Business email compromise and payment fraud cost far more than ransomware in reported losses, yet the figures quoted in board papers are often years old or impossible to trace. This page gathers business email compromise (BEC), impostor and authorised push payment (APP) fraud figures only from the bodies that collect the data: the FBI Internet Crime Complaint Center (IC3), the US Federal Trade Commission (FTC), UK Finance, the Office for National Statistics (ONS), the UK Department for Science, Innovation and Technology (DSIT) and the Anti-Phishing Working Group (APWG). Each figure carries its report name, publisher and as-of year, and all sources are recurring so the page can be refreshed. It is written for finance and treasury leaders, fraud and security teams sizing controls, and analysts who need numbers that will survive scrutiny. Last reviewed: October 2026.
Key takeaways
- BEC is the second costliest crime the FBI tracks. The FBI IC3 Internet Crime Report 2025 recorded 24,768 BEC complaints and $3,046,598,558 in losses, second only to investment fraud and up about 10% on 2024.
- The long-run total is over $55 billion. The FBI IC3 public service announcement of September 2024 put exposed BEC losses at $55,499,915,582 across 305,033 incidents from October 2013 to December 2023.
- Fast reporting recovers money. The IC3 2025 report states its Recovery Asset Team froze $679,013,183 through the Financial Fraud Kill Chain in 2025, a 58% success rate on the incidents it acted on.
- UK APP fraud is rising while business-targeted scams fall. The UK Finance Annual Fraud Report 2026 recorded £576.4 million of APP fraud losses in 2025 (up 19%), but invoice and mandate scam losses fell to £41.3 million and CEO fraud losses fell 53% to £5.6 million.
- Impersonation is the common thread. FTC data for 2025 show more than $3.5 billion lost to impostor scams, including nearly $1 billion to business impersonators, and 66% of UK APP fraud cases in 2025 started online according to UK Finance.
Headline statistics
| Statistic | Figure | Source, publisher and as-of year |
|---|---|---|
| BEC complaints to the FBI | 24,768 (2024: 21,442) | Internet Crime Report 2025, FBI IC3, calendar year 2025 |
| BEC reported losses | $3,046,598,558 (2024: $2,770,151,146) | Internet Crime Report 2025, FBI IC3, 2025 |
| All cyber-enabled crime losses reported to IC3 | $20.877 billion from 1,008,597 complaints | Internet Crime Report 2025, FBI IC3, 2025 |
| Global exposed BEC losses | $55,499,915,582 from 305,033 incidents | PSA I-091124-PSA "Business Email Compromise: The $55 Billion Scam", FBI IC3, October 2013 to December 2023 |
| US consumer fraud losses reported to the FTC | $15.9 billion from about 3 million fraud reports | FTC press release on Joint Economic Committee testimony, FTC, 2025 data |
| UK total payment fraud losses | £1,279.8 million (up 4%) | Annual Fraud Report 2026, UK Finance, 2025 data |
| UK APP fraud losses | £576.4 million from 248,070 cases | Annual Fraud Report 2026, UK Finance, 2025 data |
| Fraud incidents against adults in England and Wales | About 4.5 million (up 11%) | Crime in England and Wales, ONS, year ending June 2026 |
| Average BEC wire transfer requested | $61,732 (Q1 2026: $42,663) | Phishing Activity Trends Report Q2 2026, APWG, Q2 2026 |
Statistics by theme
Each theme gives the figure, the publisher's report and the period. Prior-year values come from the same report so the trend is like for like.
BEC losses reported to the FBI
| Year | BEC complaints | BEC reported losses |
|---|---|---|
| 2023 | 21,489 | $2,946,830,270 |
| 2024 | 21,442 | $2,770,151,146 |
| 2025 | 24,768 | $3,046,598,558 |
Source for the table: FBI IC3 Internet Crime Report 2025, which gives the three-year series. Complaints rose about 15.5% and losses about 10.0% from 2024 to 2025, so the average loss per reported BEC case fell slightly to roughly $123,000 (calculated from the IC3 figures).
- Rank among crime types: In the IC3 2025 report, BEC was second by loss behind investment fraud ($8,648,617,756) and ahead of tech and customer support scams ($2,134,675,818), personal data breach ($1,314,923,988) and confidence or romance fraud ($929,287,469).
