Trust is the Real Casualty of the $68 Billion Scam Economy

U.S. adults lost $68 billion to online scams in 2025, according to a study earlier this year from the Stop Scams Alliance and Gallup.  

Perhaps more notably, $68 billion is more than four times what the U.S. Federal Trade Commission’s own complaint data captured for the same year, showing that most scams never reach it. Instead, they land in a bank’s fraud queue, a payment app’s “dispute charge” form, or a customer support email inbox.  

There are several reasons why reported fraud numbers are always lower than the actual amounts like embarrassment over being scammed and not knowing how to report.

But this report that Netcraft co-sponsored alongside partners like JPMorgan Chase, Meta, AT&T, and a dozen others across finance, tech, and telecom gives us a better idea of how much. And outside of the actual dollars scams can cost your brand and customers, it also speaks to the reputational damage that you can’t put a value on. 

The stats that matter most to us 

One line in the report really stood out to us: two in five scams (40%) involved a fraudulent website collecting financial or personal information. That was the single most commonly measured element across every scam type Gallup asked about. Usually we think of scams involving cold phone calls with a script, “love bombing,” and fake gift card requests, but something as basic as a fake website can be just as convincing to a potential victim.  

But a scam victim doesn't just lose money. They call their bank, dispute charges, and maybe eventually stop trusting a checkout flow that looked identical to a hundred legitimate ones they've used before.  

And somewhere on that fraudulent website is a real company whose name, logo, or domain pattern got borrowed to make the con work. That company's fraud, support, and legal teams absorb a cost that can’t be measured cleanly. 

Another point about that 40% number; a fake website is a real domain registered through a registrat, sitting on a hosting account, usually with a certificate issued by a CA. Every one of those parties has an abuse inbox, which makes the fake site the part of the scan that can actually be removed from the internet.  Two in five is a big number, and the most actionable number from the study.  

The entry points are the business's own front door 

The most common ways scams started in 2025 included making a purchase on a website (17%), receiving a phone call (15%), seeing a social media post (12%), and getting a text message (10%). 

These are the exact channels legitimate businesses built to serve customers, not some dark corner of the internet. Scam prevention isn't adjacent to customer experience. It's happening inside it, on the same channels your team owns. 

When scammers need a victim to act fast and ask fewer questions, they can “borrow” an identity that consumers are inclined to trust: a tech support professional (19% of scams), a bank or credit union employee (15%), someone from government or law enforcement (14%), a financial advisor (13%). 

These are the institutions people are trained to comply with quickly, which means every legitimate bank, advisor, and support desk inherits a credibility tax it did nothing to earn. 

The damage that outlasts the scam 

Financial hardship is the visible cost the survey puts a number on, but the one that compounds quietly is trust. 

Nearly three-quarters of people whose household was scammed (73%) said it hurt their mental health or wellbeing, and that number barely drops (65%) even among people who weren't the one who got scammed, just someone who shared a home with the victim. The damage spreads past the person who clicked the link. 

It spreads past the money, too. Victims described a lasting hesitation to buy from sites that had nothing to do with the scam that hit them. That's a switching-cost problem for every business in the impersonated category, not just the fake one.One convincing con doesn't just cost the scammer's target, it takes a toll on every legitimate competitor in the same lane, including the ones who did absolutely nothing wrong. 

We’ve heard this directly from a UK apparel brand who told us the risk they worry about isn’t necessarily the individual fraud loss, it’s a customer believing they bought from that brand when they didn’t. That alone destroys confidence, even when no money is moved.  

Who actually bears the cost 

The median loss reported in a scam was $500 in 2025, according to the Gallup poll. The average was $5,578. That gap tells us that this isn't a uniform problem: a small slice of victims are absorbing losses in the thousands, and dragging the average up with them. Twenty-one percent of affected households called it a “severe” financial hardship. Another 25% called it “moderate.” 

Those are regular consumers in the market. A decent chunk of the people your business serves are carrying this into their next interaction with a checkout page, a support call, or a "your account needs verification" text.  

Spotting it isn’t stopping it 

Scam prevention has mostly been treated as a consumer-education problem. Teach people to spot the fake email, hang up on the fake call, check the URL twice before you type anything into it, don't trust caller ID. Businesses have an enterprise version of the same advice: buy feeds, more monitoring, get alerted when a lookalike domain shows up. 

All of that works right up to the point where you've found something. Then what? A fake site you know about and can't get removed is still collecting card numbers. It's now also a ticket in somebody's queue. 

The step that gets underestimated is everything after detection. Getting a domain suspended or a page pulled means persuading a registrar, hosting provider, or platform to act on your report. Their abuse desks are buried. They receive thousands of these a week from senders they've never heard of, with wildly varying evidence and wildly varying accuracy, and a report that amounts to “we think this one is fake” goes into the same pile as everybody else's. 

What moves a report to the front of that pile is evidence the provider can act on without doing the investigation again themselves, sent by somebody whose last ten thousand reports were correct. That standing takes years to build and it can't be bought in a hurry. Netcraft has been submitting evidence to these providers for two decades, at a volume they can't triage around. Providers are the ones who act. Our job is to make acting easy and to make ignoring it hard. 

Where this leaves us 

The damage doesn't stay contained to the person who got scammed. It radiates out to every business whose name got borrowed, every competitor in the same category, and every customer who’s now a little slower to trust the next legitimate message that looks exactly like the last fake one. 

That's a brand protection problem, a fraud problem, and a security problem, and right now most companies staff those as three separate conversations. 

This report, funded by a coalition that includes Netcraft alongside banks, telecoms, and platforms who all have the same stake in this, exists because the visibility gap it documents is real: only 13% of scams ever reach the FTC or federal law enforcement. The rest happen in the dark, absorb one household, one company, one damaged shred of trust at a time. Closing that gap starts with seeing more of it and finishes with taking more of it down because a fake site that’s been spotted, logged, and remains online is working perfectly well for the person who built it.