Online Scams have Become a Global Epidemic

An estimated 293 million scam reports were filed and $55.3 billion was lost in scams in 2021 worldwide

Scammers Scam Everything

Scammers have proven more successful in 2021 than ever before. The number of scams reported increased with 10.2% from 266 in 2020 to 293 million reports in 2021.  The amount of money lost in scams grew from with 15,7% from $47.8 billion in 2020 to $ 55.3 billion in 2021, mainly due to the rise in Investment Scams (also read: About the Data).

Figure 1: Money Lost and Number of Scams Reported Worldwide

Scammers are using any crises to scam people; moving from pre-ordering your Coronavirus vaccination in the beginning of 2021, to cheap flight tickets for Hajj pilgrims, “supporting” victims of the Australian bush fires, “helping” Ukrainian refugees and more recently, tickets to Queen Elizabeth’s funeral memorial and energy crisis government subsidies.

The Bloody Facts

With 4.72 billion internet users (60.1% of the global population) now spending nearly 7 hours every day online, the economy continues to digitalize at an increasing rate. Crime is following quickly. In most Western countries online scams are now the most reported type of crime.

Figure 2: Scams are in many countries now the most reported type of crime

According to the Australian Competition & Consumer Authority, 96% of Australians have been exposed to a scam in the last 5 years with half of these contacted weekly or daily by scammers. In France, 61% of the people have been exposed to “alternative” investment offers last year. In the United Kingdom, 50% of telephonic survey respondents reported receiving an email, text, or social media message that may have been phishing in one month.

No Longer a Western Disease

However, scams are no longer a “Western” disease. 53% of Filipinos stated they were targeted by fraudsters in 3 months time. 11% of the respondents said they ended up as victims. Likewise, other developing countries like Brazil, Ghana, Nigeria and Kenya are reporting huge increases in online scams, especially via mobile phones.

The introduction of a new, easy-to-use, mobile payment method called Pix in Brazil, led to an influx of scams. In Nigeria, the number of transactions via mobile channels increased by 164% in 2021. As a result, scams via mobile boomed as well. 62% of Saudi Arabian consumers received spam & scam messages, mainly on their mobiles. 14% admitted that they fell for the scam and lost money. In South Africa, two massive data breaches caused a tsunami of phishing attacks using highly personal data. Indonesia reports that 25% of their citizens has been a victim of an online fraud, making it the 2nd largest reported type of crime in the country.  

Investment Scams Continue to Rise

The strong increase in scams is not only caused by the accelerated rate of digitalization but also by high inflation, quickly increasing cost of living, and, in some countries, high unemployment rates. This is forcing people to look for new ways to invest or simply make ends meet. Despair makes bad councel.

In 2020 we already saw a sharp increase in investment, mainly in cryptocurrency scams. The Turkish government felt forced to suspend a cryptocurrency exchange, freezing more than $2 billion in assets. Canada reports that investment scams were one of the fastest growing types of online fraud, from 501 reports and 16.5 million lost in 2020 to 3,442 reports and 164 million in 2021. The United States reports a loss of $575 million in investment scams. Singapore reports the largest amount taken in a single case: $6.4 million.

Scam Blurring

2021 introduced a blurring of investment with romance scams. Where victims of romance scams used to lose money to pay for hospital, travel or other urgent needs of their virtual lovers, these scammers are increasingly switching to making “joint” investments together. To make matters worse, scam victims are after the scam approached by “money recovery” firms. These often are the same scam group, promising to help the victim retrieve his loses, of course, after first paying an “administration” fee. The money is never actually recovered. As a result, in most countries researched, the number of scam reports has not only increased, but they report an ever-stronger growth in money lost.

One of newest types of scams are loan apps. Especially in developing countries like Brazil, Mexico, Nigeria, India and Tanzania, these kind off scams are on the rise. Here too scams are blurred, in some cases the loans start as advance fee scams, asking the victim to first pay money before the loan can be given (which in the end never happens). In other cases, an online loan is provided (often much less than applied for) with huge interests. If the victim cannot pay, the lender starts calling and messaging with threats until the victims pays a multitude of what was borrowed. Finally, loan apps are often misused to get the necessary data to apply for loans or credit cards elsewhere.

Figure 3: The number of scams reported and money lost differs strongly per country

Scams remain one of the most under reported types of crime

As scam victims often feel ashamed or, according to previous research, do not know where to report a scam, scam reporting remains low.

