Business Email Compromise Statistics 2026: Losses, Payments and Claims
CyberReviewed Research Desk ·
Business email compromise is a fraud in which a criminal poses as an executive, vendor, attorney or title company by email and asks for a payment or a change to bank details. Complaints to the FBI's Internet Crime Complaint Center about it rose 15.5% in 2025 to 24,768, and reported losses reached $3,046,598,558, the highest annual total in IC3's reports. Only investment fraud cost Americans more. Treasury teams report it as the most common form of payments fraud they face, and it was the most common claim type at the cyber insurer Coalition.
So we set out to measure how much BEC costs in 2026 and how the money is taken.
Our analysts combined eight years of FBI IC3 complaint and loss data, from 2018 through 2025, with the FBI's figures on BEC victims by age, payment method and recovered funds. We added the Association for Financial Professionals' 2026 survey of 465 US treasury practitioners, Coalition's 2026 analysis of cyber insurance claims, Arctic Wolf's incident response caseload and Verizon's 2026 Data Breach Investigations Report. From the FBI data we also calculated the average loss per complaint and BEC's share of all reported internet crime losses.
In the following sections, we compare BEC losses by year, the average loss per complaint and by victim age, the payment methods fraudsters use, BEC's share of insurance claims and the controls finance teams rate most effective.
BEC losses reported to the FBI reached $3.05 billion in 2025
IC3 recorded 24,768 BEC complaints in 2025 with $3,046,598,558 in adjusted losses, up 10.0% from $2,770,151,146 in 2024.12345 Losses have more than doubled since 2018, when 20,373 complaints reported $1,297,803,489, while the number of complaints grew 21.6%.6 Across the eight years, victims reported $18,842,882,603 in BEC losses on 173,002 complaints.
| Year | Complaints | Adjusted losses | Change in losses |
|---|---|---|---|
| 2018 | 20,373 | $1,297,803,489 | No prior year |
| 2019 | 23,775 | $1,776,549,688 | +36.9% |
| 2020 | 19,369 | $1,866,642,107 | +5.1% |
| 2021 | 19,954 | $2,395,953,296 | +28.4% |
| 2022 | 21,832 | $2,742,354,049 | +14.5% |
| 2023 | 21,489 | $2,946,830,270 | +7.5% |
| 2024 | 21,442 | $2,770,151,146 | -6.0% |
| 2025 | 24,768 | $3,046,598,558 | +10.0% |
- 2024 was the only year in the series when losses fell. Complaints that year were almost flat, at 47 fewer than in 2023.
- The 3,326 additional complaints in 2025 were the biggest one-year increase since 2019.
- Complaints have stayed between about 19,000 and 25,000 a year while losses climbed, so most of the growth comes from larger thefts per victim.
The FBI's longer count is larger. Its September 2024 public service announcement put exposed BEC losses from October 2013 through December 2023 at $55,499,915,582 across 305,033 domestic and international incidents, drawing on complaints, law enforcement reports and bank filings. Complaints to IC3 over the same period counted 158,436 US victims with $20,089,561,364 in exposed losses. BEC had been reported in all 50 states and 186 countries, and banks in the United Kingdom and Hong Kong were the most common intermediate stops for stolen funds, followed by China, Mexico and the United Arab Emirates.7
BEC fell to 14.6% of all reported internet crime losses
BEC was the second costliest crime type IC3 tracked in 2025, after investment fraud at $8,648,617,756. It is shrinking as a share of the total because other fraud is growing faster. All losses reported to IC3 rose 26% in 2025 to $20.877 billion, on 1,008,597 complaints. BEC made up 2.5% of those complaints and 14.6% of the losses.1
| Year | All reported losses | BEC share |
|---|---|---|
| 2020 | $4.2 billion | 44.4% |
| 2021 | $6.9 billion | 34.7% |
| 2022 | $10.3 billion | 26.6% |
| 2023 | $12.5 billion | 23.6% |
| 2024 | $16.6 billion | 16.7% |
| 2025 | $20.877 billion | 14.6% |
- Total reported losses grew about fivefold from 2020 to 2025, while BEC losses grew by about 63%.
- Investment fraud cost 2.8 times as much as BEC in 2025.
- BEC dollar losses rose in four of the last five years, so the cost to businesses keeps climbing even as the share falls.
