What up to $195.9 billion in fraud tells us about 2026

Canadian businesses spent more on security in 2023 than in 2021. Losses reported to the FBI still reached US$20.9 billion in 2025, up 26% in one year, across more than a million complaints. Criminals now use AI to read businesses from outside. Then they borrow their names.

Europol sees the same pattern in Europe. The United States and Canada are the two markets we measure, so their figures are the ones below.

That is only what was reported. Counting losses that go unreported, the FTC estimates that “the overall cost of fraud to consumers for 2024 could be as high as $195.9 billion.”

The Federal Trade Commission’s count points the same way. It told Congress in March 2026 that in 2025 American consumers “reported $15.9 billion in losses” across 3 million fraud reports, up from “over $12 billion” the year before.

The money goes to the inside of the firm

Statistics Canada asks businesses what they spend on cyber security. In 2023, Canadian businesses spent C$11.0 billion to prevent and detect cyber incidents, up from C$9.7 billion in 2021.

The largest items were salaries for that work (C$3.8 billion), security software (C$2.9 billion) and outside consultants (C$1.9 billion).

That money buys real protection: updated laptops, managed accounts, backups, people who watch the network. In our view, almost all of it points inward, at the firm’s own devices and systems.

Statistics Canada says the rise in recovery spending may indicate that “the financial consequences of being hit by incidents are becoming more severe.” Among businesses that were hit, scams and fraud were the most common method, reported by half of them.

Security spending protects the inside. The losses start outside.

To see why, follow one payment.

The losses start outside the firm

Business email compromise is an email that looks like it came from a partner, a supplier or the firm itself, asking for a payment to new bank details. Nothing inside the firm is broken. The money simply goes to the wrong account.

Over a decade the total is larger still. An FBI public service announcement of September 2024 counts US$55.5 billion in business email compromise “exposed dollar loss” worldwide between October 2013 and December 2023.

In 2026 the call comes too. In May the FBI warned that a criminal group it names the Silent Ransom Group has “consistently targeted US-based law firms since Spring 2023”. It added that “SRG actors pose as IT support to establish access to victim computers.” The FBI dates this phone scheme to spring 2026.

To prepare it, the criminal reads what the firm shows the world: its domain name, who works there and who approves payments, whether its email setup tells mail servers to refuse mail forged in its name, which look-alike names are free to register and which staff addresses sit in public breach data.

All of it is outside the firm. A firewall never sees it.

Our own measurement shows how open that outside is. 3 in 4 of the 1,863 professional firms we measured in Canada and the US have no published rule telling mail servers to refuse mail forged in their name.

Canada’s count is a floor too. The Canadian Anti-Fraud Centre received more than 112,000 fraud reports in 2025, with more than C$704 million in reported losses. It says “Fraud is significantly underreported in Canada, with conservative estimates putting reporting to the CAFC at only 5-10% of incidents.”

Reading a firm’s outside once took a person time. Now software does it.

Criminals now read firms with AI

In 2025 the FBI received more than 22,000 complaints that mentioned AI. Its report says chat generators “can quickly create official-sounding emails mimicking a company’s CEO or other officials.”

Europol’s 2026 assessment says cybercriminals have already begun using “agentic AI systems capable of autonomously conducting entire criminal workflows with little to no human involvement.”

It also says “Fraud schemes represent the fastest-growing area of organised crime” and that AI-driven fraud will mean “replacing labour-intensive operations with autonomous digital workforce.”

In Canada, the Canadian Centre for Cyber Security judges that AI technologies are “almost certainly lowering the barriers to entry and enhancing the quality, scale, and precision of malicious cyber threat activity.”

The research a fraudster used to do on one firm, software now does on many firms at once. A defence that waits inside the firm first meets the fraud when the money moves.

The fraud is prepared in public, outside the firm, before anyone inside sees it.

Spending more inside the firm does not change what that software finds outside it.

Why it feels like someone else’s problem

Many owners hear these warnings and decide it will not happen to them. The official count seems to agree. Statistics Canada found that “In 2023, about 1 in 6 (16%) Canadian businesses were impacted by cyber security incidents.” That share is not rising: it was 21% in 2019 and 18% in 2021.

What rises is the money and the speed. Reported losses grew 26% in one year. Europol sees criminals using agentic AI to run whole criminal workflows. When software reads every firm at once, being one firm among thousands is no longer cover. The odds stop being someone else’s.

Reading first is the defence

The fraud in these counts borrows a firm’s identity. It does not need to break into the firm’s systems. So the place to look first is the one the criminal looks at: the firm as the outside world sees it.

A firm can see what an attacker’s AI can read about it while that is still only a reading. Then it can close each way in before anyone uses it. That is the work LeakTrace does.

What a firm can check from outside

Five things anyone at a firm can look at without signing in to anything:

1. The email rule. Look up the DMARC record at _dmarc followed by the firm’s domain. No record, or a policy of p=none, means nothing tells mail servers to refuse forged mail.
2. Every domain the firm owns. An old or second domain can be forged as easily as the main one. Each needs its own rule.
3. Look-alike names. Check whether names one letter away from the firm’s domain are registered and set up for mail.
4. Staff addresses in breach data. Find out whether addresses at the firm’s own domain appear in public breach data. Change any password still in use.
5. Sign-in pages. List every sign-in page the firm’s websites show to the internet. Remove the ones nobody uses.

And one habit that stops the payment itself: confirm any change to payment details by calling a number already on file, never one given in the email.

Attackers read businesses with AI. LeakTrace reads them first.