Americans reported a record $15.9 billion in losses last year to the Federal Trade Commission, and the AP and FRONTLINE investigation found that victims still have little recourse while the European Union rolls out rules that could make financial institutions potentially liable if they don’t put in adequate fraud protections. The numbers are brutal. The machinery around them is familiar. People lose the money, then they get to meet the institutions.
The investigation said the United States fails to help scam victims get money back, even after attempts by both the Trump administration and Congress to fight scams. It interviewed 58 people in the United States who lost money to cyberscams, aged 32 to 90, across all races and income levels. Their losses ranged from several thousand dollars to $4 million each. Doctors, IT professionals, academics with advanced degrees and people just trying to make ends meet all ended up in the same place: stripped, ignored, and told to wait.
The State Leaves the Bill Behind
Simon, who asked not to be identified by his full name because he is too ashamed to tell most of his family about the crime, said a scammer stole $800,000 from his retirement savings after he sought companionship online following the death of his wife of 43 years. He said he met Emily online, later realized she was fake, and then lost the money over the next few months. He said he was stuck paying back $185,000 he had borrowed and tens of thousands of dollars in additional taxes on money he had withdrawn and lost. He said he tried to report the crime to his local police and the FBI, but nothing came of it. He said another scammer later contacted him, offering to connect him with the Secret Service to recoup his losses in exchange for more money. Simon said, "What a fool I was." He also quoted police as telling him, "You have to kiss that money goodbye," and said, "Already I experienced something very bad and now I have to pay for the consequences on top of it, and see my money evaporate all over again. You lose two ways."
Debra Fox said she lost $58,000 in a romance scam. She said a bank representative told her she would be held responsible for anything fraudulent linked to her own accounts and forced to pay any legal fees. She said, "I thought, I have no control over this process," and added, "The crime was horrific enough… but it’s what happened next that was really unbelievable to me."
Alice Lin, now 83, said she and her late husband had saved about $720,000 over their lifetimes before an online scammer stole it. She said she later sued JPMorgan Chase for failing to protect an elderly citizen and flag the extraordinarily large and unusual transfers. Her lawyers said the case settled earlier this year for an undisclosed amount. JPMorgan Chase said it had multiple layers of scam protection, including bankers who asked Lin about her transactions and written warnings, and said settling the lawsuit "was a business decision weighed with the cost of litigation on this matter." Lin said the scammer, Justin, convinced her to take out money from her bank and invest it in cryptocurrency platforms. She said her financial statements initially showed big wins, but her family realized it was a scam when Justin urged her to ask her daughter for a loan to invest more. Lin said, "Are you still alive?" was a message she later saw from the scammer, and she replied, "I’m alive and I’m going to fight back."
Banks, Platforms and the Liability Gap
Brian Glick said a scammer stole $575,000 from him online. He said he called the FBI, an elder abuse hotline, the Securities and Exchange Commission and the New York State Attorney General, filed complaints at IC3.org and FightCyberCrime.org, collected thousands of screenshots and turned them over to federal investigators, and kept talking to the scammer to draw out more information. He said the FBI went to cryptocurrency company Tether to try to freeze and claw back funds linked to his investment, but Tether refused. Tether CEO Paolo Ardoino said he wasn't familiar with Glick's situation, but said there are countless examples of the company's work with law enforcement. After being given more details, including Glick's wallet addresses, Tether had no further comment. Glick said, "There are so many victims of these cybercrimes. And we can’t get our money back."
The report said banks also sometimes blame people who are scammed instead of seeing them as crime victims, or even accuse them of being complicit. It said victims described having their accounts abruptly frozen or canceled, along with demands for repayment on loans and legal fees. It said American Bankers Association Chair Kenneth Kelly said banks spend "time, money and significant resources" trying to stop fraud, which usually refers to unauthorized transactions, but under current U.S. law financial institutions are rarely liable for transactions their customers authorize. It said there are rare workarounds, including a theft from a senior citizen in California that might fall under the definition of financial elder abuse.
The report said the U.S. is taking steps to improve cooperation with the private sector on fighting scams but, unlike a growing number of other countries, has stopped short of requiring companies to do more to protect consumers or face financial penalties. It said eight in 10 Americans across political lines said the U.S. government isn't doing enough to protect them against scams, according to a new Gallup survey, and more than half said financial institutions, social media and tech companies and the federal government should also share responsibility, according to new AP-NORC polling.
Fortress Europe Tightens the Rules
Since late 2024, financial services companies in the United Kingdom have generally had to reimburse clients tricked into sending money to scammers, giving them an incentive to invest in prevention measures. The downside has been slower bank transfers, the need for more employees and sometimes a conversation to explain why a customer might want to transfer money. The European Union is also rolling out rules that make financial institutions potentially liable for scammed funds if they don't put in adequate fraud protections, and the EU's Digital Services Act, passed in 2022, requires platforms to quickly act on reported scam content and take broader steps to reduce online fraud. In the UK, trained social workers are sometimes sent to the homes of scam victims to address the emotional fallout. Louise Baxter, who serves on the Home Office Joint Fraud Task Force, said, "You wouldn’t ever say to a victim, ‘Why did you fall for a mugging? Why did you fall for a burglary?’" and added, "It’s secondary victimization, from a law enforcement perspective and a societal perspective."