In nearly all countries, reporting scams remains fragmented across CERTs, consumer protection organizations, financial authorities, banks, telecom operators, local police offices, cybercrime teams, victim support organizations, private initiatives, review sites and social media. In several countries like Kenya and Pakistan, action from law enforcement is described as slow, fragmented and inconsistent. The process of reporting must often be done physically rather than digitally.

In Australia an estimated 13% of all scams are reported. Canada estimated only 5% of the cases reach law enforcement while Israel estimated this number to be 9% and the Dutch and French estimates range between 12%–17%.

Some countries are centralizing scam reporting and are investing in making reporting easier. France has launched a new online platform for reporting internet scams without having to go to a police station. Several countries like the Belgium, Poland, New Zealand and the United Kingdom, now offer citizens the option to forward dubious emails and text messages for further analysis and action.

Social Media Stepping Stone for Scammers

In nearly all countries, social media are plagued by scammers trying to lure victims. According to Pakistani authorities, 23% of the reported online crimes, started on Facebook. Indonesia states that 51% of the scams start on social media. In the United States, more than one in four people who reported losing money to fraud in 2021 said it started on social media with an ad, a post, or a message.

There seems to be a trend to make social media more accountable. The Australian Competition & Consumer Commission for example is taking legal action over alleged misleading conduct by Meta for publishing scam celebrity crypto ads on Facebook. On a positive note, in Malaysia, Meta is supporting an online scam awareness campaign.

Get Them While They are Young

Another scam trend several countries, like Brazil, China, Finland, the Netherlands, New Zealand and Thailand are reporting, is that young people are targeted more and also lose more frequently money then elderly. Seniors still lose the most money, especially to investment/crypto scams.

In Finland especially, students seem to be a targeted group. The worst-hit age group were individuals between 18 and 30 years old (23.3%), who were scammed 8% more compared to 2020. Likewise, the Dutch University of Twente found that young people are 21.5% more likely to be scammed than older people (13.1%). New Zealand reports that 55% of the people who report scams are now younger than 40 and a study from Thailand shows that Generation Y and Z are the most vulnerable to online scams due to the amount of time they spend online. Finally, a Chinese survey amongst college students reported that more than a tenth of the respondents had lost money to scammers. This has prompted the Chinese government to launch a new wave of education campaigns aimed at making young adults more wary.

Scamming is becoming an Industry

Scams have been industrializing for years. The most well-known are the call centers in India which specialize in Helpdesk/Tech Support scams. A more recent development has been that mainly Taiwanese and Chinese citizens are tricked by human traffickers. The traffickers are targeting mostly young Asian people via social media, offering well paid work and accommodation in countries like Cambodia, Thailand, Myanmar and Laos. On arrival, their passports are taken, and they are sold to different groups and forced to work in offices running illegal phone or online scams. Taiwan authorities say almost 5,000 citizens have been recorded travelling to Cambodia and not returning.

Another development, which is reported by Group IB, is the rapid growth of SaaS (Scam-as-a-Service). Scams are automated and increasingly finetuned to specific target groups. Scam scripts (websites) are developed and distributed to local scam organizations. Cybercriminals also professionalize in specific specializations (traffic generation via social media, text and email spamming, cryptocurrency laundering, retargeting of scam victims. According to Group-IB scams (57%) now outstrips phishing (18%) and malware 25%) as cybercrime type.

Spread Love; Not Scams

An increasing number of governments are investing in raising scam awareness. With the title ‘Spread Love; Not Scams” the Tanzania government is trying to educate its citizens on online fraud. In many cases, awareness campaigns are fragmented on state (Brazil, Germany) or even municipality level (Netherlands) and different stakeholders (banks, telecom operators, law enforcement).

China has started the “people’s war” against fraudsters, a nationwide anti-fraud education campaign which was launched by the Chinese authorities in 2019, after president Xi Jinping announced in a conference that fighting fraud was a “top priority”. The campaign culminated early this year with the launch of National Anti-Fraud Center and a mobile app that has been downloaded more than 500 million times, making it one of the most popular in the world. The government uses a variety of channels, from street posters to TV commercials, to inform the public about what scams look like and how to avoid them.

Scam Prevention Initiatives are Growing

Like private companies such as ScamAdviser.com and Trend Micro, more countries are starting to offer tools to their citizens to check for malicious websites, email addresses, bank accounts, cryptocurrency addresses and phone numbers.

