Cybercrime’s Dark Reality: 20 Common Crimes, How They Destroy Lives and the Penalties Offenders Face

A fake bank alert can lead to a stolen password. A convincing investment offer can cost someone their life savings. One compromised business email account can redirect a major payment, while a ransomware attack can bring an organisation’s systems to a standstill.

These are not all the same crime, and they do not carry the same legal consequences.

Cybercrime includes a wide range of conduct, from unauthorised access to online fraud, identity theft, digital extortion and attacks against computer systems. Some offences target individuals. Others target businesses, public services or essential infrastructure. A single incident can involve several offences, which makes the legal consequences more complicated than one label suggests.

The scale is substantial. In England and Wales, the Office for National Statistics estimated 4.5 million fraud incidents and 817,000 computer-misuse incidents for the year ending June 2026. In the United States, the FBI’s Internet Crime Complaint Center (IC3) received 1,008,597 complaints in 2025, with approximately $20.877 billion in reported losses. In Europe, the EU Agency for Cybersecurity (ENISA) identified ransomware as the most impactful short-term incident type in its analysis of observed incidents during 2025.

These figures measure different things. The ONS estimates incidents through a survey of people and households in England and Wales. IC3 counts complaints submitted to a US reporting centre. ENISA analyses observed cybersecurity incidents. None provides a complete worldwide count of cybercrime.

This guide explains 20 important types of cybercrime, how they work, what official data can tell us about them, and what legal consequences offenders may face. It also explains why the law differs between countries and why a maximum prison sentence is not the same as the sentence a court will impose.

How common is cybercrime? The figures need context

Before looking at individual offences, it is important to distinguish three measures: estimated incidents, complaints submitted to authorities, and attacks observed by cybersecurity organisations.

Official figures at a glance

The ONS estimated that fraud incidents in England and Wales increased by 11% and computer-misuse incidents by 23% compared with the previous year’s survey. The rise in computer misuse was largely associated with an increase in incidents involving unauthorised access to personal information. These are survey estimates, not proof that every type of cybercrime increased by the same amount.

The FBI’s 2025 report also recorded more complaints and higher reported losses than in 2024. The FBI reported nearly $21 billion in losses across internet-crime complaints, with cyber-enabled fraud accounting for more than $17.7 billion. These figures describe reports received by IC3, not all losses suffered by Americans and certainly not the worldwide cost of cybercrime.

ENISA’s findings have a different purpose. Its threat landscape analyses observed cybersecurity incidents and threats; it is not a police database counting every offence in the EU.

The figures should therefore not be added together or treated as directly comparable. One incident may also involve several forms of criminal conduct. A phishing message, for example, could lead to account takeover, identity misuse and financial fraud. Counting each label as a separate incident would inflate the total.

The main lesson is simple: official figures help reveal the scale of harm, but no single source captures every cybercrime committed.

20 cybercrimes explained: how criminals operate and what the law can do

The categories below cover common scams, computer offences and other forms of online criminal conduct. They are not mutually exclusive, and not every category is a separate criminal offence in every country.

1. Phishing and spoofing

How it works

Phishing uses deceptive emails, text messages, websites, social-media messages or other communications to persuade people to reveal information, open malicious files or transfer money. Spoofing makes a sender, website, phone number or digital identity appear more trustworthy than it really is.

A message might claim that a bank account will be blocked unless the recipient follows a link. The link opens a fake login page that captures the victim’s credentials.

Why it matters

Phishing can be the first step in fraud, identity theft, account takeover or a larger intrusion into an organisation. It describes a method of deception, so the legal charge depends on what the offender actually does.

What the reporting data says

In its 2024 Internet Crime Report, IC3 recorded 193,407 phishing and spoofing complaints. Phishing and spoofing were also among the most frequently reported categories in the FBI’s 2025 report. The precise category definitions and annual counts should be checked in the original report before making a year-on-year comparison.

