The Outlier Lab

Reports and Data Sources

The recurring reports and datasets transaction fraud teams cite, what each is actually good for, and the caveats that keep you from misusing the numbers.

Reading fraud statistics without fooling yourself

BiasWhat it doesWhere it bites
Victim-reporting biasOnly some victims report, and reporting rates vary by age, loss size, embarrassment and awarenessFTC Sentinel, FBI IC3. Both are floors on the true volume
Definitional drift"Fraud," "scam," "dispute," "abuse" and "loss" mean different things across sources and yearsComparing UK Finance with US sources; card vs ACH; retail "returns fraud" vs "abuse"
Survey self-selectionRespondents are members or customers of the publisher, often larger firmsAFP, MRC, ABA, vendor surveys
Vendor incentiveThe publisher sells a solution to the problem being measuredMost vendor "state of fraud" reports. Read the method section first
Gross vs netSome figures are attempted or exposure amounts, others are net losses after recoveryFinCEN SAR amounts (include attempted), card loss figures
Year-over-year artifactsNew categories, intake changes or a single mega-case can swing totalsIC3 crypto and investment categories; FTC category re-coding
Double countingThe same incident can appear in multiple datasetsIC3 complaints are shared with FTC; SARs filed by multiple institutions

U.S. government sources

FTC Consumer Sentinel Network

  • What it is. The FTC's law-enforcement database of consumer reports about fraud, identity theft and other consumer protection issues. Reports come from the public and from data contributors such as other agencies and the Better Business Bureau. The FTC publishes an annual Data Book, quarterly-updated interactive dashboards on Tableau Public (via Explore Data), and topical Data Spotlight posts.
  • Headline numbers. For 2024, consumers reported losing more than $12.5 billion to fraud, about 25% more than 2023. Report volume was roughly flat at about 2.6 million fraud reports. The jump came from a higher share of reporters losing money (38%, up from 27%). Investment scams led losses ($5.7B) and impostor scams were second ($2.95B). Bank transfers and crypto together exceeded all other payment methods. Sentinel took in 6.5 million reports of all types in 2024.
  • Good for. Scam typology trends, payment-method trends (which rails scammers push victims onto), contact-method trends (email, phone, text, social), age-band patterns, state and metro maps. Data Spotlight posts are the fastest way to see an emerging pretext. An April 2026 spotlight reported $2.1 billion in 2025 losses to scams that started on social media, about eight times the 2020 figure.
  • Caveats. These are unverified consumer reports from people who chose to file. Underreporting is heavy and varies by group. Reports are kept for five years. Categories get re-coded, so check definitions before trending across years.
  • Use in the vault. Supports Authorized Push Payment (APP) Scams, Impersonation Scams, Investment Scams (Pig Butchering), Gift Card Fraud and Customer Education and Scam Warnings.

FBI Internet Crime Complaint Center (IC3)

  • What it is. The FBI's central intake for cyber-enabled crime complaints. It publishes an annual Internet Crime Report, state-level reports, periodic Elder Fraud reports, and Public Service Announcements (PSAs) on emerging schemes.
  • Headline numbers. 2024: 859,532 complaints, $16.6 billion in reported losses, up 33%. 2025: 1,008,597 complaints, the first year above one million, and $20.877 billion in losses. Investment fraud was the largest category ($8.65B), followed by BEC ($3.05B) and tech/customer support scams ($2.13B). Complainants aged 60+ reported $7.75B. Crypto-linked losses were $11.37B.
  • Good for. Scam and BEC loss sizing, the elder-fraud share, crypto as a cash-out rail, and PSAs as early warnings. Recent PSAs cover law-enforcement impersonation and couriers collecting cash in crypto investment scams.
  • Caveats. Complaint-based, so the same reporting biases as Sentinel apply. A few very large losses dominate the investment and BEC totals. BEC is out of scope for this vault except as a rail pattern. Category definitions differ from the FTC's.
  • Use in the vault. Elder Financial Exploitation, Investment Scams (Pig Butchering), Generative AI and Deepfake Fraud, Money Mules.

FinCEN: SAR Stats, Financial Trend Analyses, alerts

  • SAR Stats (sarstats.fincen.gov, linked from FinCEN). Aggregate suspicious activity report filing data by industry, suspicious activity type and geography, with historical filing trend data. Good for seeing which typologies institutions are reporting and how filing volumes move. Caveats: it measures filing behavior, which is only a proxy for fraud. Amounts include attempted activity. One incident can generate multiple SARs. Filing practices differ by institution.
  • Financial Trend Analyses (FTAs). Detailed analyses of BSA data on a single theme. Two examples worth reading:
    • Mail Theft-Related Check Fraud (Feb–Aug 2023): 15,417 reports and about $688M in activity. Altered checks were about 44% and counterfeit about 26%, and perpetrators preferred ATMs and remote deposit capture. See Check and Mobile Deposit Fraud.
    • Identity-Related Suspicious Activity: 2021: about 1.6M of 3.8M BSA reports were identity-related, about $212B in activity, split into impersonation, compromise and circumvention. See Frameworks and Taxonomies.
  • Alerts and advisories contain red-flag lists and SAR key terms, and they are often the best public description of a typology. Details are in Regulatory and Government Sources.

