Cybercrime Reporting and Statistics in America

Cybercrime reporting and statistics in America encompass the data collection systems, measurement instruments, and analytical frameworks through which the extent, distribution, and trends of digitally mediated criminal activity are documented and communicated to policymakers, law enforcement agencies, and the public. Within Cyber Criminology, the measurement of cybercrime presents distinctive methodological challenges that have prevented the development of the reliable, population-based crime statistics that exist for traditional offense categories. No single data source provides a complete picture of cybercrime in the United States; instead, researchers and policymakers must triangulate across multiple systems — the FBI’s Internet Crime Complaint Center (IC3), the Bureau of Justice Statistics’ victimization surveys, the National Incident-Based Reporting System (NIBRS), and private sector data sources — each of which captures a different slice of the problem through different methodological lenses. This article examines the major cybercrime data sources in America, assesses their strengths and limitations, and considers the implications of measurement deficiencies for research and policy within the broader study of Criminology.

Introduction

Accurate measurement is a prerequisite for effective policy. Without reliable data on the prevalence, distribution, and trends of cybercrime, policymakers cannot allocate law enforcement resources rationally, researchers cannot test theoretical explanations of cybercrime, and the public cannot assess the severity of the threat or the effectiveness of governmental responses. The measurement challenge for cybercrime is more severe than for any traditional crime category, reflecting three intersecting problems: chronic underreporting by both individual and organizational victims, definitional inconsistency across data sources that classify the same conduct differently, and the rapid evolution of cybercrime methods that may render existing measurement categories obsolete before they can produce trend data.

The consequences of measurement failure are not abstract. When cybercrime is systematically undercounted, the criminal justice system underinvests in investigation and prosecution capacity. When certain offense types are measured while others are not, resource allocation is distorted toward the visible threats at the expense of the unmeasured ones. When trend data are unreliable, it becomes impossible to evaluate whether prevention programs, enforcement operations, or legislative reforms are producing their intended effects. The development of better cybercrime measurement is thus not merely a methodological concern but a practical necessity for every dimension of the criminal justice system’s response to digital crime.

Federal Data Collection Systems

The Internet Crime Complaint Center

The IC3, operated by the FBI since 2000, serves as the primary federal intake mechanism for cybercrime complaints from the public and provides the most detailed available data on the volume and distribution of reported cybercrime in the United States. The IC3 accepts complaints online from individuals and businesses who have experienced internet-facilitated criminal activity, collects information about the nature of the offense, the financial losses incurred, and the identity of the offender (when known), and refers complaints to appropriate law enforcement agencies for investigation. The IC3’s annual reports provide the most widely cited statistics on cybercrime in the United States, including total complaint volume, total reported losses, and breakdowns by offense type, victim age, and geographic distribution.

The IC3’s 2023 annual report documented over 880,000 complaints with reported losses exceeding $12.5 billion — figures that have increased substantially over the past decade, reflecting both genuine growth in cybercrime and increased public awareness of the IC3 as a reporting mechanism (Federal Bureau of Investigation, 2024). The report identified investment fraud ($4.57 billion), business email compromise ($2.9 billion), and tech support scams ($924 million) as the highest-loss offense categories, providing data that directly informs federal enforcement priorities.

However, IC3 data are subject to significant limitations that constrain their utility for measuring cybercrime prevalence. The IC3 relies on voluntary self-reporting by victims, producing data that reflect who reports rather than who is victimized. Complainants who are aware of the IC3, motivated to file a report, and capable of completing the online complaint form constitute a self-selected sample that is not representative of the broader victim population. Anderson, Barton, Böhme, Clayton, van Eeten, Levi, Moore, and Savage (2019) estimated that fewer than 15 percent of cybercrime victims report to any law enforcement agency, suggesting that IC3 data capture a small fraction of actual victimization. The demographic profile of IC3 complainants — disproportionately older, wealthier, and more educated than the general population — further limits the representativeness of the data.