- Few complaints, large losses: BEC made up about 2.5% of the 1,008,597 complaints in the IC3 2025 report but about 15% of the $20.877 billion in losses (calculated from the IC3 figures). Phishing/spoofing shows the opposite profile: 191,561 complaints and $215,843,126 in losses.
- What IC3 means by BEC: the 2025 report describes BEC as scams targeting businesses or individuals who work with suppliers or regularly make wire payments, carried out by compromising email and other communication accounts. See the Email Identity and BEC Guide.
The long-run global picture
- Exposed losses since 2013: FBI IC3 PSA I-091124-PSA (11 September 2024) reported $55,499,915,582 in exposed losses from 305,033 domestic and international incidents between October 2013 and December 2023.
- US and non-US victims: The same PSA counted 158,436 US victim complaints with $20,089,561,364 exposed loss, and 6,546 non-US victim complaints with $1,638,490,375.
- Where money goes: Between June 2016 and December 2023, the PSA recorded 89,756 US financial recipients ($17,499,104,054) and 22,190 non-US recipients ($8,953,920,759). It named the United Kingdom and Hong Kong as the leading intermediary destinations in 2023, followed by China, Mexico and the UAE, with more than 140 countries receiving fraudulent transfers.
- Growth: The PSA reported a 9% increase in identified global exposed losses between December 2022 and December 2023, and an increase in BEC reporting where funds went to cryptocurrency exchanges.
Requested amounts and cash-out methods
- Average wire request: The APWG Phishing Activity Trends Report for Q2 2026 found the average wire transfer requested in BEC attacks was $61,732, up 45% from $42,663 in Q1 2026, and wire transfer BEC attacks rose 88% quarter on quarter.
- Cash-out methods: APWG's Q2 2026 data show gift card requests remained the most common BEC cash-out method, ahead of wire transfer, payroll diversion, Interac and cryptocurrency. Gift card and payroll requests are low value but high volume; wire requests carry the large losses.
Recovery and the Financial Fraud Kill Chain
| Financial Fraud Kill Chain, 2025 | Incidents | Amount frozen |
|---|---|---|
| Domestic | 3,574 | $507,042,623 |
| International | 326 | $171,970,560 |
| Combined | 3,900 | $679,013,183 of $1,163,919,846 attempted (58%) |
| Critical infrastructure victims | 655 | $146,561,094 of $261,451,001 (56%) |
Source for the table: FBI IC3 Internet Crime Report 2025. The kill chain works only when a victim reports quickly and the receiving bank can still hold the funds, which is why a 24-hour reporting target belongs in every payments incident plan. See the Business Email Compromise Response Playbook.
UK payment fraud and APP scams
| Category (UK Finance, 2025) | Losses | Cases |
|---|---|---|
| Total fraud | £1,279.8m (+4%) | 4,062,198 (+11%) |
| Unauthorised fraud | £703.4m (-5%) | 3,814,128 (+11%) |
| APP fraud, all | £576.4m (+19%) | 248,070 (+7%) |
| APP fraud, personal accounts | £500.8m (+26%) | 240,566 |
| APP fraud, non-personal (business) accounts | £75.6m (-11%) | 7,504 (+13%) |
| Investment scams | £221.5m (+40%) | 14,893 |
| Impersonation of police or bank staff | £55.5m (-18%) | 6,016 |
| Invoice and mandate scams | £41.3m (-4%) | 2,305 |
| Romance scams | £39.2m (+23%) | 6,335 |
| CEO fraud | £5.6m (-53%) | 197 (-29%) |
Source for the table: UK Finance Annual Fraud Report 2026 (2025 data). Invoice and mandate scams and CEO fraud are the UK Finance categories closest to BEC.
- Prevention: UK Finance's 2026 report states that £1.68 billion of unauthorised fraud was prevented in 2025, up 11%.
- Where APP fraud starts: According to the UK Finance Annual Fraud Report 2026, 66% of APP fraud cases in 2025 were enabled by online sources and 17% by telecommunications.
- Reimbursement: UK Finance reports that 88% of in-scope APP losses were reimbursed in the first year of the Payment Systems Regulator's mandatory reimbursement rules, and that £354.3 million of all 2025 APP losses was returned to victims. See the Authorised Push Payment (APP) Fraud Guide.