The average BEC complaint reported a $123,005 loss
Dividing adjusted losses by complaints gives an average of $123,005 per BEC complaint in 2025, down 4.8% from $129,193 in 2024 and below the 2023 peak of $137,132. The average was $63,702 in 2018, so it has nearly doubled in eight years.16 For comparison, IC3's average across all crime types in 2025 was $20,699.1
IC3 also breaks down BEC complaints by the age of the person filing, who is often reporting for a business.1
| Age | Complaints | Losses | Average loss |
|---|---|---|---|
| 20 to 29 | 1,250 | $45,754,756 | $36,604 |
| 30 to 39 | 3,619 | $356,707,180 | $98,565 |
| 40 to 49 | 5,090 | $624,292,591 | $122,651 |
| 50 to 59 | 4,910 | $618,105,890 | $125,887 |
| 60 and over | 4,566 | $568,048,472 | $124,408 |
- Complainants aged 40 to 59 filed 10,000 complaints and reported $1,242,398,481, about 41% of 2025 BEC losses.
- BEC complaints from people 60 and over rose 38.4% from 2024 and their losses rose 47.5%, from $385,001,099. In 2022 that group had reported $477,342,728.
- The average loss for people in their 20s was less than a third of the average for any group over 40. Fraud training should reach the senior staff and owners who approve payments, as well as junior employees.
IC3 counted 135 BEC complaints in 2025 that referred to artificial intelligence, with $30,256,592 in losses, about 1% of the BEC total. BEC complaints with a cryptocurrency link rose to 1,526, with $83,771,329 in losses, from 256 complaints and $63,882,699 in 2024.12
Wire transfers carry most of the stolen money
BEC victims who filed with IC3 in 2025 most often reported losing money by wire transfer or ACH, at 86% of reports, according to the FBI's breakdown of how complainants paid.1
| Payment method | Share of reports |
|---|---|
| Wire transfer or ACH | 86% |
| Prepaid or gift card | 7% |
| Peer-to-peer payment | 3% |
| Check | 2% |
| Debit or credit card | 2% |
- All methods other than wire and ACH together made up 14% of reports.
- IC3 counts real estate fraud as a separate crime type. It drew 12,368 complaints and $275,110,419 in losses in 2025.
- Because so much moves by wire, how fast a victim reports matters. Banks can only freeze or recall a wire while the money is still in a recipient account.
Treasury teams report a wider spread. In AFP's 2026 survey, 49% of organizations hit by BEC said wire transfers were the payment method used, down from 63% in 2024. ACH debits rose to 34% and checks to 33%, while ACH credits fell to 31% from 50%. Real-time payments were targeted at 6% of organizations, up from 3%.8
BEC affected 74% of the organizations in AFP's survey that experienced payments fraud in 2025, including 72% of those with revenue under $1 billion and 75% of those with revenue of $1 billion or more. Overall, 76% of organizations experienced attempted or actual payments fraud, and 39% said they had received genuine emails that fraudsters had intercepted.89
BEC was 31% of cyber insurance claims
Coalition, a cyber insurer, found that BEC was the most common claim type among its policyholders in 2025, at 31% of claims, and funds transfer fraud followed at 27%. BEC claim frequency rose 15% to 0.47% of policyholders, while the average BEC claim fell 28% to $27,000.10
| Period | Claims frequency | Average severity |
|---|---|---|
| First half 2023 | 0.34% | $20,442 |
| Second half 2023 | 0.36% | $49,032 |
| First half 2024 | 0.43% | $28,301 |
| Second half 2024 | 0.40% | $46,973 |
| First half 2025 | 0.42% | $30,855 |
| Second half 2025 | 0.52% | $24,500 |
- Frequency in the second half of 2025 was the highest in the period and 24% above the first half.
- Severity rose in the second half of both 2023 and 2024, but fell in the second half of 2025.
- Coalition counts funds transfer fraud as a separate claim type, with an average loss of $141,000. In 2025, 52% of those claims began with a BEC event and averaged $112,000, so much of the cost of BEC shows up under that heading.
Incident responders see the same pattern. BEC made up 26% of Arctic Wolf's incident response cases from November 2024 through October 2025, second only to ransomware for the third year. Where the root cause was confirmed, 85% of BEC cases began with email phishing, and finance and insurance firms and legal practices were the most targeted.11 In Verizon's 2026 analysis of email attacks blocked by security gateways, 3% were BEC-style attempts to get a victim to change or add a bank account ahead of a wire transfer.12
The BEC controls finance teams rate most effective
AFP asked treasury practitioners which BEC controls their organizations use and how well they work. Almost all use the basic verification steps, but fewer than two-thirds of the organizations that use each one rate it very effective.8
| Control | Implemented | Rated very effective |
|---|---|---|
| Policies to verify changes to invoices, bank deposits and contact details | 96% | 58% |
| Employee training on fraudulent emails and spear phishing | 96% | 42% |
| Calling the payee on a phone number from official records | 94% | 63% |
| Senior management sign-off above a threshold | 94% | 52% |
| No payments initiated on the basis of email or messaging | 91% | 53% |
| Extra training for employees who fail phishing tests | 84% | 36% |
| Passcodes known only to both parties to a wire | 42% | 52% |
| Firing employees who repeatedly fail phishing tests | 35% | 29% |
- Calling back on a number from official records had the highest very effective rating of any control.
