A lookalike domain is a web address made to be mistaken for yours: one letter changed, a letter added, a "0" for an "o", or your name plus a word like "login". Below are real cases from court records, law enforcement and the companies themselves. Each links to its source. None of these companies are LookalikeGuard customers; they are public examples of the problem.
The newest full-year numbers are for 2025. For 2026, only partial-year data exists so far, and we say so where it is used. All figures below are from the named source, linked.
Record losses. The FBI's Internet Crime Complaint Center (IC3) received 1,008,597 complaints in 2025 with $20.877 billion in reported losses, a 26% increase in losses from 2024. Business email compromise (BEC) alone: $3,046,598,558 from 24,768 complaints. FBI IC3 2025 report
Phishing and spoofing losses tripled in a year. Reported losses in the IC3 "Phishing/Spoofing" category went from $18,728,550 (2023) to $70,013,036 (2024) to $215,843,126 (2025). FBI IC3 2025 report, three-year loss comparison
AI is now in the complaints. In 2025, IC3 received 22,364 complaints that referenced artificial intelligence, with adjusted losses over $893 million. The FBI says businesses reported losses of over $30 million to BEC scams involving AI, and notes that many victims may not realize AI was involved, so the true share is unknown. FBI IC3 2025 report, "Artificial Intelligence (AI) Used in Cybercrime"
Impersonation is the most-reported fraud. The FTC says people reported losing $3.5 billion to imposter scams in 2025, nearly three times the 2020 figure, and nearly one in three fraud reports was an imposter scam. Business impersonators: nearly $1 billion (up from $866 million in 2024). Total reported fraud: about $16 billion, the highest on record, up about 25%. FTC, June 15, 2026
Record domain disputes. Brand owners filed 6,282 domain name cases with WIPO in 2025, the most in the service's 25-year history. WIPO says filings "increasingly" involve fraudulent email, phishing and impersonation. By October 20, 2026, 5,461 cases had already been filed this year. WIPO ADR Highlights 2025; WIPO case statistics
2026 so far: phishing up, bigger BEC asks. APWG counted 1,069,681 phishing attacks in Q2 2026, up 10.1% from Q1. APWG member Fortra saw wire-transfer BEC attacks rise 88% from Q1 to Q2 2026, with the average amount requested up 45% to $61,732. APWG Phishing Activity Trends Report, Q2 2026
Not available yet: full-year 2026 figures from the FBI, FTC or WIPO. The FBI and FTC publish annual numbers in the spring of the following year.
Reported losses roughly tripled from 2021 to 2025. These are only losses people reported; real losses are higher. Source: FBI IC3 2025 Internet Crime Report, "Losses by Year" (2025 figure: $20.877 billion).2025 was a record year. *2026 is year to date (Jan 1 to Oct 20, 2026), not a full year, so it is shown lighter. Source: WIPO domain name case statistics (retrieved Oct 20, 2026); WIPO ADR Highlights 2025.Around a million phishing attacks every quarter. Numbers dipped in late 2025 and climbed again in 2026; June 2026 (425,808) was the highest single month since April 2023. Source: APWG Phishing Activity Trends Reports Q1 2025, Q2 2025, Q3 2025, Q4 2025, Q1 2026, Q2 2026.
Forecast (a prediction, not a measurement)
Deloitte's Center for Financial Services predicts generative AI could push U.S. fraud losses to $40 billion by 2027, up from $12.3 billion in 2023, about 32% growth a year. Its lower scenario is about $22 billion. For email fraud alone, it estimates about $11.5 billion by 2027 in an "aggressive" adoption scenario. This is Deloitte's projection, made in 2024 and based on FBI IC3 data, not a count of actual losses. Deloitte Insights
The cases
Newest first.
City governmentTwo letters swapped2024 to 2026
Ohio city pays $721,976 to an email address with "construction" misspelled; two sentenced in 2026
What happened: In November 2024, Athens, Ohio, made a scheduled payment of $721,976 for a new fire station. Criminals had swapped the letters "u" and "c" in "construction" in an email address impersonating the contractor, Pepper Construction, and rerouted the payment. The city sued within days, froze part of the money and recovered $405,000, including $200,000 from insurance. The rest was gone.