The National Crime Victimization Survey and Identity Theft Supplement

The Bureau of Justice Statistics’ NCVS provides the most methodologically rigorous population-based crime victimization data in the United States, administered to approximately 240,000 individuals annually through in-person and telephone interviews. The NCVS was designed to measure interpersonal and property crime and includes limited cybercrime-related measures. The Identity Theft Supplement (ITS), administered periodically as an adjunct to the core NCVS, provides nationally representative estimates of identity theft victimization, documenting that approximately 23.9 million Americans experienced identity theft in 2021 (Harrell, 2023).

The ITS represents the gold standard for identity theft measurement: it employs probability sampling, standardized definitions, and validated survey instruments, producing estimates with known margins of error that support statistical inference to the national population. However, the supplement captures only identity theft and does not measure the full range of cybercrime victimization — phishing, malware infection, ransomware, online harassment, cyberstalking, and the many other forms of digital victimization are outside its scope. The absence of a population-based cybercrime victimization survey that captures the full range of offenses represents the most significant gap in America’s criminal justice data infrastructure.

NIBRS and Law Enforcement Reporting

The National Incident-Based Reporting System, which replaced the Uniform Crime Report (UCR) Summary Reporting System as the national standard for law enforcement crime reporting in 2021, collects detailed incident-level data from participating law enforcement agencies. NIBRS captures information about each criminal incident including offense type, victim and offender characteristics, property loss, and the circumstances of the offense. The system’s potential for cybercrime measurement lies in its capacity to record multiple offense types within a single incident and to capture computer-related elements through its “Type of Criminal Activity” and “Type of Weapon/Force” data fields.

In practice, NIBRS captures cybercrime incompletely. The system was designed for traditional crime categories and its offense classification structure does not include dedicated cybercrime offense types. Cyber-related offenses are classified under traditional categories — fraud, identity theft, extortion, stalking — with optional indicators of computer involvement that may or may not be recorded depending on the reporting agency’s training and data entry practices. The FBI has acknowledged the limitations of NIBRS for cybercrime measurement and has explored modifications to improve the capture of cyber-related incidents, but the fundamental structural challenge — adapting a crime reporting system designed for physical-world offenses to a digital crime landscape — remains unresolved.

Private Sector and International Data Sources

Industry Reports and Surveys

Private sector data sources provide complementary perspectives on cybercrime that fill gaps in governmental data, though they carry their own methodological limitations. The Verizon Data Breach Investigations Report (DBIR), published annually since 2008, provides the most detailed empirical analysis of organizational data breaches, classifying incidents by threat actor type, attack vector, data compromised, and organizational characteristics. The DBIR’s methodology — combining data contributed by dozens of organizations including cybersecurity firms, law enforcement agencies, and incident response teams — produces a large analytical dataset, though the contributing sample is not random and may oversample organizations with mature security programs.

The Ponemon Institute’s annual Cost of a Data Breach study, sponsored by IBM, provides cost estimates that are widely cited in policy and industry discussions. The Identity Theft Resource Center’s annual data breach report documents the volume of publicly disclosed breaches. The Anti-Phishing Working Group’s quarterly reports track phishing activity trends. Each of these sources contributes useful data but measures a different dimension of cybercrime through a different methodology, and none produces the population-based prevalence estimates that governmental statistical agencies aspire to provide.

The aggregation of private sector data sources can produce a richer picture of the cybercrime landscape than any single source, but the methodological heterogeneity across sources complicates synthesis. Definitions of “data breach,” “cybercrime incident,” and “financial loss” vary across industry reports, and the populations from which data are drawn differ in ways that prevent direct comparison. Researchers who cite statistics from multiple industry sources must attend carefully to these methodological differences to avoid aggregating figures that measure different things.

International Measurement Efforts

International cybercrime measurement efforts provide comparative context that can inform American policy. The UNODC has conducted multiple surveys of cybercrime legislation, enforcement capacity, and victimization across its member states, documenting the wide variation in how countries define, measure, and respond to cybercrime. Eurostat, the statistical office of the European Union, collects cybercrime victimization data through the EU Survey on Income and Living Conditions and through dedicated cybercrime modules, providing population-based estimates that the United States currently lacks for most cybercrime categories.

