Cybersecurity

What Is Cybercrime? Types Explained

Cybercrime is crime carried out with a computer or the internet — fraud, hacking, identity theft, ransomware, and the trade in stolen data. It is one of the fastest-growing forms of crime, and it affects businesses, governments and ordinary people. This guide explains the main types, how they connect, and where victims can get help.

By Abdul Hannan · Published 14 November 2026 · Updated 14 November 2026

What cybercrime is

Cybercrime is any crime in which a computer or a network is the tool, the target, or the place where the crime happens. It ranges from a single phishing email to organised criminal enterprises running ransomware campaigns across continents. What unites it is the method: the crime is committed through digital systems, at digital speed, and often from another country.

The law treats cybercrime seriously, and most countries have specific laws against it — covering unauthorised access to computer systems, fraud by false representation, the theft and trade of personal data, and the distribution of malicious software. But enforcement is hard: criminals operate across borders, hide behind stolen infrastructure, and are paid in ways that are difficult to trace. Prevention, and fast reporting, matter more than punishment after the fact.

It helps to separate two ideas. Some crimes are cyber-dependent — they can only exist because of computers, such as hacking, malware and denial-of-service attacks. Others are cyber-enabled — traditional crimes made easier by the internet, such as fraud, theft, harassment and extortion. The second group is larger by far, because the internet has made every traditional fraud faster, cheaper, and harder to trace.

The main types of cybercrime

Fraud is the largest category: phishing, investment scams, romance scams, fake shops, business email compromise, and advance-fee fraud. The criminal's goal is money, taken directly or through deception, and the methods are the social engineering techniques covered across this section. The FBI Internet Crime Complaint Center reported fraud losses in the billions of dollars in the United States in recent years, with investment fraud and business email compromise among the costliest.

Unauthorised access — hacking — is the breaking into of systems or accounts without permission, whether by guessing or stealing credentials, exploiting a software flaw, or tricking a person into granting access. It is the entry point for much other crime: once inside, the attacker can steal data, install malware, or move money. Identity theft is the use of stolen personal information to open accounts, take loans or commit fraud in someone else's name, and it is both a crime in itself and a tool for other crimes.

Ransomware is the locking and theft of data for extortion, covered in its own guides in this section. Malware covers the whole family of malicious software — viruses, spyware, trojans — used to steal, spy, or damage. And the trade in stolen data is itself a crime: markets where stolen credentials, card details and personal information are bought and sold, feeding the next round of attacks.

• Fraud: phishing, investment scams, romance scams, fake shops, BEC.
• Unauthorised access: hacking into systems and accounts.
• Identity theft: using stolen details to open accounts or take loans.
• Ransomware: locking data and demanding payment.
• Malware: malicious software that steals, spies or damages.
• Stolen-data trade: markets selling credentials and card details.

How the types connect: the cybercrime supply chain

These crimes rarely appear alone. They form a supply chain. A data breach produces stolen credentials, which are sold to a broker, who sells them to an affiliate, who uses them to get into a network, who deploys ransomware, who steals data, which is sold again, and used for the next phishing campaign. Each crime feeds the next, and the people carrying out each step may never meet — they are linked only by the markets and services they share.

One visible example: a phishing email steals an employee's password. The password is sold to an initial access broker. A ransomware affiliate buys the access, enters the network, steals data, and deploys encryption. The data is published on a leak site, and the victims' customers are phished with their own stolen details. A single weak password thus becomes a chain of crimes, each committed by a different person, over months.

Understanding the chain changes how you defend yourself. You do not need a defence for each crime separately — you need defences that break the chain: unique passwords and two-factor authentication stop the first step; patching and monitoring stop the entry; backups stop the ransom; reporting stops the spread. Every link you break protects everyone downstream.

Confirmed examples, kept honest

Cybercrime reporting is full of numbers, and many of them are misquoted. The honest approach taken in this guide is to name the source and the claim, and to separate confirmed facts from estimates. The FBI Internet Crime Complaint Center publishes annual reports on reported internet crime in the United States, including the number of complaints and the reported losses by crime type — those are the primary source for US fraud figures, and this guide's figures are drawn from them as reported.