Possible legal consequences

In England and Wales, phishing carried out with the required dishonest intent may amount to fraud under the Fraud Act 2006. The main fraud offences can carry up to 10 years’ imprisonment on conviction on indictment. Unauthorised access, identity-related offences or other charges may also apply, depending on the evidence.

Official source: Fraud Act 2006.

2. Online shopping and non-delivery fraud

How it works

A criminal advertises a product or service that does not exist, takes payment without intending to deliver it, or deliberately misrepresents what the buyer will receive. Fake shops, fraudulent marketplace listings and deceptive social-media advertisements are common methods.

A listing for a popular phone at an unusually low price might persuade a buyer to pay outside a marketplace’s protected payment system. The seller then disappears.

Why it matters

Small losses can accumulate when a fraudulent shop targets many buyers. Fake listings may also collect payment details and personal information for further misuse.

What the reporting data says

IC3 records non-payment and non-delivery complaints, but that category is not a complete count of all online-shopping scams. It excludes incidents that are not reported to IC3 and may not cover every case that a person would describe as shopping fraud.

Possible legal consequences

Deliberate deception to obtain money may constitute fraud. However, a late delivery, commercial dispute or business failure is not automatically a criminal offence. The evidence must establish the elements of the applicable law.

3. Investment and cryptocurrency fraud

How it works

Investment fraud uses false promises, fabricated trading platforms, impersonated financial professionals or manipulated online relationships to persuade people to transfer money. Some schemes show victims fictitious profits to encourage larger deposits.

Cryptocurrency may be used because transactions can be difficult to reverse, but cryptocurrency itself is not criminal. The offence lies in the unlawful conduct.

Why it matters

Victims may lose savings accumulated over many years. Some schemes deliberately build trust over weeks or months before making a large demand.

What the reporting data says

Investment fraud was the largest driver of reported losses in IC3’s 2025 cyber-enabled fraud data. The FBI reported that investment schemes accounted for nearly 49% of scam-related losses in that section of the report. This is a US reporting figure, not a global estimate.

Possible legal consequences

Depending on the evidence, offenders may face fraud, theft, money-laundering or related charges. The maximum sentence depends on the specific offence, the amount and circumstances involved, and the jurisdiction.

Official source: FBI IC3 annual reports.

4. Business email compromise

How it works

Business email compromise (BEC) involves impersonating or compromising a trusted business email account to manipulate payments or obtain sensitive information. A criminal may pose as a supplier asking for an invoice to be paid into a new account, or impersonate an executive demanding an urgent transfer.

The message may look entirely ordinary. The deception often lies in the payment instructions rather than in a malicious attachment.

Why it matters

BEC can cause substantial financial losses without deploying malware. It exploits trust and routine business processes, which makes independent verification of payment changes essential.

What the reporting data says

The FBI’s IC3 reports BEC as a distinct category of internet crime and records billions of dollars in reported losses associated with it. These figures reflect reports submitted to IC3 and should not be interpreted as the total global cost of BEC.

Possible legal consequences

Depending on the facts, prosecutors may pursue fraud, unauthorised access, forgery or other offences. A compromised email account does not, by itself, establish every possible charge.

5. Identity theft and identity misuse

How it works

Identity theft involves obtaining or using another person’s identifying information without lawful authority, often to impersonate them, apply for credit, open accounts or commit fraud. Information may be acquired through phishing, data breaches, stolen documents or social engineering.

Why it matters

The harm may continue long after the original theft. Victims can face fraudulent transactions, account restrictions, disputed debts and time-consuming recovery work.

What the reporting data says

IC3 recorded 21,403 identity-theft complaints in 2024. That figure is distinct from the number of data breaches, cases of account takeover or all forms of identity misuse. A category count should not be treated as a complete estimate of the problem.

Possible legal consequences

The relevant law may cover fraud, identity-document offences, unauthorised access or other conduct. There is no single worldwide identity-theft sentence. The legal classification depends on what the offender did and which jurisdiction applies.

