Why two cybercrime reports can tell different stories without contradicting each other

One report says phishing is the most frequently reported internet crime. Another says valid accounts and user execution dominate observed initial access. A third says investment fraud produces the largest losses. These findings can all be true because they do not count the same events, from the same population, for the same purpose.

Cybercrime statistics arrive with the authority of large numbers. The number is often accurate within the system that produced it. Confusion begins when the reader silently changes the denominator: “share of complaints received by one agency” becomes “share of all attacks,” or “share of a response provider’s observed initial access” becomes “probability that any organization will be breached this way.”

The FBI’s 2025 Internet Crime Report summarizes complaints submitted to IC3 and reported losses. Microsoft’s 2026 Digital Defense Report draws on Microsoft telemetry and security services. Both provide valuable evidence. They are windows with different frames.

Name the counting system

A complaint database records events that someone recognized and chose to report. Reporting depends on awareness, access, trust, language, perceived loss, and jurisdiction. One event can affect several people; one person can submit several complaints; classification may change as evidence develops.

Incident-response data begins after an organization detects a problem and engages a particular provider. It can offer deeper technical detail, but the client population is not a random sample of all organizations. Product telemetry may cover enormous scale while remaining concentrated in the vendor’s devices, services, regions, and detection logic.

Surveys capture self-reported experience from a sampled population. They can reach incidents never reported to law enforcement, while introducing recall, wording, and nonresponse effects.

A numerator can change when a definition changes

“Phishing” may mean a complaint category, a delivery technique, a social interaction, or the first observable step in an incident. “AI-related” may mean AI generated the lure, an AI product was impersonated, the complainant mentioned AI, or analysts found model use. Unless the report defines the label, trend comparisons can mix taxonomy change with behavior change.

The FBI’s April 2026 release states that IC3 received 1,008,597 complaints for 2025 and nearly $21 billion in reported losses. It also separately describes approximately 453,000 cyber-enabled fraud complaints with reported losses above $17.7 billion. Those numbers answer different questions: all complaints versus a defined fraud subset. Dividing a category from one table by the total from another without checking definitions produces a clean but misleading percentage.

Microsoft reports that user execution accounted for 30% and valid accounts for 20% of observed initial access in Microsoft Defender Experts data. The phrase “observed initial access” and the named data source belong beside the percentages. They should not be rewritten as “half of all breaches are caused by employees and passwords.” That paraphrase changes observation into causation, population into universality, and two technical categories into blame.

Our analysis of phishing click-rate context applies the same discipline to simulations: without delivery, exposure, eligibility, and repeated-user rules, a click rate is difficult to compare.

Ask six questions before using a chart

1. Who or what could enter the dataset? Define geography, customer base, technology, industry, and reporting channel.
2. What is one row? A complaint, victim, loss, device, alert, case, or technique occurrence?
3. What period is covered? Publication date is not the measurement period.
4. How are categories assigned? Self-selection, automated detection, analyst judgment, or mutually exclusive coding?
5. What is missing by design? Undetected events, unreported harm, unsupported systems, or cases below a threshold?
6. What changed since the prior edition? Sensors, customer population, taxonomy, law, reporting publicity, or currency assumptions?

A larger dataset narrows random uncertainty inside its frame. It does not automatically widen the frame.

Compare mechanisms, not league tables

Two reports become more useful when they are placed in a causal chain. Complaints may show where people experience financial harm. Telemetry may show which access paths defenders observe. Incident cases may reveal why controls failed after access. Instead of asking which source is “right,” ask which stage each source illuminates.

This prevents false prioritization. A low-frequency technique can deserve attention because its consequence is extreme. A high-volume alert can deserve less executive emphasis if controls contain it automatically. Loss totals can be dominated by a small number of events, while case counts describe workload.

For a board or editorial summary, use scoped sentences: “Among complaints submitted to IC3 in 2025…” or “In Microsoft Defender Experts observations…” Link the original report, state the measured period, and avoid converting reported losses into a complete estimate of societal cost.

The Microsoft report insight article makes a useful systemic point: signals from identities, endpoints, applications, and infrastructure become clearer when considered together. That is an argument for synthesis with preserved provenance, not for blending incompatible counts.

Turn statistics into bounded decisions

For security planning, map each finding to your own exposure. If valid accounts feature heavily in one dataset, examine your authentication, session, and privilege controls. If complaint data shows large investment-scam losses, improve consumer education and payment intervention. Then measure local outcomes with definitions you control.

Document why a source is relevant, what decision it informs, and what it cannot establish. Revisit the source when editions change. A number copied into a slide often outlives its footnote; keep the scope in the sentence so it survives separation.

The same source discipline appears in our pretexting trust-chain analysis: several accurate background facts do not automatically prove the authority of the current request. Several large statistics likewise do not become comparable merely because they describe cybercrime.

Cybercrime reports do not need identical rankings to be useful. Their disagreement often reveals the shape of the observation system. The disciplined reader keeps the denominator attached, treats categories as authored choices, and combines sources only after identifying the seam.