Three dates from one case (US Attorney for the Northern District of Illinois, 7 July 2026):
- 2020 and 2021. From India, Kartik Saini and others posed as tech support or security staff of companies such as Google, Apple or Citibank. They told victims their computers had been hacked and their bank accounts compromised, and had them move funds to accounts "the companies would safely hold". His group controlled those accounts.
- 26 August 2024. Saini was arrested at JFK airport on arrival from India.
- 25 June 2026. After a wire fraud plea, he was sentenced to six years and a month and ordered to pay full restitution.
What is cyber fraud?
Cyber fraud is fraud carried out through the internet or other technology. The FBI's Internet Crime Complaint Center (IC3) counts cyber enabled fraud as complaints where criminals "use the Internet or other technology to commit fraudulent activities, often involving the theft of money, data, identities" (2025 IC3 report, p. 9).
The types table in what fraud is says online and cyber fraud works through fake shops and social media scams, with online shoppers as the typical victim. Businesses lose money too, as the business email compromise row in Table 2 shows.
Article 8 of the Budapest Convention has each party criminalize causing "a loss of property to another person" through computer data or a computer system, done "intentionally and without right" with fraudulent or dishonest intent to procure an economic benefit. In England, Wales and Northern Ireland, a representation submitted "to any system or device" may be regarded as made under the Fraud Act 2006, section 2(5).
How do online frauds work?
Table 1. How online frauds work, stage by stage: the fraudster's move, what the victim or firm notices and who can stop it.
| Stage | The fraudster's move | What the victim or firm notices | Who can stop it |
|---|---|---|---|
| Contact | Sends a pop up, call, message or email | A warning, an offer or a request | The victim |
| Deception | Poses as support staff, a bank, an official or a partner | A story that asks for quick action | The victim; bank staff who speak to them |
| Access | Gets remote access, a login or personal data | A remote session or a new login | Security and fraud teams |
| Payment | Has the victim pay, or pays from the account | A transfer to a new payee, crypto or gift cards | The sending bank's fraud team |
| Laundering | Moves the money on through other accounts | Funds that arrive and leave at once | The receiving bank's or virtual asset provider's AML team |
Banks, payment firms and virtual asset service providers (VASPs) meet the case at the last two stages. The 2023 report of the Financial Action Task Force (FATF), the Egmont Group and INTERPOL gives the criminal's aim in one line: "ultimately, the goal is to induce a funds transfer" (2023 report, p. 11).
From Ufuk Gürdaş, reviewer of this entry: "The victim's bank sees a fraud alert and the receiving bank sees a mule account, and FATF's 2023 report says the laundering network typically runs through money mules, so the two alerts are one case and should be worked as one."
What are the three ways online fraud occurs?
- Deceiving the person into paying. The victim sends the money, as Saini's victims did.
- Using access without authorization. The criminal gets into a computer or account and obtains something of value; 18 U.S.C. 1030(a)(4) covers this when done "knowingly and with intent to defraud".
- Altering data or interfering with a system. Budapest Article 8 names both routes: computer data put in, altered, deleted or suppressed, or a system's functioning interfered with.
Which types of cyber fraud cost the most?
Among IC3's cyber enabled fraud types, investment fraud cost the most in 2025 and extortion drew the most complaints.
Table 2. Seven cyber fraud types in IC3's 2025 top five lists, by loss and by complaints (IC3 2025 report: top five lists p. 9, the other measure pp. 7 and 8).
| Type | How it works (IC3 glossary, pp. 59 and 60) | Complaints | Losses |
|---|---|---|---|
| Investment | False information induces victims to invest | 72,984 | $8,648,617,756 |
| Business email compromise | Compromised email or other channels redirect payments | 24,768 | $3,046,598,558 |
| Tech or customer support | Someone poses as technical or customer support | 47,794 | $2,134,675,818 |
| Confidence or romance | A victim who believes in a family, friendly or romantic tie sends money or data | 23,159 | $929,287,469 |
| Government impersonation, a form of impersonation fraud | An official is impersonated to collect or extort money | 32,424 | $797,943,193 |
| Non payment or non delivery | Payment sent and goods never received, or goods shipped and never paid for | 56,478 | $503,373,587 |
| Extortion | Money or property taken through intimidation | 89,129 | $122,499,133 |
In IC3's terms, a fake shop that takes payment and ships nothing is non delivery. FATF's report focuses on six types: business email compromise, phishing fraud, social media and telecommunication impersonation, online trading platform fraud, online romance fraud and employment scams (p. 5). Complaints that mention cryptocurrency carried $11,366,669,732 of 2025 losses across all crime types (p. 8). A SIM swap, 971 complaints (p. 7), is one route into account takeover fraud.
Which warning signs show up before the money moves?
- A claim that your computer or bank account was hacked. Saini's opening line.
- A pop up that freezes the screen and shows a number to call. Capstone's lure.
- A request to move money to a "safe" account. The victim sends it, so it looks authorized.
- Remote access at a caller's request. FATF describes victims tricked into installing remote access tools (p. 26).
- Crypto or gift cards as payment. Some of Saini's victims paid that way.
- A small payment to a beneficiary, rapidly followed by larger ones. One of FATF's indicators (p. 63).
FATF adds that a single indicator "may not alone warrant suspicion" (p. 63).