6. Account takeover and credential theft

How it works

Account takeover occurs when someone gains control of another person’s online account. Criminals may use stolen passwords, phishing, reused credentials, stolen session tokens or social engineering.

An attacker who compromises an email account may be able to reset passwords for other services, impersonate the owner or access private messages.

Why it matters

One compromised account can provide a route into many other accounts, especially when passwords are reused or recovery methods are weak.

What the reporting data says

A single comparable count for account takeover across the UK, US and EU is not established by the sources used in this article. Incidents may be recorded under broader fraud, identity or computer-misuse categories.

Possible legal consequences

In the UK, section 1 of the Computer Misuse Act 1990 criminalises unauthorised access to computer material. Further conduct, such as fraud or data theft, may lead to additional charges.

Official source: Computer Misuse Act 1990, section 1.

7. Ransomware

How it works

Ransomware is malicious software or an attack method used to deny access to systems or data, commonly by encrypting files. Some operators also steal information and threaten to publish it unless the victim pays.

Hospitals, businesses, schools and public services can all be targets. Paying a ransom does not guarantee that systems will be restored or stolen information deleted.

Why it matters

The consequences can include lost data, financial damage and disrupted services. An attack against an organisation that people rely on may cause harm well beyond the immediate victim.

What the reporting data says

IC3 recorded 3,156 ransomware complaints in 2024. This does not mean only 3,156 ransomware attacks occurred in the United States. Victims may report to other bodies, and many incidents may never be reported.

ENISA’s 2026 Threat Landscape identified ransomware as the most impactful short-term incident type in its analysis of observed incidents during 2025. That describes the impact within ENISA’s dataset, not a count of every ransomware attack in Europe.

Possible legal consequences

A ransomware operation may involve multiple offences, including unauthorised access, data or system interference, extortion and fraud. The applicable charges and penalties depend on the facts and national law.

Official source: ENISA Threat Landscape 2026.

8. Malware distribution and deployment

How it works

Malware is software designed to perform harmful or unauthorised actions. It includes spyware, information stealers, trojans, worms and other malicious programs. Criminals may distribute it through fake downloads, malicious attachments, compromised websites or software disguised as legitimate.

Why it matters

Malware can steal credentials, monitor activity, damage data, disrupt systems or provide access for further attacks. It is often a tool used within another crime rather than a complete description of the offence.

What the reporting data says

IC3 recorded 441 complaints in its malware category in 2024. That relatively small count should not be read as proof that malware is rare. A malware incident may be reported as ransomware, fraud or a data breach instead.

Possible legal consequences

Depending on the conduct, national law may criminalise unauthorised access, system interference, supplying criminal tools or other actions. Possessing a security tool or researching malware is not automatically a crime. Authorisation, intent and the specific law matter.

9. Personal-data breaches and data theft

How it works

A personal-data breach involves personal information being exposed, accessed, altered, lost or disclosed without appropriate authority. Causes can include criminal intrusion, stolen credentials, insider conduct or accidental disclosure.

Not every data breach is a criminal act. A regulatory breach of data-protection requirements is not automatically equivalent to hacking.

Why it matters

Exposed data can be used for targeted scams, impersonation, identity misuse or account compromise. A breach can create risks for people who never directly interacted with the attacker.

What the reporting data says

IC3 recorded 64,882 complaints in its personal-data-breach category in 2024. This reflects IC3’s reporting definitions and should not be merged with other breach categories without checking how each is defined.

Possible legal consequences

Depending on the facts, an offender may face charges for unauthorised access, fraud, theft or unlawful disclosure. Organisations may separately face regulatory action under applicable data-protection laws.

10. Extortion and online blackmail

How it works

Online extortion involves threatening to cause harm, expose information or disrupt a service unless a victim complies with a demand. Threats may involve stolen data, intimate images, fabricated allegations or a promised cyberattack.