Outcome: On Sept. 25, 2026, two men who used "spoofed email addresses designed to resemble legitimate accounts" were sentenced to 111 and 78 months in federal prison. Their scheme also diverted a wire of more than $1.68 million from a victim in Iowa City.
gearerospaces.com: a fake GE Aerospace domain nearly diverts $800,000 (2025)
What happened: The real site is geaerospace.com. A lookalike with an extra "r" and "s", registered June 20, 2025, was used to email the accounts receivable staff of GE's business partners, posing as GE employees about an "engine sales agreement". GE said the scheme "almost resulted in a fraudulent transfer of [USD] 800,000".
Outcome: A WIPO panel ordered the domain transferred to GE on Sept. 26, 2025, about three months after it was registered. WIPO highlighted the case among its noteworthy 2025 decisions under "DNS Abuse and Fraud on the Rise".
Microsoft shuts down 17 "homoglyph" domains used against small businesses (2021)
What happened: Microsoft's Digital Crimes Unit got a court order in the Eastern District of Virginia to disable 17 lookalike domains that impersonated its customers. Microsoft says the targets were "predominantly small businesses operating in North America." The criminals read a real email thread about a payment, then replied from a domain where only one letter was different, with the same sender name and subject line, saying payment was urgent.
Impact on trust: The attack worked by borrowing the trust the real business had with its own vendors and customers, so the people paying had no reason to doubt the email.
Google and Facebook pay over $120 million to a fake supplier (2013 to 2015)
What happened: A Lithuanian man registered a company in Latvia with the same name as a real Asian hardware maker that both companies bought from. Phishing emails, sent from accounts designed to look like the real supplier's staff, told the two companies to pay invoices into his bank accounts.
Impact: The U.S. Department of Justice says the two companies wired over $120 million. He was sentenced to 5 years in prison and ordered to forfeit $49,738,559.41 and pay $26,479,079.24 in restitution. If it can happen to two of the biggest tech companies, a look-alike sender is hard for anyone to spot.
rodgersbuildersinc.com: a contractor's name used to redirect a $1.9 million payment
What happened: Fraudsters registered rodgersbuildersinc.com to impersonate Rodgers Builders, whose real website is rodgersbuilders.com. Using an email address on the fake domain with the name of a real Rodgers employee, they asked Appalachian State University to update the contractor's bank details. A few days later the university sent a $1.9 million payment meant for Rodgers to the scammers.
Impact: The real contractor did nothing wrong, but its name was the tool used to steal from its own client. One defendant was sentenced to seven years in prison in 2024.
Facebook sues a registrar over 45 lookalike domains (2020)
What happened: Facebook (now Meta) found 45 domains impersonating Facebook, Instagram and WhatsApp, including facebo0k-login.com, instagrambusinesshelp.com and whatsappdownload.site, hidden behind a privacy service. It sued the registrar Namecheap and its WhoisGuard service to learn who was behind them, saying such domains are often used for phishing, fraud and scams. Namecheap disputed the claims.
Outcome: The case settled in 2022. In a joint statement, Namecheap agreed to transfer the domains at issue to Meta and treat Meta as a trusted notifier for abuse reports.
alfalaaval.com: one extra "a", used for a phishing email (2024)
What happened: Days after it was registered, alfalaaval.com (the real company is alfalaval.com) was used for a phishing email that used the name of a real Alfa Laval employee and the company's logo. Alfa Laval filed a UDRP complaint, the fast dispute process for domain names.
Outcome: A WIPO panel called it a typosquatting registration used for phishing and ordered the domain transferred to Alfa Laval. The complaint was filed September 4, 2024 and decided October 14, 2024.
Retailers ship goods to scammers posing as known customers (FBI)
What happened: The FBI describes a "purchase order" scam in which criminals set up websites and email accounts with domain names almost identical to real businesses and universities, then order laptops and other goods on 30-day credit in the real organization's name. Investigators found more than 85 companies and universities whose identities were used, about 400 actual or attempted incidents against some 250 vendors, and nearly $5 million lost at the time of the report.
Impact on sellers: When the real organization is billed, the fraud comes out, and in the FBI's words "the retailer must absorb the financial loss." The FBI notes that small and mid-size businesses are being targeted.