Lists of malicious media are piecemeal published on an increasing number of mainly financial authorities and some police websites such as in Canada, Mexico, Netherlands, New Zealand and South Africa. Likewise, the Polish CERT has started publishing a Domain Warning List, listing 33,000 domains in the first year.

Malaysia is taking this one step further by offering a search engine and app allowing the public to check telephone and bank account numbers used by the crime syndicates.

Cybercrime Fighting: Centralizing & Scaling up

More and more countries such as France, Malaysia, Mexico, Switzerland are (slowly) centralizing their anti-cybercrime efforts. In Switzerland for example, the Nationale Zentrum für Cybersicherheit (NCSC) is gaining a more central role in reporting fraud, in the analysis of the phenomenon, and in the prosecution. Like in Japan, this is a rare phenomenon, as both countries used to have a strict federal/prefecture approach.

Countries are also investing in resources. Indonesia is hiring 200 additional cybercops in 2021 alone. Italy now has more than 2,000 police officers specialized in IT related crimes and a special Cyber Crime Analysis Unit has been set up in close cooperation with Italian Universities to study computer crimes.

Also, more time is invested into training. The Qatar National Cybersecurity Agency for example trained 25,000 employees in different aspects of cyber security in less than one year, also in preparation for the FIFA World Cup.

Scams are not a Priority

However, the investments listed above, are mainly made to combat “big cybercrimes” targeting infrastructure and companies. In no country scam fighting receives the same level attention. On the one hand, this is understandable as the damage of a big cybercrime case is often in the millions. On the other hand, the quantity of scams hurting individual consumers and the level of personal suffering, demands attention as well.

Apart from the money lost per individual case, the biggest reason for law enforcement either ignoring or simply admitting it cannot handle the case, is that investigations have proved to be unfeasible due to the bureaucracy involved in communication between the investigation agencies of the countries involved. Singapore Police, for example, states at least 90% of the scams in Singapore originate from overseas, and described the scammers as syndicated, well-resourced and technologically sophisticated. The police said these cases are difficult to investigate and prosecute as efforts depend on the level of cooperation from overseas law enforcement agencies.

The Cure for Scams?

According to a study by the World Economic Forum only 0.05% of all cybercrimes are prosecuted. This number is probably even larger for online scammers and becoming more unacceptable as the number of scams continue to grow at a rapid pace.

Countries have, in many cases already for years, invested in awareness campaigns. However, as scams become more sophisticated and advance, scams will continue to grow. Raising awareness is not enough.

The warning lists posted by law enforcement, CERTs and financial authorities are often too little; too late. The victims have already lost their money and, as scammers operate around the globe, consumers cannot be asked to check all warning list sites. More preventive action is needed.

Prevention could take the form of a global sharing system of scam data (be it domains, email addresses, cryptocurrency addresses and bank accounts). The data cannot only be used to help consumers check if they may run a risk of being scammed, but also be used to proactively block or take down malicious assets. National initiatives like those of the Belgium Cybersecurity Center, where consumers can forward phishing emails and where this data is used real time to block websites by Belgium Internet Service Providers have already proven to reduce the number of scams. The next step is taking these kinds of initiatives international.

To allow faster take down of scam assets, especially those platforms which are used to promote scams (the Big Tech search engines and social media) and those that facilitate their infrastructure (registrars, registries and hosting providers) have to take on more responsibility. While some are already taking more responsibility, new legislation will be required to make platforms more accountable.

To find more answers to counter the rise of online scams, GASA is organizing the Global Anti Scam Summit bringing together governments, consumer & financial authorities, law enforcement, Internet Service Providers, and cybersecurity organizations to share knowledge and insights on fighting online scams and define concrete actions to combat online fraud more effectively and efficiently.

About the Data

Countries use different definition for online fraud and the way online fraud is reported, if at all, differs strongly per country as well. For our study we sometimes had to use reported phishing attacks or cyberincidents. In other causes the total number of fraud reports is available, but no distinction is made between online and offline fraud. Also, the fact that most victims do not report online scams at all, makes it difficult to give an accurate image. The worldwide figures presented in this article can therefor only be seen as a rough (under)estimate of the actual global state of scams.

It seems national surveys of victimization, like those in the Netherlands, Mexico and the United Kingdom, give a better insight into the state of online scams. It also makes the gap between reported number of scams more visible. For example, the victimization survey in the UK estimated 4.5 million fraud offences in 2021, while the different reporting sources in the UK received 965,161 complaints. The same applies to money lost. Most official sources do not report the amount of money lost. Here victimization reports are often able to give an insight.