Sextortion is one form of this conduct. Some criminals claim to possess compromising material that they do not actually have.

Why it matters

Victims can experience financial loss, fear and serious emotional distress. Paying does not guarantee that the threats will stop.

What the reporting data says

Extortion was among the most frequently reported complaint categories in IC3’s 2025 report. The extortion category is broader than ransomware-related extortion and must not be treated as a ransomware count.

Possible legal consequences

Depending on the jurisdiction, conduct may amount to extortion, blackmail, fraud, harassment or another offence. Threats involving children or intimate imagery may trigger additional laws.

11. Romance and confidence fraud

How it works

A criminal creates a false romantic or personal relationship to obtain money or other benefits. The offender may invent a medical emergency, request travel expenses or gradually persuade the victim to invest in a fabricated opportunity.

Why it matters

The loss can be financial and deeply personal. Victims may have been manipulated over a long period before realising that the relationship was fraudulent.

What the reporting data says

IC3 records confidence and romance fraud as a reporting category. Its figures measure complaints submitted to the US reporting centre, not every deceptive relationship or every victim worldwide.

Possible legal consequences

Obtaining money through deliberate deception may constitute fraud. Additional charges can apply if the offender also steals identities, makes threats or launders criminal proceeds.

12. Tech-support and customer-support scams

How it works

Criminals pretend to represent a technology company, internet provider, bank or customer-support team. They may claim that a device is infected, demand payment for a nonexistent repair or persuade the victim to install remote-access software.

Why it matters

Remote access can expose files, messages and account information. A scammer may also guide the victim through a bank transfer while falsely describing it as a security procedure.

What the reporting data says

IC3 records tech-support fraud as a distinct category. Its reported losses indicate substantial harm, but they cover reports submitted to IC3 rather than every tech-support scam worldwide.

Possible legal consequences

Fraud may be the central offence, with unauthorised access, theft or other charges possible if further criminal conduct is established.

13. SIM swapping and mobile-account takeover

How it works

In a SIM-swap attack, a criminal fraudulently transfers a victim’s phone number to a SIM or service they control. The attacker may then receive calls or text messages intended for the victim.

Why it matters

Control of a number may help an attacker access accounts that rely on text-message verification. It does not automatically defeat every form of multifactor authentication.

What the reporting data says

IC3 recorded 982 SIM-swap complaints in 2024. This is a US reporting-centre count, not a global total.

Possible legal consequences

Depending on the conduct, fraud, unauthorised access, identity-related offences or other laws may apply. The specific charge depends on the evidence and jurisdiction.

14. Real-estate and property-payment fraud

How it works

A criminal impersonates an estate agent, solicitor, landlord or buyer to redirect a deposit or property payment. The attacker may compromise a legitimate email account or create a convincing fake identity.

Why it matters

Property transactions involve large sums, and transfers to a criminal’s account may be difficult to recover.

What the reporting data says

IC3 records real-estate fraud complaints, but the category is not a complete count of every property-related scam. Reporting totals should be read in the context of the agency’s definitions.

Possible legal consequences

Fraud, forgery, unauthorised access and money-laundering offences may be relevant, depending on how the scheme was carried out.

15. Employment and recruitment fraud

How it works

A fraudulent recruiter advertises a fake job, requests an advance payment, collects identity documents or sends a counterfeit cheque and asks the applicant to return part of the money.

Why it matters

People looking for work may lose money while also disclosing personal information that can be used in later scams.

What the reporting data says

IC3 recorded 20,044 employment complaints in 2024. This count covers reports submitted to IC3 under its employment category.

Possible legal consequences

Deliberate deception may amount to fraud. Identity-related offences or unlawful handling of personal information may also apply, depending on the facts.

16. Unauthorised interception and digital spying

How it works

Unauthorised interception involves accessing communications or data transmissions without lawful authority. Digital spying may involve spyware, covert monitoring or unlawful access to private information.

