Arizona Cybercrime Index

Arizona ranks 4th in the United States for reported cybercrime complaints per resident and 4th for reported losses per resident. Between 2024 and 2025 reported losses in Arizona rose 60.7 per cent, against a national rise of 25.8 per cent. Arizona’s losses grew roughly 2.4 times faster than the country as a whole.

This page sets out the figures, the full state-by-state table, the method used, and what the numbers mean for organisations operating in Arizona. It is maintained by Honeybadger Solutions and updated when the FBI publishes new data. All figures come from the FBI Internet Crime Complaint Center; nothing here is modelled or estimated.

The headline numbers

What changed between 2024 and 2025

Arizona did not simply grow with the country. On every measure the state moved up the table.

Put plainly: Arizona holds about 2.9 per cent of the country’s cybercrime complaints but 3.0 per cent of its losses, and the average reported loss per complaint in Arizona — $21,848 — runs slightly above the national average of $20,699. Across 2025 that worked out at roughly 79 complaints and $1.73 million in reported losses every day in Arizona alone.

The full state table

Every state and territory in the FBI’s 2025 per-capita tables. Ordered by complaint rank. The final column shows the gap between a jurisdiction’s loss rank and its complaint rank — a negative number means the losses land harder than the complaint volume alone would suggest.

Source: FBI Internet Crime Complaint Center, 2025 Internet Crime Report. Rankings cover 50 states, the District of Columbia and Puerto Rico.

How to read this

Raw complaint counts follow population. California, Texas and Florida top every unadjusted table simply because more people live there, which is why those tables tell you very little. Dividing by population is what makes the figures comparable, and it is where Arizona becomes visible.

Three things are worth noticing in the table above.

• Arizona is one of very few jurisdictions ranked 4th on both measures. Most states sit high on one and lower on the other. Arizona is near the top for how often people report, and near the top for how much they lose.
• Alaska has the widest gap in the table. It ranks 2nd for complaints per resident but 19th for losses per resident, a 17-place spread — a pattern consistent with high volumes of lower-value fraud.
• California runs the other way. 13th for complaints, 2nd for losses: fewer reports per resident, but far more money lost per report.

Why Arizona

The FBI does not explain state variation, and we will not pretend to a causal answer it has not published. What can be said accurately is that the figures measure reported crime, and several things plausibly raise reporting and exposure in Arizona at the same time: sustained population growth, a large retiree population in a fraud category that skews older, rapid commercial and data-centre development in the Phoenix metropolitan area, and a business base weighted towards construction, logistics, healthcare and hospitality — sectors with distributed workforces and high supplier-payment volumes, which is the profile business email compromise targets.

Those are hypotheses consistent with the data, not findings. Anyone claiming to know precisely why Arizona ranks where it does is guessing.

What this means if you operate in Arizona

Reported loss is a lagging measure. By the time an incident appears in this dataset the money has usually gone. The practical value of a table like this is in what it tells you to check before that happens.

• Payment change requests are the single highest-value control. Business email compromise remains one of the largest loss categories nationally. A rule that no bank-detail change is actioned without a callback to a known number, using a number you already hold rather than one in the email, prevents most of it.
• Older family members and older employees are disproportionately affected. The FBI publishes separate figures for complainants over 60 for a reason.
• Recovery is time-critical. The FBI’s Recovery Asset Team can act on fraudulent domestic wires, but the window is measured in hours to days. Report immediately at ic3.gov rather than waiting for an internal investigation to conclude.
• Preserve the evidence before you investigate. Logging into a compromised mailbox, powering a device up, or letting a general IT provider “have a look” frequently destroys the artefacts a later forensic examination would depend on.
• Insurers and counterparties increasingly ask. Cyber insurance applications and enterprise vendor questionnaires now routinely require documented controls, not intentions.

Related reading: cyber investigations, ransomware recovery, computer and hard drive forensics, penetration testing, and blockchain and cryptocurrency forensics for cases where funds have moved into digital assets.

Method

• Source. Federal Bureau of Investigation, Internet Crime Complaint Center (IC3), 2025 Internet Crime Report and 2024 Internet Crime Report. State tables: complaints by state, losses by state, complaints per 100,000 residents, losses per 100,000 residents.
• Figures. Every absolute number on this page is transcribed directly from those reports. Nothing is modelled, weighted or estimated.
• Derived values. Year-on-year percentages are calculated as (2025 value − 2024 value) ÷ 2024 value. The loss-growth multiple is Arizona’s percentage loss growth divided by the national percentage loss growth. Average loss per complaint is total losses divided by total complaints. Daily figures divide annual totals by 365.
• Rank gap. Loss-per-resident rank minus complaint-per-resident rank, using the FBI’s own published ranks.
• Coverage. 50 states, the District of Columbia and Puerto Rico, as published. Other territories are omitted from the FBI’s per-capita tables.
• Known limitation. IC3 records only crimes voluntarily reported to it. Actual losses are certainly higher, and the gap between reported and actual almost certainly varies by state, which means cross-state comparison reflects reporting behaviour as well as underlying crime. This is the most important caveat on the page.
• Extracted. 28 August 2026. Next update on publication of the 2026 Internet Crime Report, expected spring 2027.

Primary sources: 2025 Internet Crime Report (PDF) · 2024 Internet Crime Report (PDF) · IC3 annual report archive. Further context on federal response guidance: CISA StopRansomware and the NIST Cybersecurity Framework.

Using this data

Journalists, researchers and analysts are welcome to cite these figures and reproduce the table with attribution to Honeybadger Solutions and a link to this page. The CSV button above exports the full dataset. If you need a cut we have not published — a specific metropolitan area, a longer time series, or the elder-fraud breakdown — ask and we will prepare it.

Frequently asked questions

Is Arizona the worst state for cybercrime?

No. On complaints per resident Arizona ranks 4th, behind the District of Columbia, Alaska and Nevada. On losses per resident it also ranks 4th, behind the District of Columbia, California and Nevada. It is among the most affected, not the most affected.

Why do these figures differ from other cybercrime statistics I have seen?

Most published figures are either raw counts, which track population, or estimates from private vendors using their own methods. This page uses only the FBI’s own per-capita tables, so the numbers are comparable across states and can be checked against the source PDFs.

Does a high complaint rate mean more crime, or just more reporting?

Both, and the data cannot separate them. A state with strong awareness and good relationships with federal reporting channels will record more complaints for the same underlying crime. This is the central limitation of any IC3-based comparison and we would rather state it than bury it.

What should a business do first?

Introduce a verified-callback rule for any change to payment details, using a phone number you already hold. It is the cheapest control available and it addresses the category that loses organisations the most money.

We have already lost money. What now?

Report to ic3.gov immediately — recovery of a domestic wire depends on hours, not days — notify your bank, and stop using the affected account or device until it has been preserved properly. Then get a forensic examination scoped before anyone else touches it.

Can we get the underlying data?

Yes. Use the CSV button above, or take it directly from the FBI PDFs linked in the method section.

About Honeybadger Solutions

Honeybadger Solutions is a veteran-owned risk management firm headquartered in Casa Grande, Arizona, with offices in Phoenix and Oro Valley. Cyber security, cyber investigations, digital forensics, financial investigations and blockchain forensics are performed from Arizona under Arizona licensure for clients anywhere in the United States and internationally. Armed and unarmed security, executive protection, surveillance and drone operations are staffed directly across Maricopa, Pinal and Pima counties, and coordinated nationwide through vetted partner agencies licensed in their own states.

For comment on this data, or to discuss a matter, book a consultation.