America's Forgotten Cyber Generation

$7.7 billion. One year.

That is how much Americans aged 60 and over reported losing to online fraud in 2025, according to the FBI's Internet Crime Complaint Center.^1,2

It was up 59% on the year before.

Older Americans filed about one in five of the complaints the FBI received. They carried more than a third of the losses. The average reported loss for someone over 60 was around $38,500, almost twice the figure across all age groups.¹

Put simply, they are not the people most often targeted. They are the people who lose the most when it happens.

And yet they barely feature in the way the country talks about cybersecurity.

National strategies focus on power grids, hospitals, government networks and defence contractors. Those matter. But the person most likely to be emptied out by a criminal on the other end of a phone line is not a utility. It is a retired teacher in Ohio.

Why them?

Part of the answer is money. People who have spent forty years working and saving tend to have something worth stealing: pensions, savings, a house with no mortgage left on it.

But money is not the whole story.

The biggest losses do not come from clever code. They come from conversations. In 2025 the largest category by value among older victims was investment fraud, at more than $3.5 billion. Next came scams in which criminals pose as customer support, a bank or a technology company, at just over $1 billion.¹

These crimes work on trust, urgency and fear. A caller says your computer is infected. Or your bank account has been compromised and the money needs moving somewhere "safe". Or your grandson is in trouble and cannot tell his parents.

None of this requires the victim to be foolish. It requires them to be human, under pressure and alone at the moment it matters.

That last part is important.

Many older Americans live by themselves. When a call feels wrong, there is often nobody in the room to say "hang on, that doesn't sound right". The scam is designed to keep it that way. Don't hang up. Don't tell anyone. Act now.

Then there is the gap nobody talks about.

Most cybersecurity awareness in the United States happens at work. Employees get phishing tests, training videos and an IT desk they can ring when something looks odd.

Retirement switches all of that off.

The day someone leaves their job, they lose the training, the colleagues and the help desk. They keep the email address, the bank account and the smartphone. The threats stay. The support goes.

This is not a failure of individuals. It is a failure of design.

The fixes are not mysterious either.

Awareness campaigns could be built for older audiences and delivered where they already are: on television, through doctors' offices, libraries, churches, pharmacies and local government services, not on corporate training platforms they will never see.

Banks could do more. They already stop unusual card payments within seconds. The same thinking could flag the large, sudden transfers that scams so often depend on, and put a human check in the way before the money leaves.

Families can help too, with a simple agreement: any call asking for money gets a second opinion first.

And policymakers could start by naming older adults as a priority group in national cyber strategy, rather than a footnote in a fraud report.

Cybersecurity is usually told as a story about hackers and defenders, code and networks.

For millions of older Americans, it is a story about a phone call on a Tuesday afternoon.

Until national strategy reflects that, the generation losing the most will remain the one it remembers least.