Internet fraud examples: which cases ended in a US sentence?
Capstone Technologies, a Charlotte company, is one beside Saini's. Its pop ups froze victims' screens and showed a number to call, and call centers in India posing as Microsoft charged victims to fix problems that did not exist. Capstone took more than $7 million from thousands of US victims.
Sentencing came on 17 February 2026. Three men in the scheme got 30, 40 and 24 months for conspiracy to commit wire fraud and were ordered to forfeit $3,711,000 together (US Attorney for the Western District of North Carolina). Two of them had also moved proceeds to the pop up publishers' bank accounts abroad.
Cyber fraud's legal consequences: which US, UK and EU rules apply?
Cyber fraud can fall under fraud law, computer misuse law or both. Each rule in Table 3 sets a mental element, from intent to defraud to recklessness.
Table 3. Cyber fraud laws in the US, UK and EU: what each requires, the maximum and where it applies.
| Rule | What it requires | Maximum | Where it applies |
|---|---|---|---|
| 18 U.S.C. 1343, wire fraud | Having devised, or intending to devise, a scheme to defraud, or to get money or property through false or fraudulent pretenses, then sending an interstate or foreign wire, radio or television communication to carry it out | Prison for 20 years at most, a fine or both; 30 years at most, a $1,000,000 fine or both where a financial institution is affected or a benefit tied to a presidentially declared major disaster or emergency is involved | United States |
| Computer fraud, 18 U.S.C. 1030(a)(4) | Entering a protected computer without authorization, or beyond it, "knowingly and with intent to defraud", and so furthering the fraud and obtaining anything of value (computer use worth $5,000 or less a year excepted) | Up to 5 years, a fine or both; 10 after a prior 1030 conviction (1030(c)(3)) | United States |
| Fraud Act 2006, section 2 | Making a false representation dishonestly, aware it is or might be untrue or misleading, to make a gain or to cause someone else loss or a risk of loss | 10 years at most on indictment, a fine or both (section 1(3)) | England, Wales and Northern Ireland only (section 15) |
| Scots law | Common law fraud (Scottish Government) | Not stated in the source opened | Scotland |
| Computer Misuse Act 1990, section 1 and section 3 | s1: causing a computer to perform a function, intending access the person knows is unauthorized; s3: a knowingly unauthorized act intended to impair a computer, or reckless as to that | On indictment, up to 2 years (s1) or 10 years (s3), a fine or both | Whole UK |
| Budapest Convention, Article 8 | Parties criminalize causing a loss of property through data or a system, intentionally, without right and with fraudulent or dishonest intent | No penalty set | Each state party |
| Directive (EU) 2019/713, Article 6 | Causing a transfer of money, monetary value or virtual currency, and an unlawful loss, by hindering a system or altering data without right, intentionally and for an unlawful gain | A maximum prison term of at least 3 years (Article 9(4)) | EU; Ireland (recital 38) and Denmark (recital 39) did not take part in its adoption |
Saini pleaded guilty to a wire fraud charge, the 1343 offense. US victims report to the FBI's IC3, which calls itself "the central hub for reporting" such crime (p. 3).
For the UK, the National Cyber Security Centre gives two routes by where the victim lives: Report Fraud for England, Wales or Northern Ireland, and Police Scotland on 101 for Scotland. The City of London Police launched Report Fraud on 4 December 2025 to take over from Action Fraud (Office for National Statistics).
Is phishing cyber fraud, and is all cybercrime fraud?
Phishing is one way into cyber fraud. Cybercrime is the wider set, and cyber fraud the part aimed at money or property. FATF's 2023 report on cyber enabled fraud leaves ransomware financing outside its scope (p. 6).
Table 4. Cyber fraud, cybercrime and phishing compared.
| Term | What it targets | Source and latest count |
|---|---|---|
| Cyber fraud | Money or property, by deception or altered data | IC3: 452,868 cyber enabled fraud complaints, 2025 |
| Cybercrime, such as computer misuse | Computers, data and services: hacking or malware "to disrupt services, obtain information illegally, or extort" (ONS glossary) | ONS: an estimated 798,000 computer misuse incidents in England and Wales, year ending March 2026, beside 4.5 million fraud incidents (Crime Survey for England and Wales) |
| Phishing | Logins and personal data, as a first step | IC3: 191,561 phishing and spoofing complaints, 2025 |
Where do fraud, security and AML teams meet in a cyber fraud case?
No single team sees the whole case. Security sees an intrusion, if there is one; the sending bank's fraud team sees the payment; the receiving side's AML team sees the account it lands in. FATF's report says the laundering network "typically involves money mules but can also include shell companies or legitimate businesses" (p. 3), so a money mule account is where fraud and AML meet.
At complead, formerly Sanction Scanner, the device and behavior analysis product reads how a session behaves, including a payment approved under coaching or during remote access. Each score shows which signals contributed, and a payment can be held for review.
Saini's victims were told their computers had been hacked. What they lost went by transfer into accounts his group controlled, and on 25 June 2026 the court ordered full restitution.
Related terms
- APP fraud. A push payment the customer makes after being deceived.
- Social engineering. Manipulating a person into giving access, data or money.
- Tech support fraud. A fake support contact that ends in a payment.
- Computer misuse. Unauthorized access to a computer, or acts that impair it.
