Business Email Compromise Statistics 2026
By Axis Intelligence Research
Co-author: Marcus Chen | Last updated: August 13, 2026 | License: CC BY 4.0
Business email compromise cost US victims $3,046,598,558 across 24,768 complaints in 2025, according to the FBI Internet Crime Complaint Center. That is $123,005 per complaint, 109 times the average phishing loss, and the second-largest loss category in federal cybercrime reporting. Complaints rose 15.5 percent. Losses rose 10 percent.
Quick Answer: BEC by the Numbers
Business email compromise generated $3.05 billion in reported US losses in 2025 from 24,768 complaints — an average of $123,005 per incident. According to Axis Intelligence Research, BEC carries a BEC Loss Concentration Ratio (BLCR) of 5.94, meaning its share of reported dollar losses is nearly six times its share of reported complaints. Federal fund-freezing operations covered at most 22.3 percent of those losses.
Key Findings
- According to the FBI IC3 2025 Annual Report, business email compromise produced $3,046,598,558 in reported US losses from 24,768 complaints in 2025.
- According to Axis Intelligence Research, the average BEC loss per complaint was $123,005 in 2025 — 109 times the $1,127 average phishing/spoofing loss recorded the same year.
- According to Axis Intelligence Research, the BEC Loss Concentration Ratio fell from 6.69 in 2024 to 5.94 in 2025, the first decline in BEC’s relative loss dominance despite rising absolute losses.
- According to Axis Intelligence Research, the Recovery Coverage Ceiling for 2025 was 22.3 percent — the maximum share of reported BEC losses that federal fund-freezing could have offset, and the true figure is lower.
- According to FinCEN Bank Secrecy Act analysis, BEC scams using fraudulent vendor or client invoices averaged $125,439 per transaction, versus $50,373 for CEO impersonation — a 2.49x difference in yield per attempt.
How Much Money Did Business Email Compromise Cost in 2025?
The FBI’s IC3 2025 Annual Report logged $3,046,598,558 in BEC losses. That places BEC second only to investment fraud ($8.65 billion) and ahead of tech support fraud ($2.13 billion) in the federal loss table.
The four-year series matters more than the single year.
BEC Losses and Complaints, 2022–2025
| Year | Complaints | Reported losses | Average loss per complaint | Source |
|---|---|---|---|---|
| 2022 | 21,832 | $2,742,354,049 | $125,612 | FBI IC3 2024 Annual Report, three-year comparison |
| 2023 | 21,489 | $2,946,830,270 | $137,132 | FBI IC3 2025 Annual Report, three-year comparison |
| 2024 | 21,442 | $2,770,151,146 | $129,193 | FBI IC3 2025 Annual Report, three-year comparison |
| 2025 | 24,768 | $3,046,598,558 | $123,005 | FBI IC3 2025 Annual Report, p. 8 |
Average loss column calculated by Axis Intelligence Research from IC3 complaint and loss totals.
For three consecutive years, BEC complaint volume sat almost perfectly still — 21,832, then 21,489, then 21,442, a run confirmed across both the 2024 and 2025 editions of the report. A variance of under two percent across three years is not a threat that is growing. It is a threat that has found its ceiling of reportable victims. Then 2025 broke the pattern: 24,768 complaints, up 15.5 percent.
Here is what actually happened. Losses grew slower than complaints. The average loss per incident fell from $129,193 to $123,005, a 4.8 percent decline. More victims, smaller average hits. That is the signature of an attack moving down-market — away from the treasury departments of large enterprises with dual-authorization controls, toward smaller organizations and individual transactions where one person can move money alone.
The related phishing statistics picture makes the contrast stark. Phishing and spoofing generated 191,561 complaints in 2025 and $215,843,126 in losses — an average of $1,127. BEC produced 12.9 percent of phishing’s complaint volume and 14.1 times its dollar losses.
Average Versus Median: Why the Two Headline Numbers Disagree
The two most-cited BEC figures in the industry do not describe the same thing, and the gap between them is analytically useful.
IC3’s arithmetic average for 2025 is $123,005. Verizon’s Data Breach Investigations Report states that the median amount extracted from BEC victims has settled around $50,000.