The international dimension of cybercrime measurement highlights the challenge of cross-national comparison. Differences in legal definitions, reporting practices, and cultural attitudes toward cybercrime reporting produce national statistics that may not be comparable even when they purport to measure the same phenomena. A phishing complaint rate of one per thousand population in Country A and five per thousand in Country B may reflect different victimization rates, different awareness of reporting mechanisms, different legal definitions of phishing, or some combination of all three. The development of internationally standardized cybercrime measurement instruments — a goal pursued by the UNODC and other international organizations — remains a work in progress.

The Dark Figure and Measurement Reform

Understanding Underreporting

The dark figure of cybercrime — the gap between actual and reported victimization — is recognized as the most significant obstacle to accurate measurement. Underreporting operates through multiple mechanisms that differ across victim types and offense categories. Individual victims may not recognize that they have been victimized (malware infections, data breaches), may not know where or how to report (confusion about IC3 versus local police versus FTC), may perceive reporting as futile (belief that nothing will be done), or may be deterred by shame or embarrassment (romance fraud, sextortion). Organizational victims face additional disincentives including reputational damage, regulatory scrutiny, litigation exposure, and the perception that law enforcement cannot provide meaningful assistance.

The magnitude of underreporting varies by offense type. Identity theft is relatively well-measured because victims eventually discover unauthorized charges or accounts and have practical incentives to report for fraud resolution purposes. Online harassment and cyberstalking are substantially underreported because many victims do not consider their experiences criminal or do not believe law enforcement will take action. Corporate data breaches were severely underreported before the enactment of mandatory breach notification laws, which have improved but not eliminated organizational underreporting. Ransomware attacks against private companies remain underreported because many organizations prefer to manage incidents privately rather than involve law enforcement.

The systematic character of underreporting means that available cybercrime statistics do not merely undercount the total but distort the distribution of cybercrime across offense types, victim demographics, and geographic areas. Offense types with higher reporting rates appear disproportionately prominent in the data, while underreported offenses are rendered invisible. Policy and resource allocation based on these distorted data may address visible problems while neglecting invisible ones, creating a feedback loop in which unmeasured cybercrime remains unmeasured because the absence of data prevents the recognition that measurement is needed.

Proposals for Improvement

The development of better cybercrime measurement has been the subject of sustained advocacy from researchers, the Government Accountability Office (GAO), and congressional oversight committees. The most frequently proposed reform is the creation of a dedicated national cybercrime victimization survey — analogous to the NCVS but designed specifically to capture the full range of cyber victimization. Such a survey would employ probability sampling, standardized definitions, and validated measurement instruments to produce population-based prevalence estimates with known statistical properties.

The Bureau of Justice Statistics has taken incremental steps toward expanded cybercrime measurement, including the periodic administration of the Identity Theft Supplement and the exploration of cybercrime-related questions for potential inclusion in the core NCVS. However, the development and fielding of a dedicated cybercrime victimization survey requires substantial investment in questionnaire development, cognitive testing, pilot fielding, and ongoing administration — resources that compete with other demands on the BJS budget. The GAO has recommended that the Department of Justice develop a coordinated strategy for cybercrime measurement that addresses the gaps across existing data systems, but progress toward implementation has been slow.

Improvements to existing data systems offer lower-cost alternatives that could produce meaningful gains in cybercrime measurement. Enhancements to NIBRS that improve the capture of cyber-related incidents, standardization of IC3 reporting categories to facilitate trend analysis, mandatory reporting requirements for additional categories of cybercrime (particularly ransomware), and the integration of private sector data into governmental statistical products could collectively improve the measurement landscape without the cost of a new survey instrument. The most productive approach likely combines incremental improvements to existing systems with the longer-term development of dedicated cybercrime measurement instruments.

Conclusion

The measurement of cybercrime in the United States remains fragmented, incomplete, and inadequate relative to the severity of the problem it seeks to document. The IC3 provides the most detailed data on reported cybercrime but captures only a fraction of actual victimization. The NCVS provides methodologically rigorous population-based estimates but only for identity theft. NIBRS captures law enforcement-recorded cybercrime but does so through categories designed for traditional offenses. Private sector data sources provide valuable supplementary information but lack the methodological rigor and population representativeness of governmental statistical products.

