdiction regardless of where the offender’s hardware sits.5Federal Bureau of Investigation. Cyber
Statute of Limitations
Prosecutors generally have five years from the date of the offense to bring wire fraud or computer fraud charges.6Office of the Law Revision Counsel. 18 US Code 3282 – Offenses Not Capital That window extends to ten years when wire fraud affects a financial institution.7Office of the Law Revision Counsel. 18 USC 3293 – Financial Institution Offenses Complex fraud investigations often take years, so reporting promptly gives law enforcement the most time to build a case.
Mandatory Restitution
When a defendant is convicted of wire fraud, computer fraud, or another financial deception offense, the judge is required to order restitution to identified victims. Orders can cover the stolen amount, lost income, and expenses the victim incurred during the investigation or prosecution. Two narrow exceptions apply: when the number of victims makes individual restitution impractical, or when calculating each loss would unreasonably delay sentencing.8Office of the Law Revision Counsel. 18 US Code 3663A – Mandatory Restitution to Victims of Certain Crimes Restitution is separate from any fine, and it goes to the victim rather than the government.
What You Are Liable For as a Victim
Unauthorized Electronic Bank Transfers
Federal law caps your liability for unauthorized electronic fund transfers based on how fast you notify your bank. Report within two business days of discovering the problem and your maximum liability is $50. Wait longer and exposure climbs to $500. Ignore an unauthorized transfer on a bank statement for more than 60 days after the statement was sent and you can be on the hook for everything stolen after that 60-day mark.9eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers Check statements and call the moment something looks wrong.
Unauthorized Credit Card Charges
Credit cards carry stronger protection. Under the Fair Credit Billing Act, your maximum liability for unauthorized charges is $50, and most issuers waive even that. The cap applies whether the thief used a physical card or just the number online. Dispute the charge promptly once it appears on your statement.
Credit Freezes
If your personal information was exposed, place a credit freeze with Equifax, Experian, and TransUnion to block anyone from opening new accounts in your name. Freezes are free to place and lift, and they do not affect your credit score.10Federal Trade Commission. Credit Freezes and Fraud Alerts A freeze does not stop misuse of existing accounts, but it shuts down the most damaging form of identity theft: new loans and cards you only discover when collections calls start.
What To Do in the First Hours
Speed matters more here than almost anywhere else in the legal system. Every hour gives a scammer more time to move money beyond reach.
- Call your bank or card issuer and request a freeze or reversal. For electronic transfers, the two-business-day window that caps liability at $50 starts when you learn of the unauthorized activity, not when the transfer happened.9eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
- Freeze your credit at Equifax, Experian, and TransUnion. Each bureau requires its own request.10Federal Trade Commission. Credit Freezes and Fraud Alerts
- Change passwords and turn on multi-factor authentication, starting with email and banking. A password manager keeps you from recycling credentials across sites.
- Preserve evidence: full email headers (which contain routing data and the sender’s IP), screenshots of fraudulent sites and profiles, transaction IDs, cryptocurrency wallet addresses, and dated records of every communication with the scammer. Investigators use this to trace funds and link complaints together.
Where to Report Internet Fraud
The FBI’s Internet Crime Complaint Center
IC3.gov is the central intake point for cyber-enabled fraud.11Internet Crime Complaint Center (IC3). Home Page When you submit, you will see an on-screen confirmation. Save or print it immediately. The IC3 does not email a copy, and you cannot access it again after leaving the page.12Internet Crime Complaint Center (IC3). Frequently Asked Questions Analysts review each complaint and route it to the right agency. You probably will not hear back directly, but your report feeds pattern analysis that builds larger cases, and the IC3’s Recovery Asset Team can sometimes intercept recent transfers before funds disappear.1Internet Crime Complaint Center (IC3). 2024 IC3 Annual Report
The Federal Trade Commission
File at ReportFraud.ftc.gov. Your report enters the Consumer Sentinel database, available to more than 2,800 law enforcement agencies. Unlike the IC3, the FTC emails you a report number and suggested next steps if you provide your address.13Federal Trade Commission. ReportFraud.ftc.gov – FAQ Filing with both IC3 and FTC is standard practice because they feed different databases and different investigative teams.
Local Police
A local police report may feel useless for an online crime, but many creditors and credit bureaus require one before they will remove fraudulent accounts or debts. Consumer reporting agencies will automatically block fraudulent accounts from your credit report only if you can provide a police report.14Office for Victims of Crime. Steps for Victims of Identity Theft or Fraud Ask for a copy or at least the report number.
IdentityTheft.gov for Stolen Identities
If someone used your personal information to open accounts or file taxes in your name, IdentityTheft.gov generates a personalized recovery plan, produces an FTC Identity Theft Report, and pre-fills dispute letters.15Federal Trade Commission. IdentityTheft.gov It is the most useful federal tool for identity theft specifically, as opposed to general fraud.
Deducting a Fraud Loss on Your Taxes
For tax years 2018 through 2025, the Tax Cuts and Jobs Act barred individuals from deducting personal theft losses unless the loss stemmed from a federally declared disaster, which shut most internet fraud victims out of a write-off.16Taxpayer Advocate Service. Allow the Limitation on Theft Loss Deductions in the Tax Cuts and Jobs Act to Expire That restriction was always set to expire after 2025, and for 2026 taxpayers can again claim an itemized deduction for personal casualty and theft losses not tied to a disaster.17Congressional Research Service. Expiring Provisions in the Tax Cuts and Jobs Act
Report the loss on IRS Form 4684 and attach it to your return.18IRS. Instructions for Form 4684 – Casualties and Thefts Identify the person or entity that defrauded you to the extent you know their name, address, or taxpayer ID, and deduct the loss in the year you discovered the theft. Losses from investment-related fraud, such as money placed in a fake trading platform, may qualify under the “transaction entered into for profit” category, which remained deductible even during the TCJA restriction period. You can only deduct what insurance or restitution does not reimburse.