Online Scam Prevention: The 12 Scams That Stole $10 Billion in 2024

Online Scam Prevention: The 12 Scams That Stole $10 Billion in 2024

My mother called me in tears two years ago. She had spent three weeks communicating with someone she met on Facebook who claimed to be a retired military officer widowed in Germany. He was charming, attentive, and had asked her to invest in a "business opportunity" he was developing. She had transferred $8,400 before a friend raised concerns and she called me.

We caught it before she sent more. The "military officer" was operating from West Africa, using stolen photos of an actual American soldier, with scripts specifically designed to target recently widowed women in their 60s. The FBI estimates thousands of Americans lose money to the same operation every year.

Online scams stole an estimated $10.3 billion from Americans in 2023, according to the FBI's Internet Crime Complaint Center (IC3) — a figure that represents only reported losses. The real total is likely two to three times higher. The reason scams succeed isn't that victims are foolish. Scams succeed because they are sophisticated, psychologically calibrated, and designed by professionals who do this full time.

This guide covers the 12 most costly scam types, how to identify each instantly, and exactly what to do if you've been targeted.

The Scam Landscape: What the Data Actually Shows

The FBI's 2023 Internet Crime Report documented 880,418 complaints with losses exceeding $12.5 billion. The FTC's own data for the same period shows 2.6 million fraud reports with $10 billion in losses. The discrepancy reflects different reporting mechanisms — the real number is somewhere between and above both.

The fastest-growing fraud categories are investment fraud (particularly cryptocurrency scams), impersonation fraud, and tech support scams targeting older adults. Romance scams, while not the largest category by volume, generate the largest average individual losses.

For general online safety context, see our online safety resource library and our cybersecurity fundamentals guide.

The 12 Most Costly Online Scams in 2024

Deep Dive: Crypto and Investment Fraud

Cryptocurrency and investment fraud is now the costliest scam category in the United States. The FBI reported $3.94 billion in cryptocurrency investment fraud losses in 2023 — a 53% increase from 2022. The primary mechanism is a scam type called "pig butchering" (translated from the Chinese term "sha zhu pan").

In pig butchering, a scammer establishes a long-term relationship with a target — sometimes taking weeks or months to build trust through daily messaging — before introducing an "investment opportunity." The target is initially allowed to make small "withdrawals" to build confidence, then encouraged to invest larger amounts. When they try to withdraw substantial funds, they're told they owe taxes or fees first. The money is gone.

I've spoken with victims of pig butchering who lost $50,000 to $300,000. These were not unsophisticated people. They were professionals who were simply deceived by someone who invested significant time in building a relationship before making any financial ask.

The single most reliable indicator of investment fraud: guaranteed or unusually high returns with low risk. No legitimate investment offers guaranteed returns. Anyone promising them is lying.

Resources: Report investment fraud to the FTC at ReportFraud.ftc.gov and to the FBI's IC3 at ic3.gov.

Deep Dive: Phishing and Its Sophisticated Variants

Standard phishing — fake emails mimicking trusted brands — has evolved. The current threat landscape includes:

Spear phishing targets specific individuals using personalized information gathered from social media and data breaches. A spear phishing email might reference your name, your employer, a recent purchase, or other specific details to appear more credible.

Smishing (SMS phishing) sends fake text messages appearing to be from delivery services, banks, or government agencies. These are particularly effective because SMS messages feel more immediate and personal than emails.

Vishing (voice phishing) uses phone calls, increasingly with AI-cloned voices of known individuals or convincing synthetic voices mimicking company representatives.

Quishing uses QR codes in physical mail or print materials that lead to phishing sites. This vector bypasses email security filters entirely.

The defense against all phishing variants is the same: never use contact information or links provided in an unexpected communication. If you receive an urgent message from your bank, hang up or close the email, then call the number on the back of your card or go directly to the bank's website by typing the address.

Romance Scams: Why Smart People Get Fooled

My mother is an intelligent woman who reads widely and managed her own business for twenty years. She was still nearly defrauded of her savings by a romance scam. This is worth understanding: intelligence is not protection against these scams because they target emotional needs, not logical ones.