Well-known confirmed incidents illustrate the types: ransomware attacks that shut down hospitals and pipelines, breach incidents that exposed millions of records, and fraud operations that ran for years before being dismantled by law enforcement. The details of a specific incident should be checked against the primary source — the law enforcement announcement or the company's own disclosure — before it is relied on, because early press coverage often gets the facts wrong.

Where this guide gives a figure, it is labelled by source and date. Where the evidence is an estimate, the guide says so. Where the facts are disputed or unconfirmed, the guide says that too. That is the standard of the research library on this site, and it is the standard a crime as fast-moving as cybercrime demands.

Who commits cybercrime

The image of a lone hacker in a dark room is largely a myth. Modern cybercrime is organised: developers who build the tools, affiliates who carry out the attacks, brokers who sell access, money launderers who move the proceeds, and support staff who run negotiations and leak sites. Some operations are businesses with a division of labour, recruitment, and customer support — described in detail in our guide on ransomware as a service.

The motive is usually money. Some attackers are motivated by ideology or by state interests, and those cases are handled by national security agencies, not by this guide. But the overwhelming majority of the cybercrime an ordinary person or a small business will meet is financially motivated, organised, and international — which is why it is so persistent, and why prevention matters more than attribution.

Understanding the organisation matters for defence. An organised operation reuses its methods, so a defence that stops one attack often stops the next hundred. And because the operation is a business, it targets whoever looks profitable and poorly defended — which means a small business with no backups is a better target than a large one with a security team.

What to do if you are a victim

Act in this order. First, contain it: change passwords from a clean device, disconnect an infected machine from the network, and contact your bank if money is involved. Second, preserve the evidence: save the messages, emails, links, wallet addresses and transaction records, and do not delete anything until you have reported it.

Third, report it. In the United States, the FBI Internet Crime Complaint Center at ic3.gov, the Federal Trade Commission at ReportFraud.ftc.gov, and IdentityTheft.gov if identity theft is involved. In the United Kingdom, Action Fraud, and report phishing emails to [email protected]. In other countries, your national fraud or cyber-crime reporting service. Fourth, tell the organisations affected: your bank, the company impersonated, and anyone whose data may have been exposed.

Fifth, protect yourself from the follow-up: the same criminals may return pretending to be police or a recovery firm. No one legitimate will ask you to pay a fee to recover stolen money. And finally, be kind to yourself. Cybercrime is a professional industry, its attacks are designed to work, and being a victim is not a personal failure — it is a crime, and the criminal is at fault.

Sources

• FBI Internet Crime Complaint Center — IC3 — last checked 14 November 2026.
• Federal Trade Commission — Report Fraud — last checked 14 November 2026.
• National Cyber Security Centre (UK) — Cybercrime guidance — last checked 14 November 2026.

Last checked: 14 November 2026.

Frequently asked questions

What is cybercrime?

Cybercrime is any crime carried out with a computer or the internet — fraud, hacking, identity theft, ransomware, and the trade in stolen data. Some cybercrimes can only exist because of computers; others are traditional crimes made faster and harder to trace by the internet.

What are the main types of cybercrime?

The main types are fraud, unauthorised access (hacking), identity theft, ransomware, malware, and the trade in stolen data. They connect in a supply chain: stolen data feeds phishing, phishing feeds account takeovers, and account takeovers feed fraud.

Is cybercrime only about hacking?

No. Hacking is one type, and much cybercrime involves no technical hacking at all — phishing, fraud and identity theft rely on deception and stolen data rather than breaking into systems. Social engineering is the most common ingredient across all types.

How big is the problem of cybercrime?

Large and growing. The FBI Internet Crime Complaint Center reports billions of dollars in losses from internet crime in the United States in recent years, with investment fraud and business email compromise among the costliest types. The figures are reported losses, not all losses — much goes unreported.

What should I do if I am a victim of cybercrime?

Contain it first: change passwords from a clean device and contact your bank if money is involved. Preserve the evidence, then report it to the official fraud channel in your country, and tell the organisations affected. Never pay a fee to someone offering to recover your money.