The consequences of measurement failure are practical and significant: without accurate data on the prevalence, distribution, and trends of cybercrime, the criminal justice system cannot allocate resources rationally, evaluate the effectiveness of its interventions, or communicate the severity of the problem to policymakers and the public. The development of better cybercrime measurement — through the creation of dedicated survey instruments, the improvement of existing data systems, and the integration of multiple data sources — represents one of the most important investments the American criminal justice system could make in its capacity to understand and respond to digital crime.

References

Anderson, R., Barton, C., Böhme, R., Clayton, R., van Eeten, M. J. G., Levi, M., Moore, T., & Savage, S. (2019). Measuring the changing cost of cybercrime. In The 18th Annual Workshop on the Economics of Information Security. https://doi.org/10.17863/CAM.41598
Bureau of Justice Statistics. (2023). National Crime Victimization Survey. U.S. Department of Justice. https://bjs.ojp.gov/data-collection/ncvs
Federal Bureau of Investigation. (2024). Internet Crime Complaint Center 2023 annual report. U.S. Department of Justice. https://www.ic3.gov/AnnualReport/Reports/2023_IC3Report.pdf
Federal Bureau of Investigation. (2023). National Incident-Based Reporting System (NIBRS). Criminal Justice Information Services. https://www.fbi.gov/how-we-can-help-you/more-fbi-services-and-information/ucr/nibrs
Harrell, E. (2023). Victims of identity theft, 2021. Bureau of Justice Statistics, U.S. Department of Justice. https://bjs.ojp.gov/library/publications/victims-identity-theft-2021
Holt, T. J., & Bossler, A. M. (2016). Cybercrime in progress: Theory and prevention of technology-enabled offenses. Routledge.
Identity Theft Resource Center. (2024). 2023 data breach report. https://www.idtheftcenter.org/publication/2023-data-breach-report/
Kshetri, N. (2010). The global cybercrime industry: Economic, institutional and strategic perspectives. Springer.
Levi, M. (2017). Assessing the trends, scale and nature of economic cybercrimes: Overview and issues. Crime, Law and Social Change, 67(1), 3–20. https://doi.org/10.1007/s10611-016-9645-3
Macdonald, M., & Frank, R. (2017). The network structure of malware development, deployment and distribution. Global Crime, 18(1), 49–69. https://doi.org/10.1080/17440572.2016.1197123
Ponemon Institute. (2024). Cost of a data breach report 2024. IBM Security.
Reep-van den Bergh, C. M. M., &”; Junger, M. (2018).”; Victims of cybercrime in Europe: A review of victim surveys. Crime Science, 7(1), 5. https://doi.org/10.1186/s40163-018-0079-3
Romanosky, S. (2016). Examining the costs and causes of cyber incidents. Journal of Cybersecurity, 2(2), 121–135. https://doi.org/10.1093/cybsec/tyw001
U.S. Government Accountability Office. (2007). Cybercrime: Public and private entities face challenges in addressing cyber threats. GAO-07-705. https://www.gao.gov/products/gao-07-705
United Nations Office on Drugs and Crime. (2013). Study on cybercrime: Draft. United Nations.
Van de Weijer, S. G. A., Leukfeldt, R., & Bernasco, W. (2019). Determinants of reporting cybercrime. European Journal of Criminology, 16(4), 486–508. https://doi.org/10.1177/1477370818773610
Verizon. (2024). 2024 Data Breach Investigations Report. https://www.verizon.com/business/resources/reports/dbir/
Wall, D. S. (2007). Cybercrime: The transformation of crime in the information age. Polity Press.
Yar, M., & Steinmetz, K. F. (2019). Cybercrime and society (3rd ed.). SAGE Publications.
Anti-Phishing Working Group. (2024). Phishing activity trends report: 4th quarter 2023. https://apwg.org/trendsreports/

Related Articles