Not all monitoring is illegal. Authorised security monitoring and lawful investigations are different from covert access without permission.

Why it matters

Victims may lose privacy, have confidential communications exposed or become targets for further fraud and harassment.

What the law says

Article 3 of the Council of Europe’s Budapest Convention addresses illegal interception. National implementation and the exact conduct matter when assessing a particular case.

Possible legal consequences

Depending on the jurisdiction, offences may include illegal interception, unauthorised access, privacy violations or other criminal conduct.

Official source: Council of Europe, Budapest Convention.

17. Denial-of-service and distributed denial-of-service attacks

How it works

A denial-of-service attack attempts to make a service unavailable. A distributed denial-of-service (DDoS) attack uses many systems or sources to overwhelm a target.

Targets can include businesses, public websites, online services and essential infrastructure.

Why it matters

An attack can interrupt access to a service even if the attacker never steals data. Where essential services are affected, disruption can have consequences for many people.

What the reporting data says

ENISA’s 2026 assessment reported that ideology-driven DDoS activity accounted for 82% of recorded events affecting public administration in its dataset. This is a specific subset of observed events, not a measure of all cybercrime or all DDoS attacks in Europe.

What the law says

In the UK, section 3 of the Computer Misuse Act 1990 addresses specified unauthorised acts intended, or undertaken recklessly, to impair computer operation or access to programs or data. The offence can carry up to 10 years’ imprisonment on conviction on indictment.

Official source: Computer Misuse Act 1990.

18. Unauthorised access to computer systems

How it works

Unauthorised access occurs when someone deliberately accesses computer material without permission and with the required knowledge. Everyday descriptions often call this “hacking”, but authorised security testing is not the same as criminal intrusion.

Why it matters

An intrusion may be the first stage of data theft, extortion, fraud or disruption. The legal consequences depend on the specific actions and intent established by the evidence.

Examples of national penalties

• United Kingdom: Section 1 of the Computer Misuse Act 1990 provides a maximum of two years’ imprisonment on conviction on indictment for the basic unauthorised-access offence. Section 2, covering access with intent to commit or facilitate further offences, provides a maximum of five years.
• France: Article 323-1 of the Penal Code provides penalties for specified fraudulent access to or remaining in a system. The basic form has been punishable by up to three years’ imprisonment and a €100,000 fine, with higher penalties for certain consequences and circumstances. The current consolidated provision should be checked before publication.
• Germany: Section 202a of the Criminal Code provides up to three years’ imprisonment or a fine for obtaining access to specially protected data by overcoming access security without authorisation.
• Spain: Article 197 bis of the Penal Code provides six months to two years’ imprisonment for specified unauthorised access that violates security measures.
• The Netherlands: Article 138ab of the Criminal Code provides penalties for computer trespass, with the maximum depending on the form of conduct.

These are examples of statutory penalties for particular offences, not directly equivalent measures of how harshly countries punish cybercrime overall. The precise wording and current consolidated versions of national laws should be checked before publication.

19. Child sexual exploitation and grooming online

How it works

Online child sexual exploitation includes offences involving the sexual exploitation of children, such as producing, distributing or possessing illegal child sexual abuse material and certain forms of grooming.

The legal definitions and offences differ by jurisdiction, and some conduct is addressed through specific legislation.

Why it matters

These are serious offences involving direct harm to children. They should not be reduced to a general technology or privacy issue.

What the reporting data says

The sources used here do not establish a directly comparable UK, US and EU complaint total for this category. Europol addresses child sexual exploitation as a distinct priority in its assessments of online organised crime.

Possible legal consequences

Serious offences can carry substantial prison sentences. The applicable maximum depends on the offence, the victim’s age, the conduct proved and the jurisdiction. A reliable comparison requires the exact national provision rather than one general penalty for all online exploitation.

Official source: Europol, Internet Organised Crime Threat Assessment.