New regulations in Australia spread responsibility for preventing scams, with financial institutions, telecommunications companies and digital platforms able to be fined or forced to compensate victims if they don't do enough to prevent and respond to scam activity. Singapore's protections are among the strictest. Under the government's Shared Responsibility Framework, banks and telecom companies may have to repay victims of certain phishing scams if they fail to implement required safeguards. The Protection From Scams Act passed last year allows police to temporarily restrict bank transfers of someone they believe to be a victim, and staff from banks and e-commerce platforms physically sit in the same office as police in the national anti-scam center.
The report said the U.S. makes piecemeal attempts to teach law enforcement agents how to respond to scams, but requirements vary across agencies. It said victims are generally only reimbursed if the money is taken from their accounts without their authorization, not if they were tricked into approving the withdrawals. It said U.S. law also offers social media companies broad protections from liability for the content they carry, even scams. It said China bans crypto-related businesses, while the European Union requires licensing, consumer protections and broad disclosures. It said the Trump administration has backed some cryptocurrency regulation, but has also promised to halt "aggressive enforcement actions and regulatory overreach" to promote innovation. It said the GENIUS Act, signed by President Donald Trump last year to regulate some cryptocurrencies, did not require companies to return stolen funds to fraud victims, a gap consumer advocates, prosecutors and some lawmakers have criticized.
The report said law enforcement officials say it is harder to track, freeze or recover funds because institutional banking safeguards largely do not apply to cryptocurrency. It said crypto assets are not backed by federal insurance, so if an exchange fails the money can be lost. It said banks require customers to provide identification, social security numbers and account details when moving cash, while cryptocurrency transfers can obscure the identities of those involved. It said many cryptocurrency exchanges operate across borders and through offshore entities where U.S. laws may not apply. It said locating stolen cryptocurrency takes time and money, and returning it is even more complicated. It said a cottage industry of attorneys specializing in tracing cryptocurrency is emerging, but they still need buy-in from overworked officials to obtain warrants. It said even if people can locate their stolen funds, it's unlikely they'll get them back.
The report said after Glick lost $575,000, he called the FBI, an elder abuse hotline, the Securities and Exchange Commission and the New York State Attorney General, filed complaints at IC3.org and FightCyberCrime.org, and collected thousands of screenshots as evidence. It said the FBI asked Tether to freeze funds linked to Glick's investment, but Tether refused. It said officials at the FBI and Secret Service said Tether works closely with law enforcement to combat crimes related to cryptocurrency, and that in a joint initiative Tether, TRM Labs and TRON say they have frozen over $450 million in illicit funds worldwide since 2024. It said the Justice Department in November unveiled a strike force to cut off access of Southeast Asian operations to U.S. infrastructure, pursue criminal networks behind the scams and seize stolen funds. It said the Treasury has levied sanctions in Southeast Asia, and Myanmar and Cambodia have staged high-profile crackdowns on scam compounds. It said the Justice Department's Scam Center Strike Force claimed on its website this summer that it had restrained $832 million in cryptocurrency from Chinese transnational criminals, but a spokesperson said it was unable to go into specifics about each seizure, where the funds are held or what, if anything, has been returned to victims.
Trump signed an executive order in March directing the attorney general to prioritize the prosecution of scammers and to submit a recommendation for a program to restore money to victims. The White House said in a statement to AP/FRONTLINE, "President Trump is unleashing every available tool to stop criminal networks that exploit vulnerable Americans through cyber fraud and scams." Advocates argue funding hasn't flowed to the federal agencies tasked with combating scams, investigating cybercrime and developing a cohesive plan for attacking the problem, and that the fledgling efforts to help victims get money back aren't keeping up with the number of people who have lost it. At least 13 federal agencies touch on different aspects of these crimes, according to a report issued by the Government Accountability Office. Seto Bagdoyan, who runs the office's Forensic Audits and Investigative Service, said the piecemeal approach results in a sluggish strategy that "falls short." He said, "There is no government-wide estimate of the money lost to scams, no common definition of scams, and no national strategy for combating them." Rebecca Keithley, FBI Financial Crimes Section assistant section chief who retired earlier this year, said tens of billions of dollars flow out of the U.S. economy through scams, and that the FBI's Operation Level Up has stopped about 8,500 people from falling for scams over almost two years. She said the FBI receives nearly 3,000 internet crime complaints a day on average through the IC3.gov online portal. She said, "It’s an enormous problem, and one that the FBI is prioritizing."
Chris Scott, a casino dealer in Arizona, said she was scammed out of $400,000 by a man on a dating site. She said she went four times in person to her local FBI office, begging for help, but was told all she could do was file a complaint through IC3. She said she did, but heard nothing back, not even an acknowledgment of receipt. She said she then searched for help online, found three companies claiming to have a direct line to the FBI and promising to recover her funds, hired them all and handed over a total of $23,000. She said none of the companies were real, and she was forced to sell her home to cover her debts. She said she is still paying off the $20,000 tax bill she received after draining her retirement accounts. She said, "I’m just a small fish in a big pond. All I wanted was to talk to someone and get help, but I’m nobody to them."