Romance scammers specifically look for individuals who are recently widowed, divorced, or experiencing loneliness. They work in teams, with scripts developed through extensive testing. The relationships are built slowly and deliberately, with the scammer investing significant time because the eventual payoff can be enormous.

Warning signs specific to romance scams:

The person cannot meet in person, always has a reason (military deployment, overseas job, family emergency). They escalate emotional intimacy very quickly. They introduce financial requests in the context of emergencies or opportunities that only require "temporary" help. They are always too busy or too far to video chat (and if they do video chat, the image may be blurry or the timing choppy — possibly because they're playing pre-recorded video).

Verification technique: Reverse image search every photo using Google Images or TinEye. Romance scammers use stolen photos of real people — often military personnel, doctors, or engineers — and reverse image search will often find those photos on legitimate profiles belonging to other people.

If you've been in a romance scam situation: The FBI's romance scam resources are helpful, and the organization StopRomanceScams.org provides peer support from other survivors, which many victims find valuable because of the shame barrier that prevents seeking help.

What to Do If You've Been Scammed

Acting quickly matters enormously. Here are the steps by payment type:

Credit card payment: File a dispute with your card issuer immediately. Under the Fair Credit Billing Act, card issuers must investigate disputes and you're generally not liable for fraudulent charges. This is the most recoverable payment method.

Bank wire transfer: Call your bank immediately — same day if possible. Banks can sometimes initiate a SWIFT recall within 24-72 hours. After 72 hours, recovery becomes nearly impossible. File a report with your bank's fraud department and request they contact the recipient bank.

Zelle, Venmo, Cash App: These platforms generally consider authorized transactions (where you sent the money, even if under deception) as non-refundable. File a dispute and explain the fraud, but recovery rates are low. Report to the FTC regardless.

Cryptocurrency: Almost never recoverable. Report to the FBI's IC3 and the FTC. If the platform has a U.S. presence, report to the appropriate financial regulator. Some exchanges freeze funds when law enforcement contacts them quickly, but this is rare.

Gift cards: Essentially unrecoverable. Report to the FTC and the specific gift card company — some have fraud departments that can sometimes freeze unused balances.

Reporting Resources Table

After reporting, consider placing a fraud alert or credit freeze with the major credit bureaus (Equifax, Experian, TransUnion) if any personal information was shared with the scammer. Our identity theft protection guide covers this in detail. You can also find our downloadable scam prevention checklist at /notes.

Frequently Asked Questions

What should I do immediately after realizing I've been scammed online?

Act within the first 24 hours for the best chance of recovery. Contact your bank or payment processor immediately — many can reverse transactions or freeze payments if you act fast enough. Report to the FTC at ReportFraud.ftc.gov. Change passwords on any accounts that were involved. If you sent cryptocurrency, contact the exchange immediately. Document everything: screenshots, emails, transaction IDs, and the timeline of contact.

Can you get your money back after an online scam?

It depends heavily on how you paid. Credit card payments offer the best recovery chance — dispute the charge as fraud and your card issuer is legally required to investigate. Bank wire transfers are very difficult to reverse, but report immediately. Cryptocurrency payments are almost never recoverable. Zelle, Venmo, and Cash App payments to strangers are usually not recoverable. Gift card payments are essentially unrecoverable.

What are the most common signs of a phishing email?

The most reliable indicators: a sender email address that doesn't match the company's actual domain, urgency creating pressure to act immediately, requests for passwords or payment information via email, links that don't match the stated destination (hover to preview), unexpected attachments, and grammar that seems off. Legitimate companies never ask for your password via email and never threaten immediate account closure requiring immediate payment.

Are romance scams as common as reported?

Romance scams are severely under-reported, so official statistics undercount the actual prevalence. The FTC reported $1.14 billion in romance scam losses in 2023 alone. The average romance scam loss is over $10,000, with many victims losing their entire savings. Shame prevents reporting, so the real number is likely two to three times the reported figure.

How do I verify if an online store is legitimate before purchasing?

Check these in order: look up the domain age on Whois.domaintools.com (scam sites are usually less than six months old), search the business name plus "scam" or "review" on Google, verify a physical address using Google Street View, check that the site uses HTTPS, look for a real phone number and call it, and be suspicious of prices significantly below market rate. Use a virtual credit card for first purchases from unknown stores.