20. Attacks on critical infrastructure

How it works

These attacks target systems supporting essential services, potentially including healthcare, energy, transport, communications and public administration. Some are financially motivated; others may be linked to espionage, political motives or geopolitical conflict.

Why it matters

Disruption can affect people who have no direct connection to the targeted organisation. A hospital outage, for example, may disrupt appointments, access to records or other services.

What the reporting data says

ENISA reported that 73% of the targeted organisations in its 2026 dataset were entities classified as essential or important under the EU’s NIS2 framework. This does not mean that 73% of all European organisations were attacked.

Possible legal consequences

Depending on the conduct and national law, prosecutors may pursue system-interference, data-interference, extortion, fraud or other charges. Some jurisdictions provide enhanced penalties for specified attacks on protected or essential systems.

Official source: ENISA Threat Landscape 2026.

What prison sentences can cybercriminals face?

There is no single worldwide prison sentence for cybercrime. The legal result depends on the country, the precise offence, the evidence, the harm caused and the circumstances recognised by the relevant law.

A phishing campaign might involve fraud and unauthorised access. A ransomware operation might involve system interference, extortion and data theft. One investigation can therefore lead to several charges.

Fraud and online deception

In England and Wales, the Fraud Act 2006 provides a maximum of 10 years’ imprisonment on conviction on indictment for the main fraud offences. Whether a particular phishing, shopping, investment or recruitment scheme amounts to fraud depends on the evidence and statutory elements.

In the United States, federal wire fraud under 18 U.S.C. § 1343 can carry up to 20 years’ imprisonment. The statute provides for a higher maximum of up to 30 years in specified cases involving a financial institution or a major disaster or emergency. These are statutory maximums, not predictions of the sentence in an individual case.

Sources: UK Fraud Act 2006 and US wire-fraud statute.

Unauthorised access and attacks on systems

In the UK, the Computer Misuse Act 1990 distinguishes between basic unauthorised access and more serious conduct:

• Section 1: up to two years’ imprisonment on conviction on indictment.
• Section 2: up to five years for unauthorised access with intent to commit or facilitate further offences.
• Section 3: up to 10 years for specified unauthorised acts impairing computer operation or access to programs or data.

These provisions should not be treated as a general penalty scale for every online scam. The offence charged must match the conduct.

Source: Computer Misuse Act 1990.

Extortion and blackmail

Extortion and blackmail laws differ between countries and may be separate from computer-crime statutes. A ransomware operator who threatens to publish stolen data may face charges beyond unauthorised access, depending on the jurisdiction and the facts.

In England and Wales, blackmail is addressed by section 21 of the Theft Act 1968. It carries a maximum of 14 years’ imprisonment on conviction on indictment. Whether a particular threat meets the legal definition of blackmail must be assessed against the statute and evidence.

Source: Theft Act 1968, section 21.

Payment fraud and financial crime

Fraud involving bank transfers, payment cards or other non-cash payment instruments may be prosecuted under laws different from those covering basic unauthorised access. The applicable offences depend on how the payment was obtained, whether a payment instrument or account was misused, and whether other crimes were committed.

In the European Union, Directive (EU) 2019/713 requires Member States to address specified fraud and counterfeiting involving non-cash payment instruments. It does not create one identical sentence for every payment-fraud case across all EU countries.

Source: Directive (EU) 2019/713.

Ransomware and multiple charges

Ransomware is not one universal legal offence. The same operation may involve unauthorised access, system interference, data theft, extortion, fraud or money laundering. Prosecutors may bring multiple charges if the evidence supports them.

The available penalties depend on national law and the precise conduct. It would be misleading to assign one prison term to every ransomware incident.

Child sexual exploitation offences

Offences involving the sexual exploitation of children are governed by specific national laws. Penalties vary according to the conduct and circumstances. A responsible comparison should identify the exact offence and jurisdiction rather than provide one sentence for a broad category.

The international legal framework

Three frameworks help explain how countries approach cybercrime, while leaving many sentencing details to national law.