Ohio case: $422,000 taken by mimicking a vendor's email domain
What happened: A Columbus, Ohio man pleaded guilty in 2021 to laundering money from business email scams. In one, nearly $422,000 was obtained through a "man in the middle" scheme where the attacker impersonated a vendor or customer using email domains that looked the same but were slightly different. Another victim company lost $80,499.
Home buyer sends $813,000 to an address one letter off from her conveyancer (Australia)
What happened: Criminals created an email address one letter different from a real business's to trick a South Australian woman buying a home into sending $813,000 to them instead of her conveyancer (property settlement agent).
Outcome: She reported it to her bank and police two days later. Police recovered $777,000, about 96%, but it took nearly 12 months. The Australian Federal Police stress that recovery is complex and often not possible.
Who: Big brands and small firms alike. The fake borrows the trust of a real business.
What: A domain that differs by a letter, an added word or a lookalike character, used for email, a copycat site, or both.
Where: In inboxes and browsers of the real business's customers, vendors and staff, not on the business's own systems.
When: It can be fast: alfalaaval.com was used for phishing within days of being registered.
Why: Money: redirected payments, stolen logins, or orders on someone else's credit.
How it is stopped: Spotting the domain early, reporting it, and warning the people it targets. See what to do about a fake domain.
Illustrative example, numbers are estimates
This is a made-up store, not a real case. Every number in this box is an example estimate to show how the costs add up, except where a source is linked.
Day 0. Someone registers a misspelling of a small online store's domain and copies its product pages.
Days 1 to 21. Ads and emails point shoppers to the fake. Customers pay, and nothing arrives. The money goes to the scammer, not the store.
Week 3. Complaints start: "Where is my order?" Customers don't know they used a different site, so they blame the real store.
Weeks 3 to 6. Refund requests, a few chargebacks on genuine past orders, angry reviews, and hours of support time. Some customers mark the store's real emails as spam, which can hurt delivery of its newsletters.
Months later. A share of those customers never buy again.
Item
How it is worked out
Amount
Store revenue
Small online store example estimate
$40,000 / month
Average order
example estimate
$60
Customers who pay the fake site
Over 3 weeks before anyone notices example estimate
50 people, $3,000 to the scammer
Goodwill refunds or replacements
Store chooses to make 20 of them whole: 20 x $60 example estimate
$1,200
Chargebacks
5 confused customers dispute real past orders: 5 x ($60 + $15 dispute fee) example estimate; the $15 fee is Stripe's US dispute fee
$375
Support time
30 hours of emails and calls x $25/hour example estimate
$750
Lost repeat sales
40% of the 50 stop buying (20 people) x $120 they would have spent next year example estimate
$2,400
Total cost to the store
example estimate
about $4,725
Same attack, alert on day 1
Fake reported and customers warned in the first days; say 5 people caught instead of 50, so roughly a tenth of the above example estimate
about $470
LookalikeGuard monitoring
Solo $9/month x 12 (Team $29, Agency $79/month)
$108 / year
Not counted: harder-to-price harm such as bad reviews, a damaged search reputation, and email deliverability (customers marking your real emails as spam after a phishing wave). An alert does not take a site down by itself, and outcomes vary; the point is that the earlier you know, the fewer people are affected.
Where an early alert changes the story
With monitoring, the store would hear about the new lookalike around Day 0 or Day 1, often when the fake site gets its security certificate, before most customers ever see it. It can then report the domain, warn customers with a short email or banner, and keep watching. Fewer people are caught, which shrinks every row of the table.
More context (2024 figures and costs)
The FBI's Internet Crime Complaint Center received 859,532 complaints in 2024. Business email compromise, the kind of fraud in several cases above, accounted for $2,770,151,146 in reported losses from 21,442 complaints. Source: FBI IC3 2024 Internet Crime Report.
Card disputes carry a fee on top of the refunded amount. Stripe charges $15.00 in the US for each dispute received, plus $15.00 if you counter it (returned if you win). Sources: Stripe pricing; Stripe: how disputes work.
See which lookalikes of your domain exist today
Free, about a minute, no sign-up.
Free, no account needed. A scan takes 15 to 60 seconds. You get a shareable result link.
Lookalike