US consumer fraud and impersonation
- Total reported losses: The FTC's 25 March 2026 release on its Joint Economic Committee testimony states consumers reported $15.9 billion in fraud losses in 2025 from about 3 million fraud reports, up from more than $12 billion and 2.6 million reports the year before.
- Impostor scams: The same FTC release identifies impostor scams as the most reported category in 2025, with more than 1 million reports and over $3.5 billion in losses. Investment scams caused the largest losses at $7.9 billion.
- Business and government impersonation: The FTC's 15 June 2026 release reports nearly $1 billion lost to business impersonators in 2025 (up from $866 million in 2024), with bank impersonators accounting for the highest losses, and about $920 million to government impersonators (up from $789 million).
- Older victims: The FBI IC3 Internet Crime Report 2025 recorded 201,266 complaints from people aged 60 and over, with $7.748 billion in losses.
UK crime survey and business victims
- Fraud against individuals: The ONS bulletin Crime in England and Wales: year ending June 2026 (22 October 2026) estimated about 4.5 million fraud incidents from the Crime Survey for England and Wales, an 11% rise, with bank and credit account fraud up 13% to 2.8 million. Computer misuse rose 23% to about 817,000 incidents.
- Recorded fraud: The same ONS bulletin reports 348,944 fraud offences reported directly to Report Fraud (up 15%) and 405,990 referred from Cifas (up 8%) in the year ending June 2026. Report Fraud replaced Action Fraud and the National Fraud Intelligence Bureau on 4 December 2025.
- Businesses: The DSIT Cyber Security Breaches Survey 2025/2026 found 3% of UK businesses (about 43,000) and 1% of charities were victims of cyber-facilitated fraud in the previous 12 months, and 12% of businesses were targeted by impersonation of their organisation in emails or online.
AI, deepfakes and BEC
- AI-linked complaints: The FBI IC3 Internet Crime Report 2025 identified 22,364 complaints with an AI nexus and $893,346,472 in adjusted losses, including $30,256,592 in BEC losses where AI was involved.
- Scale in context: AI-linked BEC losses were about 1% of total BEC losses in the IC3 2025 data (calculated), so the bulk of BEC still relies on ordinary email impersonation and account compromise. Individual deepfake cases can still be very large: in the Arup deepfake fraud of 2024, a video call with a faked CFO led to HK$200 million moving in 15 transfers. See the Executive Deepfake and CEO Fraud Guide.
What the numbers mean for defenders
BEC is a process and identity failure more than a malware problem. The figures point to a small set of controls that change outcomes: verifying payment changes out of band, protecting mailboxes from takeover, stopping domain spoofing and reporting fast enough for funds to be frozen.
| Finding | Control response | Framework mapping |
|---|---|---|
| BEC losses of $3.05 billion in 2025 (FBI IC3) | Dual approval and call-back verification to a known number for any new payee or bank detail change | NIST CSF 2.0 PR.AT-01; NIST SP 800-53 AT-2(3) |
| 58% of funds frozen when the kill chain is used (FBI IC3 2025) | A 24-hour route from finance to bank fraud team and IC3 or Report Fraud; rehearse it | NIST CSF 2.0 RS.MA-01; ISO/IEC 27001:2022 A.5.24 |
| BEC relies on compromised mailboxes | Phishing-resistant MFA for finance and executives; alert on new inbox and forwarding rules | ATT&CK T1078 Valid Accounts, T1114.003 Email Forwarding Rule; NIST SP 800-53 IA-2(2) |
| Nearly $1 billion lost to business impersonators (FTC 2025) | DMARC at p=reject on all owned domains; monitor look-alike registrations | NIST SP 800-53 SI-8; CIS Control 9 |
| 66% of UK APP fraud cases start online (UK Finance 2026) | Supplier onboarding checks and confirmation of payee before first payment | ISO/IEC 27001:2022 A.5.19, A.5.14 |
| Vishing and deepfake calls in high-value cases | Code words or call-back procedures for executive payment requests; no approvals on inbound calls alone | ATT&CK T1566.004 Spearphishing Voice, T1598 Phishing for Information |
- Small organisations: Most small firms cannot run a fraud analytics platform but can enforce a rule that no bank detail change is actioned without a call to a number already on file. That one control addresses the most common invoice and mandate pattern. See the Payment Fraud Guide.