According to Axis Intelligence Research, the ratio between them is 2.46. Both numbers are correct. A typical BEC wire is roughly $50,000; the average is $123,005 because a small number of very large transfers pull it upward. IC3’s own 2025 casework illustrates the tail directly: an Oregon city government reported a single BEC loss of over $6 million, and a Missouri homebuyer received fraudulent wire instructions for over $1.3 million.
Anyone budgeting for BEC exposure using the average is modelling a rare event. Anyone using the median is ignoring the events that end careers.
A source disagreement Axis Intelligence Research will not reconcile silently. Verizon’s 2025 DBIR states that more than $6.3 billion was transferred in BEC scams in 2024, attributing the figure to IC3. That number does not appear in the IC3 2024 Annual Report, which records $2,770,151,146 in BEC losses. The most likely explanation is a mix of measurement bases: IC3’s annual reports publish adjusted loss, while the IC3 BEC public service announcement series publishes exposed loss, defined by the FBI as actual losses plus attempted thefts. The two are not interchangeable and differ by roughly a factor of two. We publish IC3’s adjusted-loss figure throughout this page and flag the discrepancy rather than averaging two incompatible measurements into a number that means nothing.
What Is the BEC Loss Concentration Ratio?
Raw loss totals answer “how much.” They do not answer “how much does BEC matter relative to everything else being reported.” So Axis Intelligence Research built a metric for it.
BLCR — BEC Loss Concentration Ratio
BLCR = (BEC share of total reported losses) ÷ (BEC share of total reported complaints)
A BLCR of 1.0 describes a crime type whose financial weight exactly matches its reporting frequency. Above 1.0, the crime punches above its complaint volume. The inputs are two published IC3 totals per year and two published BEC totals per year — four numbers, no weighting, no adjustment, fully reproducible by anyone with the same reports.
| Year | BEC loss share | BEC complaint share | BLCR | Source |
|---|---|---|---|---|
| 2024 | 16.688% | 2.4946% | 6.69 | FBI IC3 2024 Annual Report |
| 2025 | 14.593% | 2.4557% | 5.94 | FBI IC3 2025 Annual Report |
BLCR calculated by Axis Intelligence Research. Denominators use IC3’s published annual totals: 859,532 complaints and $16.6 billion in losses for 2024; 1,008,597 complaints and $20.877 billion for 2025.
According to Axis Intelligence Research, BLCR fell from 6.69 to 5.94 between 2024 and 2025 — a 11.2 percent decline in BEC’s relative loss concentration, in a year when BEC’s absolute losses rose 10 percent.
That combination is the finding. BEC did not get less damaging. Investment fraud got more damaging faster, climbing from $6.57 billion to $8.65 billion and dragging the denominator up with it. A ratio that falls while its numerator rises is telling you the composition of cybercrime is shifting, not that the threat receded.
Marcus Chen: A falling BLCR is the kind of number that gets misread in a headline. It does not mean accounts payable is safer this year. It means the reporting pool got flooded with crypto investment losses, which are larger per victim and far more numerous. If you run a finance function, the number that governs your exposure is still $123,005 per successful attempt, and it has not moved much in four years.
How Much BEC Money Actually Gets Recovered?
This is the question every CFO asks after the wire leaves, and it is the one the industry answers worst.
The FBI’s Recovery Asset Team runs the Financial Fraud Kill Chain (FFKC), which requests account freezes at recipient banks. In 2025 the FFKC handled 3,900 incidents against $1,163,919,846 in attempted theft and froze $679,013,183 — a 58 percent success rate on the cases it touched.
That 58 percent is the number vendors quote. It is also the wrong number for estimating your odds, because it measures success only within cases that reached the FFKC in time.
RCC — Recovery Coverage Ceiling
RCC = total FFKC funds frozen ÷ total reported BEC losses for the same year
| Year | FFKC frozen | Reported BEC losses | RCC | Source |
|---|---|---|---|---|
| 2024 | $561,600,000 | $2,770,151,146 | 20.3% | FBI IC3 2024 Annual Report, p. 13 |
| 2025 | $679,013,183 | $3,046,598,558 | 22.3% | FBI IC3 2025 Annual Report, p. 17 |
RCC calculated by Axis Intelligence Research. This is a deliberate upper bound, not an estimate of BEC recovery.
