Safest and Riskiest U.S. States for Financial Cybercrime

• Final rankings go from safest to riskiest based on the overall weighted score, where rank 1 represents the safest state with the lowest overall risk, and rank 51 represents the riskiest state with the highest combined threat level.
• Final weighted scores: A composite score that factors in per-capita victim count, financial losses, change over time and legislative action. Lower scores indicate a higher risk for financial cybercrime.
• Victim count per million population: The number of reported financial cybercrime victims in 2024, shown as per million residents in each state to provide accurate comparisons.
• Victim loss per million population: The total reported losses due to cybercrime in 2024, divided by each state’s population in millions to show how residents were impacted financially.
• Percentage change in victim count (2022 to 2024): Reflects how the number of reported victims has increased or decreased between 2022 and 2024.
• Percentage change in victim loss (2022 to 2024): Shows the change in total monetary loss due to cybercrime over the two-year period.
• Legislation count: The number of state-level legislative actions related to cybercrime, cybersecurity or online fraud.

Advance fee scams involve promises of loans, prizes or inheritances that require victims to pay a fee upfront. The amount victims pay is typically smaller per incident, but this scam is increasingly common and can be financially damaging at scale.

Across the U.S., advance fee fraud led to more than $91 million in losses in 2024. West Virginia is the safest state for this kind of scam, while Arizona is the riskiest.

Never pay upfront fees for something you didn’t apply for, especially when the promise involves a large return. Always verify claims independently and be skeptical of unsolicited offers.

Lottery, sweepstakes and inheritance scams tell victims that they’ve won money or are due a large windfall but must pay a fee or hand over personal information in order to claim it. These scams disproportionately affect older adults and are very effective at defrauding victims.

The safest state for these scams is West Virginia ($38,000 in losses per million residents), while the riskiest state is Nevada (more than $2 million in losses per million residents).

Legitimate lotteries and sweepstakes never ask winners to pay fees. If you’re contacted about winning a lottery you never entered or are asked to send money to release an inheritance, it’s a scam.

Business email compromise (BEC) scams are among the most financially devastating. Attackers impersonate executives, clients or vendors to trick victims into sending unauthorized wire transfers or making fraudulent payments.

The riskiest location for this scam is D.C., which reported $18.6 million in losses from just 144 victims. In contrast, South Dakota saw 47 cases and $6.9 million in losses, making it one of the least affected states per capita.

Always confirm payment requests through a second, verified communication channel, and enable multi-factor authentication on email accounts to avoid unauthorized access.

Confidence and romance scams involve building emotional trust with victims before requesting money, gifts or personal information. These schemes can unfold over weeks or months, and often target older or isolated adults.

Mississippi is the safest state for these scams, with only 33 cases and $837,000 in losses per million residents. Arizona reported 1,084 victims in 2024, with a loss of $43.5 million, making it the riskiest state for this crime.

Be cautious when engaging in online relationships with people you’ve never met, especially if they avoid video calling or meeting in person. Never send money, gift cards or personal finance details to people you’ve interacted with only online.

Non-payment and non-delivery fraud happens when buyers don’t pay for goods or services, or sellers take payment and don’t deliver. It’s one of the most frequently reported online scams, and is often tied to online marketplaces and peer-to-peer sales platforms like Etsy.

The safest state for this in 2024 was Mississippi, with just 254 cases and $1.3 million in total losses. Nevada reported 667 victims and $13.9 million in losses.

When buying or selling online, use platforms that offer payment protection and shipment tracking. Avoid any deals that require payment in cryptocurrency, prepaid cards or wire transfers.

Credit card and check fraud involves the unauthorized use of financial details to withdraw funds, make purchases or forge documents. This kind of financial cybercrime often comes from data breaches, phishing scams or physical theft of mail or bank cards.

The safest state here is Mississippi, which saw only 72 cases in 2024 and $348,000 in losses. Arizona reported 1,058 victims and more than $9 million in losses.

Monitor your bank cards and accounts regularly to check for suspicious charges. Use virtual cards for online shopping and avoid sharing card details over the phone or on unsecured websites.

Overpayment scams trick victims into refunding money that never existed, typically through fake checks, fraudulent job offers or online transactions. Once the victim sends back the “extra” funds, the original payment is reversed, leaving the victim with a loss.

South Dakota reported only three instances of this scam in 2024 and $0 in losses. In contrast, Pennsylvania saw 95 cases and $13.2 million in losses.

If someone overpays you and asks you to return the difference, it’s likely a scam. Never refund money from a check until it has fully cleared with your bank.

Data breaches involve unauthorized access to or theft of personal or financial information stored online. Hackers can exploit weak security protocols or software vulnerabilities to gain this data. Breaches can also lead to other crimes like identity theft or unauthorized transactions.

North Dakota and Rhode Island each reported two instances of data breaches, with $0 in reported losses. Wyoming reported nine data breaches, resulting in a loss of $21.7 million.

Make sure you use strong, unique passwords for each account and enable multi-factor authentication when possible. Monitor accounts and put alerts or credit freezes in place if your information is exposed in a breach.

Personal data breaches happen when cybercriminals access sensitive personal data like names, Social Security numbers or login credentials for accounts. Breaches often lead to other cybercrimes, like identity theft or account takeovers.

Iowa reported nearly 4,000 personal data breach victims in 2024 — the equivalent of 1,226 victims per million residents. Meanwhile, Wyoming saw just 89 cases and $199,000 in losses, representing the lowest financial impact and the second lowest victim count.

Be wary of unsolicited emails that request personal information, and use unique passwords with multi-factor authentication for sensitive accounts.

Employment scams involve exploiting job seekers who respond to fake job listings or scammers posing as recruiters to steal money or personal data. Victims are asked to pay up front for training, supplies or equipment, and can be tricked into sharing bank details.

