“$262 Million Lost to Account Takeover Scams in 2025: What You Need to Know”

According to the FBI, cybercriminals have stolen approximately $262 million in 2025 through “account takeover” scams. Most of these cases involved unauthorized access to financial, payroll, or health-savings accounts. Attackers typically use social engineering tactics, such as phishing emails, fake calls, text messages, or fraudulent websites, to trick users into revealing their credentials, OTPs, or MFA codes. Once they obtain these details, attackers log into the accounts, reset passwords, lock out the legitimate owners, and quickly transfer funds to accounts under their control, often using crypto wallets to make tracing difficult. AI-powered phishing and “holiday-themed” scams have also increased, including fake e-commerce stores, mobile phishing, and brand impersonation, which appear more realistic and are more effective in deceiving victims.

The FBI has provided key safety tips: avoid sharing personal information, such as pet names, family details, or birth dates, on social media or public platforms; use unique and strong passwords for each account and always enable multi-factor authentication (MFA/2FA); access login sites through direct URLs or bookmarks rather than search ads or suspicious links; regularly monitor your financial accounts for unusual transactions and investigate immediately; and if a scam occurs, inform your bank or financial institution, reset your credentials, and file a fraud report.