- Training was as widely used as verification policies but rated very effective 16 points less often.
- Shared wire passcodes are used by fewer than half of organizations, yet 52% of the organizations that use them rate them very effective, the same as senior sign-off. They are a low-cost addition for teams that already call back.
The IC3 Recovery Asset Team asks banks to freeze funds when victims report quickly. It handled 3,900 incidents in 2025 involving $1,163,919,846 in attempted theft and froze $679,013,183, a 58% success rate. BEC has historically made up most of those incidents. In one 2025 case, a city government office in Oregon recalled a wire of more than $6 million after the recipient bank, alerted by an earlier freeze on the same account, checked with the sending bank.1 Coalition recovered $21.8 million for its policyholders in 2025, an average of $202,000 per incident.10
Smaller companies are less likely to get money back. Among AFP respondents with revenue under $1 billion that experienced payments fraud, 48% incurred a loss and 24% of those recovered none of it. Among larger organizations, 66% had a loss and 19% recovered nothing.8
What the figures mean for finance teams
BEC losses reported to the FBI have risen in six of the last seven years, to more than $3 billion in 2025, and the average complaint now reports a six-figure loss. Insurance claims for BEC are becoming more frequent, and most cases still begin with a phishing email.
The money mostly leaves by wire or ACH, which gives victims a short window. The FBI's Recovery Asset Team froze more than half of the money in the attempted thefts it worked on in 2025, and the treasury controls rated most effective are checks on payment changes made outside email.
So if you run payments, require a call-back on a number from your own records before changing any bank details, and report a suspicious wire to your bank and IC3 the same day.
Sources
- FBI Internet Crime Complaint Center, 2025 Internet Crime Report
- FBI Internet Crime Complaint Center, 2024 Internet Crime Report
- FBI Internet Crime Complaint Center, 2023 Internet Crime Report
- FBI Internet Crime Complaint Center, 2022 Internet Crime Report
- FBI Internet Crime Complaint Center, 2021 Internet Crime Report
- FBI Internet Crime Complaint Center, 2020 Internet Crime Report
- FBI Internet Crime Complaint Center, Business Email Compromise: The $55 Billion Scam (public service announcement I-091124-PSA, September 2024)
- Association for Financial Professionals, 2026 AFP Payments Fraud and Control Survey Report: Key Highlights
- Association for Financial Professionals, Over 75 percent of US firms experienced payments fraud in 2025 (press release)
- Coalition, 2026 Cyber Claims Report
- Arctic Wolf, 2026 Threat Report
- Verizon, 2026 Data Breach Investigations Report
Methodology
BEC complaint counts and adjusted losses come from the FBI IC3 Internet Crime Reports: 2018 to 2020 from the 2020 report, 2021 from the 2021 report, 2022 from the 2022 report, 2023 from the 2023 report, 2024 from the 2024 report and 2025 from the 2025 report. IC3 figures are complaints filed by victims and are not a full count of BEC. All reported losses by year come from the "Losses by Year" chart in the 2025 report, which rounds earlier years to one decimal place in billions. Average loss per complaint, year-on-year changes and BEC's share of all losses are calculated by CyberReviewed from the published figures. Age data covers complainants who gave an age, and the under-20 group is not shown; IC3 notes that BEC complainants aged 60 and over may be reporting on behalf of a business. The payment method shares for 2025 come from IC3's chart of the most frequent ways BEC complainants reported losses. The 2013 to 2023 totals come from IC3's September 2024 public service announcement. AFP figures come from the 2026 Payments Fraud and Control Survey Report highlights, based on 465 responses from US treasury practitioners in January 2026 about fraud in 2025. Coalition figures cover claims from its policyholders in 2025. Arctic Wolf figures cover its incident response cases from November 1, 2024 to November 1, 2025. Verizon figures come from the 2026 Data Breach Investigations Report. Percentages are calculated from the published figures and rounded once. All money is in US dollars.