According to Axis Intelligence Research, the 2025 Recovery Coverage Ceiling was 22.3 percent — meaning that even if every dollar the FFKC froze in 2025 had come from a BEC case, it would offset at most 22.3 percent of reported BEC losses. The real figure is materially lower, because IC3 states plainly that while BEC historically dominated FFKC initiations, 2025 saw a rise in tech support and account takeover cases entering the same pipeline.
FinCEN’s independent Rapid Response Program shows the same shape. In FY22 it acted on 806 referrals worth more than $356 million and froze approximately $174 million — 49 percent. Since 2014 the program has frozen more than $1.3 billion, a cumulative 51 percent success rate.
Both programs depend on the receiving bank acting fast, which is why the detection capability of the institution on the other end matters as much as the victim’s own controls — a dynamic covered in our AI in banking statistics analysis.
Two federal freeze programs, two success rates near 50 percent on the cases they receive, and a ceiling near 22 percent across all reported losses. The gap between those figures is entirely explained by cases that never reach a freeze request fast enough. FinCEN is explicit about the window: recovery success is materially higher when victims or their banks report within 72 hours of the transaction.
Which Industries Are Targeted Most by Business Email Compromise?
IC3 does not publish BEC by industry. FinCEN does, through Suspicious Activity Report analysis — a separate federal pipeline fed by banks rather than victims, and the single most under-cited BEC dataset in circulation.
| Sector | Share of BEC incidents, 2017 | Share of BEC incidents, 2018 | Source |
|---|---|---|---|
| Manufacturing and construction | 20% | 25% | FinCEN Financial Trend Analysis, July 2019 |
| Commercial services | 6% | 18% | FinCEN Financial Trend Analysis, July 2019 |
| Real estate | 9% | 16% | FinCEN Financial Trend Analysis, July 2019 |
| Financial firms | 16% | 9% | FinCEN Financial Trend Analysis, July 2019 |
FinCEN’s sector analysis identified manufacturing and construction as the most targeted sector in both years. The reason is structural rather than technological: these firms run regular high-value wire payments to overseas suppliers, and 33 percent of BEC transactions targeting them in 2017 listed a foreign beneficiary. A wire to a new overseas account is not anomalous in a supply chain that already sends them monthly.
Real estate carried the highest average fraudulent transaction amount at $179,001, against $53,728 for manufacturing and construction — a 3.33x difference, according to Axis Intelligence Research. Real estate firms represented 9 percent of targeted firms in 2017 but over 20 percent of fraudulent transaction value.
The volume of this pipeline is easy to miss. FinCEN received nearly 6,000 BEC-related SARs in 2016 averaging $110 million in monthly suspicious transaction value, rising to nearly 14,000 filings averaging $301 million per month in 2018 — a 174 percent increase in monthly value across two years.
Which BEC Scam Types Steal the Most Money?
The public image of BEC is a fake email from the CEO. FinCEN’s SAR narrative sampling shows that image is roughly a decade out of date.
| Scam typology | Share of incidents, 2017 | Share of incidents, 2018 | Average transaction | Source |
|---|---|---|---|---|
| Fraudulent vendor or client invoice | 30% | 39% | $125,439 | FinCEN Financial Trend Analysis, July 2019 |
| CEO or president impersonation | 33% | 12% | $50,373 | FinCEN Financial Trend Analysis, July 2019 |
| Impersonation of an outside entity | not tracked | 20% | not published | FinCEN Financial Trend Analysis, July 2019 |
CEO impersonation collapsed from 33 percent of sampled incidents to 12 percent in a single year. Vendor invoice fraud rose from 30 percent to 39 percent and became the dominant method. According to Axis Intelligence Research, vendor invoice fraud yields 2.49 times more per transaction than CEO impersonation — and while it accounted for 30 percent of transactions in 2017, it produced 41 percent of total transaction value.
Marcus Chen: Attackers did not abandon CEO fraud because it stopped working technically. They abandoned it because finance teams got trained on it. Every awareness program in the country teaches the urgent-email-from-the-boss scenario. Almost none of them teach the scenario where a supplier your company has paid for six years sends an invoice on their real letterhead from their real compromised mailbox, with one field changed. That attack has no urgency, no unusual sender, no anomaly for a gateway to score — and it pays two and a half times better. Vendor email compromise is where the money went, and the control that stops it is a callback to a phone number already on file, not a spam filter.
How Big Is Real Estate Wire Fraud?