The Budapest Convention

The Council of Europe’s Convention on Cybercrime establishes a framework for criminalising specified computer-related conduct and improving international cooperation. Its offences include illegal access, illegal interception, data interference, system interference, misuse of devices, computer-related forgery and computer-related fraud.

Article 13 calls for effective, proportionate and dissuasive sanctions, including deprivation of liberty where appropriate. It does not set one fixed prison sentence for every offence in every country. The treaty operates through the obligations of its parties and their domestic laws.

Source: Council of Europe, Budapest Convention.

EU rules on attacks against information systems

Directive 2013/40/EU requires EU Member States to criminalise specified attacks against information systems and establish penalties that meet minimum standards.

For relevant offences, Article 9 requires maximum imprisonment terms of at least two years in non-minor cases. It sets higher requirements for national maximum penalties in specified aggravated circumstances, including certain attacks affecting a significant number of systems and cases involving serious damage, criminal organisations or critical infrastructure.

These are requirements for national legislation, not automatic sentences imposed by the EU. They also do not mean every cybercrime carries a two-, three- or five-year prison term.

Source: Directive 2013/40/EU.

Selected national penalties

This is an illustrative comparison of selected offences, not a ranking of which country punishes cybercrime most harshly. The maximum for unauthorised access cannot automatically be applied to phishing, ransomware, identity theft or online fraud. Those may fall under different provisions.

What can make a cybercrime case more serious?

The available sentence may depend on more than the name of the offence. Factors recognised by the relevant law can include:

• Financial harm: the amount lost and the circumstances of a fraud may affect the charge or sentence.
• Multiple offences: an intrusion followed by theft, extortion and fraud may involve several charges.
• Scale and duration: the number of victims, extent of the conduct and length of the operation may be relevant.
• Essential services: certain laws provide enhanced penalties for specified attacks against protected systems or critical infrastructure.
• Organised criminal activity: participation in a criminal organisation may be relevant where the law provides for it.
• Criminal proceeds: laundering or handling proceeds of crime may lead to separate charges.

These factors do not operate identically in every jurisdiction. The applicable legislation and sentencing rules must be checked before making a claim about a particular case.

Why cybercrime remains difficult to measure and prosecute

Digital crimes can cross borders almost immediately. A victim may live in one country, the suspect may operate from another, the data may be hosted elsewhere, and the proceeds may pass through several financial services.

Investigators may need evidence from overseas companies, records that disappear quickly or information held in encrypted or closed channels. They may also need to distinguish the person who carried out an attack from those who supplied tools, handled stolen information or moved the proceeds.

Reporting creates another difficulty. Some victims do not report crimes because they are embarrassed, fear reputational damage or believe nothing can be done. Others report to banks, platforms or specialist organisations rather than the police. Agencies may use different definitions and recording systems.

That is why an official complaint total is not the same as the actual number of offences committed. It is also why threat-intelligence reports and police statistics can tell different stories: they observe different parts of the problem.

Also see: UK Cybercrime Statistics 2026 for a closer look at cybercrime trends in the United Kingdom.

How to protect yourself from common cybercrime

The most useful response is to make common criminal methods harder to carry out successfully.

• Verify unexpected messages independently. Do not rely on a link or phone number included in a suspicious message. Visit the service’s official website or contact the organisation through a trusted channel.
• Use unique passwords. A password manager can help prevent one stolen password from unlocking several accounts.
• Enable multifactor authentication. Prefer phishing-resistant methods where available, particularly for important email, financial and work accounts.
• Verify payment changes. Confirm new bank details using a contact method you already trust, not the number or link in the payment request.
• Be cautious with remote access. Do not give unexpected callers control of your computer or phone.
• Keep software updated. Security updates can fix vulnerabilities that criminals may exploit.
• Back up important files. Keep backups protected from unauthorised access or deletion through your main account.
• Act quickly after an incident. Contact your bank or payment provider, secure affected accounts, preserve messages and transaction records, and report the incident to the appropriate authority.

