The Threat Is Real. The Statistics Often Aren’t.

AI fraud is real, growing, and worth taking seriously. Almost every number you have read about it is not. The field is flooded with vendor statistics — astronomical totals and four-digit "surge" percentages — that share no baseline, no methodology, and a clear commercial interest in alarm. This year, for the first time, one independently audited figure arrived to anchor the conversation, and it tells a more modest, more useful story than the marketing.

What Happened

For the first time in roughly a quarter-century of reporting, the FBI's Internet Crime Complaint Center (IC3) broke out AI-enabled fraud as its own category — placing a single, independently audited dollar figure into a space that had been filled almost entirely by companies marketing detection products. Within that audited category, investment fraud dominated at roughly 71% of losses (about $632 million), followed distantly by business email compromise (~$30 million), romance and confidence scams (~$19 million), and deepfake job-interview employment scams (~$13 million); adults aged 60 and over bore about 39% of the total. Separately, the World Economic Forum's 2026 Global Risks Report again ranked misinformation and disinformation the most severe short-term global risk, citing AI deepfakes and synthetic audio capable of deceiving even informed audiences.

Set against that audited baseline, much of the widely circulated data collapses. Analysts who have tried to verify the popular figures find that headline claims such as "$1.8 billion in voice-cloning losses" or "$2.3 billion stolen from the elderly per the FBI" have no traceable primary source and, in some cases, directly contradict the audited report. Vendor "surge" percentages — 2,100%, 1,300%, a projected 3,892% rise in document deepfakes — routinely omit any baseline or methodology, and in at least one case a single vendor's quarterly incident count exceeded its own reported full-year total. The bulk of the alarming attack-surface data comes from firms that sell detection and verification, a conflict of interest those statistics pages almost never disclose.

Why It Matters

Bad numbers are not harmless. They misdirect defensive spending toward whatever a vendor is selling, they feed the "liar's dividend" by making the whole threat sound like hype so that real warnings get dismissed, and they corrode the credibility of the field precisely when clear-eyed assessment matters most. A threat described in inflated, unverifiable figures becomes easy to either panic over or wave away — and both reactions are failures. Getting the size of the problem roughly right is the precondition for responding to it proportionately. This is warrier's core discipline, applied to the threat industry itself.

advertising