Federal Reserve

  • Federal Reserve Payments Study (FRPS). The benchmark estimate of U.S. noncash payment volumes and values by rail, with periodic fraud measures. The July 2026 release covers national volumes through calendar 2024, and a March 2026 release covers the top 100 depository institutions. Good for denominators: you need rail volumes to turn fraud counts into rates. Caveat: fraud estimates are not in every release, so check which cycle covers fraud.
  • FedPayments Improvement resources: the FraudClassifier/ScamClassifier models, Fraud Mitigation Toolkits, and a 2026 Payments Fraud Trends Survey run by Federal Reserve Financial Services. See Frameworks and Taxonomies.

CFPB Consumer Complaint Database

  • What it is. Complaints the CFPB sent to companies, published after the company responds or after 15 days. Downloadable as CSV or through an API, generally updated daily.
  • Good for issue-level text mining: P2P scam disputes, Reg E error-resolution complaints, account freezes. Also good for comparing complaint themes across peers, normalized for size.
  • Caveats. Not a statistical sample. Complaints referred to other regulators aren't published. Volume tracks company size and consumer awareness as much as underlying fraud. See Regulation E and Unauthorized Transfers.

Nacha ACH volume statistics

Network volume and value by quarter and year. These are the denominator for ACH return-rate benchmarking (Nacha Rules and ACH Risk, ACH Funding Fraud).

Industry and association reports

ReportPublisherCadenceGood forCaveats
Global eCommerce Payments and Fraud ReportMerchant Risk Council (MRC), with Visa Acceptance Solutions and Verifi; fieldwork by B2B InternationalAnnualMerchant fraud cost as % of revenue, attack trends, tool adoption, post-purchase abuseMember-skewed merchant sample; self-reported
Occupational Fraud: A Report to the NationsACFEBiennialInsider fraud patterns, detection methods (tips), median lossesCovers occupational (insider) fraud only; cases come from CFEs who investigated them
Consumer Returns in the Retail Industry / Total Retail LossAppriss Retail (with Deloitte for 2024)AnnualReturns-fraud and abuse sizing by channelVendor-published; model-based estimates
Retail Returns LandscapeNational Retail Federation with Happy Returns (a UPS company)AnnualReturn volume, consumer attitudes, retailer-estimated fraud shareRetailer- and consumer-survey based
Data Breach Investigations Report (DBIR)VerizonAnnualCredential abuse as an initial vector, credential stuffing share of auth trafficBreach-focused; dataset composition changes yearly
State of PasskeysFIDO AllianceAnnualPasskey adoption and awarenessIndustry body promoting the standard
APP scams reimbursement dashboardUK Payment Systems RegulatorQuarterlyReimbursement rates, claim volumes, speed under mandatory reimbursementFaster Payments only; reported by sending firms

Selected verified figures

  • MRC 2026 report (fielded Nov–Dec 2025; 1,278 merchants in 37 countries): payment fraud cost merchants 3.2% of eCommerce revenue. 62% saw rising first-party misuse disputes and 57% saw rising refund or policy abuse. 45% named real-time payment fraud as the next big attack, and 63% were exploring or planning agentic AI payments. See Chargeback and Friendly Fraud, Refund and Return Fraud, Agentic Commerce Fraud.
  • ACFE 2024 edition: 1,921 cases, $145,000 median loss, an estimated 5% of revenue lost to occupational fraud, and 43% of cases detected by tips. The 2026 edition analyzes 2,402 cases from 143 countries. See Insider Fraud.
  • Appriss Retail with Deloitte (2024 data): returns of $685B, with $103B (about 15%) attributed to fraudulent returns and claims. Wardrobing was reported by 60% of retailers. Appriss 2026 Total Retail Loss Benchmark (2025 data): $706B returned, with about 14% deemed preventable loss from fraud and abuse. Buy-online-return-in-store was called the fastest-growing fraud and abuse vector. See Refund and Return Fraud, Retail and Ecommerce.
  • NRF and Happy Returns 2025: retailers expected about $850B in returns, about 15.8% of sales, and estimated 9% of returns as fraudulent.
  • Verizon DBIR 2025 research: compromised credentials were the initial access vector in 22% of breaches. Credential stuffing made up a median 19% of daily authentication attempts in SSO logs studied. See Credential Stuffing.
  • PSR dashboard (Oct 7, 2024 – Mar 31, 2026): 88% of money lost to in-scope APP scams (£316M) was reimbursed, across about 438,000 reported claims. The PSR notes its figures aren't directly comparable with UK Finance's. See Case Study - UK APP Scam Reimbursement Rules (2024).

Datasets for modeling and benchmarking

Public fraud datasets are mostly synthetic or anonymized. They are useful for teaching, tooling and benchmarking methods. They are not useful for estimating real-world performance on your traffic.

Dataset or simulatorWhat it isGood forCaveats
PaySimAgent-based mobile-money transaction simulator calibrated on one real service's logsTeaching, prototyping rules and features on P2P-like flowsSingle synthetic economy; fraud patterns are simplistic
AMLSim (IBM)Simulator generating transaction graphs with laundering typologiesGraph features, Money Mules and ring detection prototypesSynthetic; AML-oriented
Fraud Detection Handbook simulated dataSimulated card transactions with reproducible notebooks (Le Borgne, Siblini, Lebichot, Bontempi)Learning validation pitfalls on time-ordered, imbalanced dataCard-only; simulated
ADBench (NeurIPS 2022)Benchmark of anomaly detection algorithms across many datasetsComparing unsupervised methods before you pick oneNot fraud-specific

Repos and licenses are in Open Source Tools for Fraud Teams.

Building your own data sources

External reports tell you what is happening somewhere. The data that tells you what is happening to you is internal:

Sources and further reading