Types of Cybercrime: 10 Common Crimes Businesses Face
Cybercrime is any crime that uses computers or networks as the target or the tool. The FBI’s Internet Crime Complaint Center (IC3) received 1,008,597 complaints in 2025, with reported losses of nearly $20.9 billion. Knowing the types of cybercrime behind those numbers helps a business decide where to spend its defense budget.
What Are the Main Types of Cybercrime?
The main types of cybercrime businesses face are phishing, business email compromise, ransomware and extortion, identity theft and fraud, and data breaches. Other common types include malware, DDoS attacks, insider threats and cryptojacking. Most target businesses for money, data or access to their systems and customers.
The 3 Categories: Crimes Against People, Property and Government
Many textbooks group cybercrime by victim. Crimes against people include harassment, stalking and identity theft. Crimes against property include fraud, data theft, ransomware and damage to systems. Crimes against government include attacks on public services and state-backed espionage. A business can fall into all three, since it holds both property and people’s data.
UK law enforcement often uses another split. Cyber-dependent crimes, such as hacking and malware, can only happen using computers. Cyber-enabled crimes, such as fraud, are traditional crimes made bigger by technology.
The 5 Types of Cyber Crime at a Glance
- Phishing and social engineering
- Business email compromise and invoice fraud
- Ransomware and extortion
- Identity theft and account takeover
- Data breaches and data theft
10 Common Types of Cybercrime Businesses Face
1. Phishing and Spear Phishing
Phishing uses fake emails, texts, calls or websites to trick people into handing over passwords, paying money or installing malware. Spear phishing targets named individuals with researched details. Phishing/spoofing was the most reported crime type to IC3 in 2025, with 191,561 complaints, and the UK Cyber Security Breaches Survey 2025/2026 found it was by far the most common breach or attack against businesses.
2. Business Email Compromise and Invoice Fraud
In business email compromise (BEC), criminals impersonate or hijack a supplier’s, executive’s or customer’s email account and ask for a payment or a change to bank details. IC3 recorded about $3.05 billion in BEC losses in 2025, second only to investment fraud.
3. Ransomware and Cyber Extortion
Ransomware encrypts files and systems, and attackers demand payment to restore them. Many groups also steal data first and threaten to publish it. Some skip encryption and simply extort. Reported ransomware losses capture only part of the cost, since downtime and recovery rarely appear in complaint figures.
4. Data Breaches and Data Theft
Criminals steal customer records, employee data, financial information or trade secrets, then sell, publish or use them for further fraud. Breaches often follow stolen credentials, misconfigured cloud storage or unpatched systems. IC3 recorded about $1.31 billion in personal data breach losses in 2025.
5. Identity Theft and Account Takeover
Attackers use stolen personal details or passwords to open accounts, apply for credit or take over existing accounts, including business banking and cloud admin accounts. Credential reuse and missing multi-factor authentication make account takeover easy.
6. Online Payment and Card Fraud
This covers stolen card details used for purchases, fake orders, refund scams and skimming code injected into online checkout pages. Retailers and online stores face chargebacks, lost goods and card scheme penalties.
7. Malware Infections and Hacking
Malware includes viruses, trojans, spyware and keyloggers that steal data or give attackers remote control. Hacking means gaining unauthorized access to systems, often by exploiting weak passwords or unpatched software. Both are cyber-dependent crimes under the UK Computer Misuse Act 1990 and the US Computer Fraud and Abuse Act.
8. DDoS Attacks
A distributed denial-of-service (DDoS) attack floods a website or service with traffic from many devices, often a botnet, until it slows or goes offline. Criminals use DDoS for extortion, protest or to distract defenders during another attack.
9. Insider Threats and Intellectual Property Theft
Employees, contractors or partners may steal data, designs or client lists, often when leaving for a competitor, or misuse access for fraud. Not every insider incident is malicious; careless handling of data can cause similar damage.
10. Cryptojacking and Supply Chain Attacks
Cryptojacking secretly uses a business’s computers or cloud accounts to mine cryptocurrency, driving up costs and slowing systems. Supply chain attacks compromise a trusted supplier, software update or IT provider to reach many customers at once.