Real estate BEC gets its own federal study because homebuyers, unlike companies, rarely survive the loss.
FinCEN’s real estate BEC analysis examined 2,013 real estate BEC incidents worth $710 million reported between January 2020 and December 2021.
| Metric | Value | Source |
|---|---|---|
| Real estate BEC incidents, 2020–2021 | 2,013 | FinCEN Financial Trend Analysis, March 2023 |
| Value of those incidents | $710,000,000 | FinCEN Financial Trend Analysis, March 2023 |
| Title or closing company impersonated | 36.91% (743 incidents) | FinCEN Financial Trend Analysis, March 2023 |
| Realtor impersonation, share of value | 23.12% ($189.8M) | FinCEN Financial Trend Analysis, March 2023 |
| Initial transfers staying domestic | 88% (1,767 incidents) | FinCEN Financial Trend Analysis, March 2023 |
| Full recovery of funds | 22.21% (447 incidents) | FinCEN Financial Trend Analysis, March 2023 |
| No recovery of funds | 20.37% (410 incidents) | FinCEN Financial Trend Analysis, March 2023 |
Median incident value rose from $108,712 in 2020 to $131,917 in 2021, tracking home prices upward.
The recovery breakdown deserves careful reading, and most coverage gets it wrong. Recovery outcomes were unknown or unreported in 30.45 percent of incidents. Among the 69.55 percent where the outcome was documented, full recovery occurred in 31.9 percent of cases and no recovery in 29.3 percent, according to Axis Intelligence Research. Roughly one in three documented cases recovered everything. Roughly one in three recovered nothing.
IC3 separately tracks a real estate crime category, which recorded 12,368 complaints and $275,110,419 in losses in 2025.
Who Loses the Most to BEC? Losses by Age Group
IC3 publishes BEC complaint and loss counts by age band but does not calculate severity per band. Axis Intelligence Research does.
| Age band | Complaints | Losses | Average loss per complaint | Share of age-reported losses |
|---|---|---|---|---|
| Under 20 | 73 | $15,137,364 | $207,361 | 0.7% |
| 20–29 | 1,250 | $45,754,756 | $36,604 | 2.1% |
| 30–39 | 3,619 | $356,707,180 | $98,565 | 16.0% |
| 40–49 | 5,090 | $624,292,591 | $122,651 | 28.0% |
| 50–59 | 4,910 | $618,105,890 | $125,887 | 27.7% |
| 60+ | 4,566 | $568,048,472 | $124,408 | 25.5% |
Complaint and loss figures: FBI IC3 2025 Annual Report, pp. 32–33 and p. 46. Average and share columns calculated by Axis Intelligence Research. The under-20 band rests on 73 complaints and is too small to support inference.
Age-reported complaints cover 19,508 of 24,768 BEC complaints (78.8 percent) and $2,228,046,253 of $3,046,598,558 in losses (73.1 percent). The remaining 26.9 percent of losses carry no age attribution, which is expected given that IC3 notes BEC complaints may be filed on behalf of a business.
Three bands — 40–49, 50–59 and 60+ — account for 81.2 percent of age-reported BEC losses and cluster tightly between $122,651 and $125,887 in average loss. That convergence is the point. BEC severity does not scale with the victim’s age; it scales with signing authority. The 40-to-65 range is where payment approval sits in most organizations.
The elder segment is the exception that moves. Complainants aged 60 and over filed 4,566 BEC complaints in 2025 against 3,300 in 2024 and 3,080 in 2023, with losses rising from $385,001,099 to $568,048,472 — a 38.4 percent increase in complaints and a 47.5 percent increase in losses year over year. This is the fastest-moving segment in the entire BEC dataset, and real estate closings are the most likely explanation: IC3’s 2025 FFKC casework for victims aged 60-plus lists BEC and real estate as the second-largest category at 104 incidents.
How Does BEC Money Actually Move?
According to the IC3 2025 Annual Report transaction charts, 86 percent of BEC funds moved by wire transfer or ACH — the highest concentration on a single payment rail of any major fraud category. For comparison, investment fraud runs 72 percent through cryptocurrency.
Axis Intelligence Research cross-checked that reading against IC3’s own descriptor tables. BEC complaints with a cryptocurrency nexus numbered 1,526 (6.2 percent of BEC complaints) accounting for $83,771,329 (2.75 percent of BEC losses), which rules out cryptocurrency as the dominant rail and confirms wire and ACH.