No single measure prevents every attack. The aim is to reduce the chance of becoming a victim and limit the damage if something goes wrong.

A note from law enforcement

In the FBI’s published 2024 Internet Crime Report, FBI Director Kash Patel emphasised the importance of reporting suspected internet crime:

“Reporting is one of the first and most important steps in fighting crime so law enforcement can use this information to combat a variety of frauds.”

The practical point is that preserving evidence and reporting an incident can help investigators identify patterns and connect cases. Victims should also contact their bank or payment provider quickly if money or payment details are involved.

Source: FBI, “FBI Releases Annual Internet Crime Report”.

Sources and methodology

This guide draws on official statistical publications, cybersecurity threat assessments, international legal frameworks and national legislation. These sources help explain the scale of cybercrime, how different offences operate and the penalties provided by law. Statistics and legal provisions are attributed to their respective issuing organisations.

Official statistics Office for National Statistics: Crime in England and Wales

Survey estimates for fraud and computer misuse in England and Wales for the year ending June 2026.

US crime reporting FBI Internet Crime Complaint Center: 2025 Annual Report

Complaints, reported financial losses and categories of internet crime recorded by the FBI’s IC3.

Historical data FBI IC3 Annual Reports

Earlier reporting periods and category definitions used to put reported internet crime trends into context.

Threat intelligence ENISA: Threat Landscape 2026

Analysis of observed cybersecurity incidents and threats during January to December 2025.

Organised cybercrime Europol: Internet Organised Crime Threat Assessment

Law-enforcement analysis of organised online crime, criminal methods and emerging threats.

International framework Council of Europe: Budapest Convention

An international framework for cooperation and laws addressing specified cybercrime offences.

European Union law Directive 2013/40/EU

EU rules addressing attacks against information systems.

Payment fraud law Directive (EU) 2019/713

EU rules concerning fraud and counterfeiting involving non-cash payment instruments.

United Kingdom legislation Computer Misuse Act 1990

UK offences involving unauthorised computer access and specified acts affecting computer systems.

United Kingdom legislation Fraud Act 2006

UK offences involving fraud by false representation, failure to disclose information and abuse of position.

United Kingdom legislation Theft Act 1968, Section 21

The statutory offence of blackmail in the relevant UK legal context.

United States legislation US Code, Title 18, Section 1343

The federal wire-fraud statute, which may apply to certain online fraud prosecutions.

France legislation French Penal Code

National criminal provisions, including specified offences involving access to computer systems.

Germany legislation German Criminal Code

National provisions covering specified forms of unauthorised access to protected data.

Spain legislation Spanish Penal Code

National criminal provisions, including specified unauthorised access offences.

Netherlands legislation Dutch Criminal Code

National provisions concerning computer trespass and related conduct.

How to interpret the evidence: Survey estimates, complaints received by law enforcement and observed cybersecurity incidents measure different things. They should not be treated as interchangeable or as a complete count of worldwide cybercrime. Legal penalties are summaries of specified provisions; maximum penalties are not the same as sentences actually imposed. Laws can change, so the applicable provision and its current wording should be checked before publication.

Important limitations

The statistics in this article do not all cover the same period or population. The overall IC3 complaint and loss figures are from 2025, while several individual IC3 category counts cited above are from 2024. They are labelled separately for that reason. The ONS figures cover England and Wales, not the whole United Kingdom. ENISA’s dataset is a threat-intelligence assessment, not an EU-wide police complaint database.

The 20 categories are not mutually exclusive. Some describe methods, some describe legal offences, and others describe the target or impact of an attack. They should not be added together as if each represented a distinct incident.

Finally, statutory maximum penalties are not typical sentences or guarantees of imprisonment. The legal examples should be checked against current consolidated legislation before publication, particularly where the precise offence, jurisdiction or aggravating circumstances may change the available penalty.