Types of Cyber Crime Compared: Reported Cost and Frequency
| Crime type (IC3 category) | 2025 IC3 complaints | 2025 IC3 reported losses |
|---|---|---|
| Phishing/spoofing | 191,561 | $215.8 million |
| Extortion | 89,129 | $122.5 million |
| Personal data breach | 67,456 | $1.31 billion |
| Identity theft | 31,675 | $185.8 million |
| Business email compromise | 24,768 | $3.05 billion |
| Credit card/check fraud | 18,774 | $282.7 million |
| Ransomware | 3,611 | $32.3 million |
| Malware | 893 | $19.4 million |
| Botnet | 715 | $13.9 million |
Source: FBI IC3 2025 Internet Crime Report (April 2026). Figures cover complaints from individuals and organizations reported to IC3. DDoS, insider threats and cryptojacking are not tracked as separate IC3 categories.
The pattern is clear: phishing is the most frequent, while BEC causes the largest business losses.
Which Cybercrimes Hit Small Businesses Most?
US Data: FBI IC3 Internet Crime Report
The IC3 data points to phishing as the most common entry point and BEC as the costliest business crime. Both rely on deceiving people rather than breaking technology, which means small businesses with few finance controls are exposed.
UK Data: Cyber Security Breaches Survey
The UK government’s Cyber Security Breaches Survey 2025/2026 found that 43% of businesses identified a breach or attack in the previous 12 months. Phishing affected 38% of all businesses, and among those that experienced cybercrime, 93% experienced phishing. Ransomware was reported by 1% of businesses. Medium and large businesses were more likely to report breaches than micro and small firms.
How to Defend Against Each Type of Cybercrime
- Phishing: staff awareness training, email filtering, MFA and reporting buttons
- BEC and invoice fraud: verify any bank detail change by phone using a known number; require two approvers for payments
- Ransomware: patching, offline or immutable backups, EDR and restricted admin rights
- Data breaches: least-privilege access, encryption, secure cloud configuration and monitoring
- Identity theft and account takeover: MFA, password managers and alerts on new logins
- Payment fraud: fraud screening, secure checkout and monitoring for injected scripts
- Malware and hacking: endpoint protection, patching and firewall rules
- DDoS: DDoS protection from your hosting or network provider and a response plan
- Insider threats: access reviews, prompt offboarding and data activity monitoring
- Cryptojacking and supply chain: cloud spending alerts, supplier security checks and software update controls
The UK’s Cyber Essentials scheme covers the basic technical controls behind many of these defenses.
How to Report Each Type of Cybercrime in the US and UK
In the US, report cybercrime and fraud to the FBI at ic3.gov, and significant cyber incidents to CISA. Identity theft can also be reported to the FTC at IdentityTheft.gov. In England, Wales and Northern Ireland, report cybercrime and fraud to Report Fraud, the City of London Police service that replaced Action Fraud in December 2025. In Scotland, call Police Scotland on 101. Personal data breaches may also need reporting to the ICO within 72 hours under UK GDPR.
How the Types of Cybercrime Are Changing
The IC3’s 2025 report added a section on AI for the first time, recording 22,364 AI-related complaints. Expect phishing, BEC and impersonation to grow more convincing as criminals use voice clones and generated content. The crimes themselves will stay familiar; the delivery will get harder to spot. To assess which of these crimes your business is most exposed to, contact Cyber Security Solutions Ltd through our contact page.
FAQs
Common lists name phishing, business email compromise, ransomware and extortion, identity theft and fraud, and data breaches as the five main types affecting businesses. Different sources group crimes differently, so you may also see hacking, malware or DDoS attacks listed. The key point is that most rely on deceiving people or exploiting weak access controls.
Phishing. It was the most reported crime type in the FBI's 2025 IC3 report, with 191,561 complaints, and the UK Cyber Security Breaches Survey 2025/2026 found it was the most common breach or attack against businesses by far. Phishing is also the starting point for many other crimes, including BEC and ransomware.
Business email compromise is among the costliest for businesses. IC3 recorded about $3.05 billion in BEC losses in 2025, second only to investment fraud, which mostly targets individuals. Ransomware can also be very expensive, but much of its cost comes from downtime and recovery, which complaint figures often do not capture.
Serious cyberbullying can be. Harassment, stalking, threats and sharing intimate images without consent are crimes in the US and UK, and IC3 records harassment and stalking complaints. Many lists group these as crimes against people. Less serious online unkindness may breach platform rules or school policies without being a criminal offense.
There is no single official number. Lists range from three broad categories, crimes against people, property and government, to dozens of specific crime types. The FBI's IC3 tracks more than 20 categories. For businesses, about ten types, from phishing and BEC to insider threats and cryptojacking, cover most real risk.
A cyber attack is any attempt to breach, damage or disrupt systems or data. Cybercrime is a broader legal term for crimes committed using computers, including attacks but also online fraud, scams and harassment. The UK survey notes that cybercrimes are a subset of the breaches and attacks organizations report.
