BEC made up 2.46% of FBI IC3 complaints and 14.59% of reported losses in 2025. See what the figures mean for payment fraud and verification.
An invoice is due, the supplier’s name is familiar, and the only thing that’s changed is where the money goes.
For a business email compromise (BEC) attacker, the bill supplies the cover story. The company’s already planning to pay it, and finance has work to get through. A credible change to bank details can steer that routine payment to the wrong account.
The FBI’s 2025 IC3 Annual Report (opens in new tab) shows how expensive that can get. Business email compromise accounted for 24,768 complaints and about $3.05 billion in reported losses. That’s roughly 2.5% of all complaints but nearly 15% of the money lost.
Divide reported BEC losses by the complaint count and you get about $123,000 per complaint, almost six times the average across all IC3 complaints. One unremarkable email can leave a memorable hole in the budget.
That concentration of loss explains the appeal for criminals. It also gives finance and security a reason to look beyond message counts when setting priorities. The FBI’s figures measure reported harm; calculating an attacker’s profit would require cost data the report doesn’t provide.
Business email compromise exploits a trusted identity or business relationship to steal money or information. An attacker might use a compromised mailbox, an executive’s name, or a lookalike supplier address. The request often comes wrapped in a legitimate reason to make a payment.
The table below uses the FBI’s 2025 complaint and loss totals. The percentages and average are calculated from those published numbers, so you can follow the arithmetic back to the source.
Metric | 2025 figure | How to read it |
BEC complaints | 24,768 | Complaints received by IC3 during 2025. |
Share of all complaints | 2.46% | Calculated from 1,008,597 total complaints. |
Reported BEC losses | $3.05 billion | The report gives $3,046,598,558. |
Share of all reported losses | 14.59% | Calculated from $20.877 billion in total losses. |
Mean loss per BEC complaint | About $123,000 | Reported BEC losses divided by BEC complaints. |
BEC losses, age 60+ | $568 million | Reported losses for the 60-and-over category. |
Each complaint represents a report IC3 received. Victims who never file won’t appear in the count, and unreported attempts won't either. Use the totals to understand reported harm while leaving room for losses the dataset can’t capture.
BEC’s share of losses was about six times its share of complaints. A risk review that gives the busiest alert category the most attention can miss that imbalance. Give the potential value of a fraudulent payment a place in the discussion.
A supplier may already be owed a substantial amount. A property buyer may already have funds ready for closing. In either case, the attacker can step into a transaction with a price tag and a deadline already attached. The fraud works by redirecting a payment someone intended to make.
In vendor invoice fraud, the paperwork can be perfectly boring. The supplier’s real, the purchase order matches, and the total looks right. The fraudulent instruction hides in the detail that changes the destination: Send the money to this account instead.
Three features of business payments give that instruction room to work:
Treat changed payment details as a fresh verification task. An employee can know the supplier well and recognize every invoice detail. They’ll still need to check the replacement beneficiary through a trusted contact before releasing the money.
The attacker can use credential harvesting to gain access to a real account, complete with its familiar address and existing threads. A lookalike supplier address offers another way to borrow that credibility. Establish which route was used so responders can contain the account or investigate the impersonating domain.
The average comes from dividing about $3.05 billion in reported losses by 24,768 BEC complaints. Understanding a typical complaint’s loss would require the distribution of those losses, including the median. Recovery amounts and the sums attackers originally requested are separate questions.
The often-cited median of about $50,000 comes from separate Verizon BEC research. Verizon’s 2026 Breach Impact Study (opens in new tab) refers back to that historical median.
That median belongs to Verizon’s research. If you use it alongside the FBI’s $123,000 average, label each source and reporting period. Otherwise, readers could assume both describe the same victims.
Take a deliberately simple example: Nine losses of $50,000 and one of $800,000 produce an average of $125,000 and a median of $50,000. These 10 fictional losses show how one large transfer can move the average while the middle value stays put.
For planning, examine your own payment amounts. What’s the largest transfer a finance employee can release? Which payments need a second approver? Can someone change bank details shortly before a payment run? The answers show how a convincing request can turn into a loss before anyone notices.
Another widely repeated number comes from the FBI’s September 2024 BEC advisory (opens in new tab): about $55.5 billion in global exposed losses across 305,033 incidents reported between October 2013 and December 2023.
The advisory combines reports to IC3 and law enforcement with financial-institution filings. Its exposed losses include actual and attempted losses. Calling all $55.5 billion stolen would overstate the finding.
Keep the $55.5 billion advisory separate from the annual IC3 total. The date range matters: It ends in December 2023. For a 2026 risk review, use that figure as historical context and the annual report to examine more recent reported losses.
BEC has outlasted years of security upgrades and awareness programs. The payment-change process that worked last year still needs to hold up when a convincing request lands today.
IC3’s 60-and-over category reported about $568 million in BEC losses in 2025, compared with about $385 million in 2024. That’s an increase of roughly 48%, calculated from the report’s totals.
The age breakdown groups together different situations, including people handling business payments and those making personal transactions. A supplier payment and a property closing can involve very different procedures. To understand the risk behind the total, you’d need to know how the fraudulent instruction entered each transaction.
An experienced person can recognize a suspicious login page and still trust fraudulent instructions in a familiar transaction. The relevant question is how the payment gets independently verified.
Explain the verification process to customers before funds are due. Tell them how you’ll confirm bank details, how to question a change, and which established number to call. A disputed transfer is a poor time to introduce that procedure.
Security reports can be very busy documents. They count blocked messages, detected domains, and investigated incidents, all useful measures of the team’s work. Add a question finance can help answer: How much money could a believable payment-change request put at risk?
Bring finance into the measurement discussion. Alongside email activity, examine:
Payment fraud can involve identity abuse in Microsoft 365. An intruder in a real mailbox may have read earlier exchanges or sent requests to several people. Finance can hold affected payments while responders check whether the attacker still has access.
After a suspected fraudulent transfer, contact the originating financial institution immediately to request a recall or reversal, as the FBI’s BEC guidance (opens in new tab) recommends. Recovery is uncertain, so keep the bank’s response route handy. The best opportunity to question the instruction comes while your organization still controls the payment.
Give staff a procedure they can follow under pressure:
Use multichannel simulations to rehearse that exception. Start with a payment-change email, then have a test caller press for a shortcut. Follow the decision through the callback and approval steps. If the employee accepts the incoming call as verification, the exercise has found a payment procedure worth fixing.
When a reported request uses an attacker-controlled domain or fake portal, the asset may be targeting more than one person. Preserve it as part of the investigation and look for related brand impersonation, while finance checks affected transactions.
Doppel’s campaign-level visibility helps connect related impersonation signals. If a supplier lookalike appears in several reports, investigators can check for a wider campaign. Finance can identify who else received a payment-change request while security investigates the infrastructure.
Record both outcomes: Establish what happened to the payment and whether the attacker still has access or active infrastructure. Keep both answers in the incident record so finance and security can coordinate the follow-up.
A small slice of complaints produced a much larger slice of reported losses. That’s a good reason to bring the 2.5% and 15% figures into discussions about payment authority, verification, and incident response. Put an actual payment amount beside the alert count, and the priority becomes easier to explain.
Review the payment changes your organization could approve today. If a familiar name can get a new beneficiary accepted without an independent check, you’ve found something worth fixing before the next convincing request arrives.
Could your team catch impersonation before a payment goes the wrong way? Request a Doppel demo to explore how campaign context and realistic finance scenarios can help you test that risk.