That single fact governs defensive priority. BEC is not a crypto problem, a malware problem, or a patching cadence problem. It is a payment authorization problem that happens to arrive by email. The broader online fraud statistics picture has moved decisively toward cryptocurrency rails; BEC has not moved at all.
Destination data completes the map. FinCEN found 88 percent of real estate BEC initial transfers stayed domestic, moving to US depository accounts controlled by money mules; only 8 percent went directly international. Among those international transfers, Hong Kong led at 18.54 percent, followed by China and Mexico at 12.58 percent each, Nigeria at 9.27 percent and the United Kingdom at 7.28 percent. The FBI’s cumulative BEC analysis independently names the United Kingdom and Hong Kong as the most common intermediary jurisdictions, followed by China, Mexico and the UAE.
The domestic-first pattern is why the 72-hour reporting window matters so much. The money is usually still in a US bank when the victim notices.
How Much Business Email Compromise Is AI-Generated?
For the first time, IC3 tracked artificial intelligence as a descriptor across crime types in 2025. The BEC numbers are smaller than the discourse suggests, and the reason is instructive.
| Metric | Value | Source |
|---|---|---|
| BEC complaints with AI nexus | 135 | FBI IC3 2025 Annual Report, p. 41 |
| Losses from AI-nexus BEC | $30,256,592 | FBI IC3 2025 Annual Report, p. 42 |
| Share of all BEC complaints | 0.55% | Axis Intelligence Research calculation |
| Average loss, AI-nexus BEC | $224,123 | Axis Intelligence Research calculation |
According to Axis Intelligence Research, AI-flagged BEC complaints carry an average loss of $224,123 — 1.82 times the $123,005 average across all BEC complaints.
The 0.55 percent figure is not a measure of how much BEC involves AI. It is a measure of how often victims knew AI was involved and said so in a complaint form. IC3 states directly that AI-related figures are likely undercounts because complainants often do not realise AI was used against them. A well-written impersonation email leaves no evidence of its authorship. A cloned voice on a callback leaves none either.
The severity multiple is the number worth watching, because it is measured on cases where AI use was identifiable — typically voice cloning, which victims notice in retrospect. Our AI phishing statistics and AI scam statistics pages track the wider synthetic-media picture across all fraud categories.
How Big Is Business Email Compromise Globally?
The FBI’s cumulative BEC accounting is the only figure that captures international scope, and it uses the exposed-loss basis rather than the adjusted-loss basis used in annual reports.
| Metric | Value | Source |
|---|---|---|
| Global BEC incidents, Oct 2013 – Dec 2023 | 305,033 | FBI IC3 PSA I-091124 |
| Global exposed dollar loss | $55,499,915,582 | FBI IC3 PSA I-091124 |
| Countries reporting BEC | 186 | FBI IC3 PSA I-091124 |
| Countries receiving fraudulent transfers | over 140 | FBI IC3 PSA I-091124 |
| US victims / exposed loss | 158,436 / $20,089,561,364 | FBI IC3 PSA I-091124 |
| Non-US victims / exposed loss | 6,546 / $1,638,490,375 | FBI IC3 PSA I-091124 |
| Non-US financial recipients / exposed loss | 22,190 / $8,953,920,759 | FBI IC3 PSA I-091124 |
Two derived observations, both by Axis Intelligence Research. First, the average non-US victim loss was $250,304 against $126,799 for US victims — cross-border BEC is roughly twice as costly per victim, consistent with international transactions being larger and harder to recall. Second, the $55.5 billion global figure is 2.76 times the $20.09 billion in US victim-complaint exposed losses over the same period, which quantifies how much of the global BEC picture sits outside direct victim complaints to IC3 — in bank filings, foreign law enforcement records and law enforcement casework.
The FBI recorded a 9 percent increase in identified global exposed losses between December 2022 and December 2023, and attributed part of it to a growth in BEC where funds were routed to custodial accounts at third-party payment processors, peer-to-peer processors and cryptocurrency exchanges rather than to conventional bank accounts.
Which Controls Actually Stop BEC?
Both federal agencies that study BEC converge on the same short list, and none of it is a product category.