South Dakota reported just 27 victims of this scam, with a total loss of $90,000. Nevada reported 344 victims, with a loss of $22.9 million — the highest in the country.

Don’t apply for jobs or accept employment offers that require financial information up front. Research the company and contact them directly to confirm how legitimate the job offer is.

Phishing and spoofing scams try to trick people into sharing sensitive information through fake texts, emails or websites. These attacks impersonate banks, employers and even government agencies, leading to stolen credentials or unauthorized access to sensitive accounts.

Indiana reported more than 6,100 phishing victims in 2024. In contrast, West Virginia recorded 271 cases and a loss of just $54,000.

Don’t click on suspicious links or download attachments from unknown senders. Verify the source of messages, especially if they involve account access or payment information.

Extortion scams typically involve digital or physical threats, and demands for payment to prevent personal harm, data exposure or damage to the victim’s reputation. These attacks are often carried out by email, phone or messaging apps and often rely on scare tactics to get quick payments.

In 2024, Nevada reported 1,625 extortion cases, with more than $61 million in reported losses. By comparison, North Dakota saw only 131 cases and $85,000 in losses.

If you receive a blackmail or extortion message demanding payment or personal data, don’t respond to it. Report it to the FBI’s Internet Crime Center (IC3) and avoid paying the scammer.

Ransomware attacks lock or encrypt a victim’s data and demand payment for its release. Incidents of these attacks are typically less frequent than other types of cybercrime, but the financial damage can be significant, especially for businesses.

North Dakota is overall the safest state for this, with only three reported incidents and no financial losses. In 2024, Illinois reported 161 ransomware victims and $1.69 million in losses.

Make sure you back up important data regularly and store important backups offline. Don’t click unknown links or download unsolicited attachments. Use reliable antivirus and anti-malware tools to guard against exploits.

Government impersonation scams happen when criminals pose as federal or state officials, such as IRS agents, police or immigration officers. They coerce victims into paying fake fines, fees or overdue taxes, often with urgent threats or fabricated legal consequences.

In 2024, California reported 2,397 victims and losses of $93 million from these scams. By comparison, North Dakota saw just 38 incidents and a little less than $285,000 in losses.

No legitimate government agency will demand payment through wire transfers, gift cards or cryptocurrency. If someone claiming to be from the government threatens legal action or arrest over the phone, hang up and verify the agency’s contact details independently.

Real estate fraud targets renters, home buyers and property owners through fake listings, fraudulent closing or scammers impersonating real estate professionals. Often, scammers will advertise properties that don’t exist and demand a deposit before the victim can view the “property.”

Alaska is the highest-risk state per capita, with just 49 victims in 2024 but losses totalling $2.8 million. South Dakota reported just 27 cases and $63,000 in losses, giving it the lowest exposure to this kind of fraud.

Verify the identity of agents or landlords and make sure you view the property before sending deposits or personal information.

SIM swap fraud occurs when scammers trick a mobile provider into transferring a victim’s phone number to a new SIM card that is under their control. Once they gain access, it’s possible to intercept security codes and reset passwords to breach financial accounts.

The riskiest state for this fraud is Alaska, with six victims and losses of almost $152,000 in 2024. Both Wyoming and New Mexico had zero reports in 2024, with Hawaii, Idaho, Iowa, Mississippi, Rhode Island and Vermont also reporting no monetary losses.

Try to avoid using SMS for two-factor authentication when possible, as this can be intercepted easily. Contact your mobile carrier to set up PIN or port-out protection to avoid unauthorized number transfers.

Identity theft happens when criminals use someone’s personal data, like their Social Security number or financial details, to commit fraud. Victims can face long-term damage to their finances, credit scores or even legal records.

The safest state for identity theft is Vermont, reporting just 38 cases and less than $8,000 in losses in 2024. While it didn’t have the highest total losses, New Jersey’s smaller population and high loss amount (almost $20 million) amounted to the highest per-capita losses nationwide.

Keep details like your Social Security number secure, monitor your credit reports regularly and use fraud alerts if possible. Don’t share personal or financial details online freely, and shred sensitive documents before you dispose of them.

Tech support scams involve criminals posing as representatives from well-known tech companies to trick victims into sending money or giving up control of their devices. These scams often target older adults and can lead to significant financial losses or data compromise.

D.C. reported only 98 victims in 2024 but had losses of $245 million, which equates to a staggering $350,000,000 per million residents. In contrast, Mississippi saw 185 cases and $2.29 million in losses.

Don’t trust unsolicited calls or pop-ups claiming that your device has a virus. Real tech companies won’t initiate contact for support issues. Make sure not to give remote access to your device unless you’ve verified the support channel.

Investment scams promise high returns with low risk, targeting victims through social media or fake financial advisors. Victims hand over significant amounts of money to “invest” through illegitimate platforms or fraudulent schemes and never see the money again.

While Oregon had an average number of reported victims (507 in 2024), it reported just over $489 million in losses — the highest per-capita figure across the U.S. Vermont had just 46 cases and less than $2 million in losses.

Be wary of unsolicited investment advice or guaranteed returns. In addition, thoroughly research any investment opportunities and verify licenses through official regulatory bodies.

Scams in this category include pirated content, counterfeit goods and the unauthorized reproduction or sale of intellectual property. Though less common than other forms of cybercrime, the losses can be significant — especially for businesses or content creators.

Wyoming saw only four incidents in 2024 but reported losses of $710,000. South Dakota reported a single case and no financial losses in the same year.

Avoid making purchases from unverified retailers, especially if prices are too good to be true. Don’t download or share pirated content, and report unauthorized use of your original works to the appropriate platforms or legal authorities.