FinCEN’s guidance to financial institutions and the real estate sector centres on three process controls: authentication of the participants in a communication, authorization of the transaction itself, and verified communication of any change to transaction details. Its operative instruction is to verify suspicious payment instructions sent by email using a different communication channel, or by contacting someone else authorized to conduct the transaction. Identifying fraudulent instructions before the payment is issued is the entire game.
The FBI’s BEC prevention guidance adds: use secondary channels or two-factor authentication to verify any request to change account information; confirm that a sender’s address matches the party it claims to be, particularly on mobile devices where addresses are truncated; enable full email extension display on employee machines; and treat requests for secrecy or speed as a signal rather than a courtesy.
Marcus Chen: There is no zero-day here. There never was. The DBIR data says what it says every year — the human element sits in the majority of breaches, and pretexting keeps climbing because it does not need an exploit. BEC’s entire technical footprint is a mailbox login and a changed bank account field. What stops it is a rule that a change to payment details triggers a callback to a number already on file, executed by someone who is not the person who received the request. That control costs nothing and fails only when someone is allowed to skip it. Our cybersecurity incident tracking shows the same pattern in newer attack surfaces: the exploit is rarely the story, the authorization workflow is.
Methodology
Collection. Every figure on this page was retrieved from a primary source document during production on August 13, 2026. Sources are the FBI Internet Crime Complaint Center 2025 and 2024 Annual Reports, IC3 Public Service Announcement I-091124, two FinCEN Financial Trend Analyses issued under Section 6206 of the Anti-Money Laundering Act of 2020, and the Verizon 2025 Data Breach Investigations Report Finance Snapshot. No figure is drawn from an aggregator, a vendor blog, or an unfetched secondary summary.
BLCR formula. BLCR = (BEC reported losses ÷ total IC3 reported losses) ÷ (BEC complaints ÷ total IC3 complaints), computed per calendar year. Denominators use IC3’s published annual totals as printed: 859,532 complaints and $16.6 billion for 2024; 1,008,597 complaints and $20.877 billion for 2025. IC3 publishes its annual loss total rounded to three decimal places of a billion; BLCR inherits that rounding, which affects the second decimal place at most.
RCC formula. RCC = total FFKC funds frozen in a calendar year ÷ total reported BEC losses in the same calendar year. The 2024 numerator sums IC3’s published domestic ($469.1 million) and international ($92.5 million) FFKC freeze totals. RCC is defined as a ceiling, not an estimate: the FFKC processes crime types beyond BEC, and IC3 states that non-BEC initiations rose in 2025, so BEC-specific recovery coverage is below the RCC in both years.
Derived columns. Average loss per complaint, per-band averages, loss shares, year-over-year percentages and all ratios described as Axis Intelligence Research calculations are arithmetic on the published figures shown in the adjacent columns. Every one is reproducible from this page and from the accompanying CSV, and all were verified programmatically before publication.
Scope and known constraints. IC3 figures capture US-directed victim complaints only and use adjusted loss, which excludes attempted thefts, business interruption, remediation cost and legal expense. Complaint-based data undercounts by an unknown factor, since many organizations report to local law enforcement, to their bank, or not at all. FinCEN SAR-derived sector and typology data reflects 2017–2018 and 2020–2021 review windows and is the most recent BEC sector analysis published by that agency; it is labelled with its period wherever it appears rather than presented as current. The IC3 transaction-rail chart is published as a percentage graphic without underlying counts; the 86 percent wire and ACH reading was corroborated against IC3’s cryptocurrency descriptor tables before publication. IC3 restates prior-year figures across editions, and the 2022 and 2023 values here are taken from the most recent edition in which each appears.
About This Dataset
The complete dataset behind this page is published as a CSV under a Creative Commons Attribution 4.0 International (CC BY 4.0) licence. Every number in the prose above exists as a row, with value, unit, as-of date, source organization, source document, source URL, retrieval date, primary-source flag, Axis-calculated flag and method note.
File: business-email-compromise-statistics-2026.csv
Licence: CC BY 4.0
Mirrors: Hugging Face, Kaggle and GitHub
Citation formats
APA: Axis Intelligence Research. (2026). Business email compromise statistics 2026. https://axis-intelligence.com/business-email-compromise-statistics/
MLA: Axis Intelligence Research. “Business Email Compromise Statistics 2026.” Axis Intelligence, 13 Aug. 2026, axis-intelligence.com/business-email-compromise-statistics/.
Chicago: Axis Intelligence Research. “Business Email Compromise Statistics 2026.” Axis Intelligence. Last modified August 13, 2026. https://axis-intelligence.com/business-email-compromise-statistics/.
FAQ: BEC Statistics 2026
What counts as business email compromise under the FBI’s definition?
IC3 defines BEC as a scam targeting businesses or individuals working with suppliers, or businesses that regularly perform wire transfer payments, carried out by compromising email accounts and other communication channels including phone numbers and virtual meeting applications, through social engineering or computer intrusion, to conduct unauthorized transfers of funds. Two implications matter for anyone comparing datasets: the definition covers individuals as well as companies, which is why homebuyers appear in BEC statistics; and it explicitly includes voice and video channels, so a deepfaked conference call requesting a wire is BEC, not a separate category.
Why is BEC counted separately from phishing in federal statistics?
IC3 assigns exactly one crime type per complaint, and BEC and phishing/spoofing are distinct categories with no overlap in the published totals. Phishing/spoofing covers unsolicited messages requesting credentials or personal data. BEC covers the unauthorized fund transfer that follows a compromised or spoofed business communication. The separation is why phishing shows 191,561 complaints against $215.8 million in 2025 while BEC shows 24,768 complaints against $3.05 billion — the credential theft and the payment fraud are counted in different buckets even when they are two stages of one operation.
Is vendor email compromise counted inside the BEC figures?
Yes. IC3 does not break vendor email compromise out as a separate crime type, so supplier-impersonation fraud sits inside the 24,768 BEC complaints. FinCEN’s SAR-narrative analysis is the only federal source that separates the typology, and it found fraudulent vendor or client invoices at 39 percent of sampled incidents in 2018, with an average transaction of $125,439 — the highest-yield BEC method it measured.
How quickly must a fraudulent wire be reported to have a chance of recovery?
FinCEN states that its Rapid Response Program has materially greater success identifying and freezing funds when victims or their financial institutions report within 72 hours of the transaction. The FBI’s instruction is to contact the originating financial institution immediately, request a recall along with any indemnification documents, and file at ic3.gov regardless of amount. IC3’s 2025 casework includes a $6 million Oregon municipal wire recalled specifically because a prior freeze on the same recipient account was already on record.
Does multi-factor authentication stop business email compromise?
Not on its own, and the payment-rail data explains why. Eighty-six percent of BEC funds move by wire or ACH, which means the attacker’s objective is an authorized payment, not persistent system access. Where mailbox access is the route in, MFA raises the cost — but adversary-in-the-middle toolkits and MFA prompt bombing both appear in current breach data. Where the attack is pure impersonation from a lookalike domain, MFA on your own tenant is not in the attack path at all. The control that maps to the threat is out-of-band verification of payment changes.
Why do published BEC loss figures differ so widely between reports?
Because at least three different measurement bases circulate under the same label. IC3 annual reports publish adjusted loss, which is what victims reported losing: $3.05 billion for 2025. IC3’s BEC public service announcements publish exposed loss, defined as actual losses plus attempted thefts: $55.5 billion cumulatively from October 2013 to December 2023. FinCEN publishes suspicious transaction value from bank filings, which includes attempted and blocked transactions: roughly $10.8 billion across 31,695 filings in 2020–2021. Any comparison that mixes these bases will produce a number with no defensible meaning.
Which sectors face the highest BEC exposure?
By incident count, FinCEN’s SAR analysis put manufacturing and construction first at 25 percent of reported BEC incidents in 2018, driven by routine high-value payments to overseas suppliers. By value per incident, real estate led with an average fraudulent transaction of $179,001. The two rankings answer different questions: manufacturing and construction firms get attacked most often, real estate transactions lose the most per event.
Are BEC losses concentrated among large enterprises?
The severity data suggests otherwise. Average loss per BEC complaint sits between $122,651 and $125,887 across the 40–49, 50–59 and 60-plus age bands, which together carry 81.2 percent of age-reported BEC losses. That flat distribution across the bands where payment authority concentrates, combined with an average loss that fell 4.8 percent in 2025 while complaint volume rose 15.5 percent, points to BEC broadening across organization sizes rather than concentrating at the top.