- Large organisations: Volume and supplier count make manual checks fragile. Combine payment platform controls with mailbox takeover detection and supplier master data monitoring. See the Fraud and Cyber Convergence Guide.
- Machine identities in BEC: Mail-sending credentials are part of the attack surface. In the TruffleNet campaign of 2025, stolen AWS keys with SES permissions were used to register hijacked sending domains, and a fake $50,000 vendor invoice was observed, although Fortinet said the direct link to TruffleNet was unclear.
- Domain spoofing: See the DMARC, SPF and DKIM Guide and the Callback Phishing (TOAD) Guide.
Metrics to track
- Payment change verification rate: share of bank detail changes verified by call-back to a number on file before first payment.
- Time to bank notification: median hours from discovering a fraudulent payment to notifying the sending bank.
- Recovery ratio: value recovered or frozen as a share of value sent fraudulently, compared with IC3's 58% kill chain benchmark.
- Finance mailbox protection: phishing-resistant MFA coverage for finance, treasury and executive assistants.
- Suspicious payment requests reported: number of attempted BEC requests stopped by staff per quarter, a leading indicator alongside losses.
Methodology notes and caveats
| Source | What it counts | Main caveat |
|---|---|---|
| FBI IC3 Internet Crime Report | Victim complaints by crime type and reported losses | Under-reported; losses are as reported by victims; one primary crime type per complaint |
| FBI IC3 BEC PSA | "Exposed" losses, including actual and attempted losses, from IC3 and international partners | Exposed loss is wider than actual loss and spans a decade; do not compare directly with annual report losses |
| FTC fraud report data (Consumer Sentinel) | Consumer reports to the FTC and partners | Mostly consumer, not business, fraud; self-reported |
| UK Finance Annual Fraud Report | Fraud losses and cases reported by member banks and payment providers | Covers payment fraud through UK Finance members; business categories are small in case numbers |
| ONS Crime Survey for England and Wales | Survey estimates of fraud experienced by adults, plus recorded fraud | Households and individuals only; recorded figures changed with the switch to Report Fraud |
| APWG Phishing Activity Trends Report | BEC attempts seen by contributing members | Requested amounts, not losses; quarterly figures are volatile |
- Currencies and scope differ: US dollar complaint data and UK sterling bank data cannot be added or compared as like for like.
- BEC is defined differently: IC3 counts BEC as its own crime type; UK Finance splits similar activity into invoice and mandate scams and CEO fraud within APP fraud.
- Reporting changes: UK recorded fraud figures from December 2025 onwards come from Report Fraud, so compare with Action Fraud years cautiously.
- Calculated values are labelled: averages and shares on this page that are not stated by the publisher are marked as calculated.
Practitioner checklist
- Use the latest edition of each source and state the report name, publisher and data year in the same sentence.
- Refresh this view each spring when IC3, the FTC and UK Finance publish annual figures, and each quarter for APWG.
- Require out-of-band verification to a known number for every new payee and every bank detail change.
- Agree a 24-hour fraud reporting route with your bank, and know how to report to IC3 or Report Fraud.
- Enforce phishing-resistant MFA and forwarding rule alerts on finance, treasury and executive mailboxes.
- Set DMARC to p=reject on every owned domain, including parked domains.
- Audit cloud and SaaS credentials that can send email on your behalf, and rotate or remove unused ones.
- Rehearse a deepfake or vishing payment request in a tabletop exercise with finance and executive assistants.
Standards and references
- FBI Internet Crime Complaint Center: Internet Crime Report 2025
- FBI Internet Crime Complaint Center: Business Email Compromise: The $55 Billion Scam
- UK Finance: Annual Fraud Report 2026
- Federal Trade Commission: FTC Testifies Before Joint Economic Committee on Agency's Efforts to Combat Fraud
- Federal Trade Commission: FTC Data Show People Reported Losing $3.5 Billion to Imposter Scams in 2025
- Office for National Statistics: Crime in England and Wales, year ending June 2026
- UK Department for Science, Innovation and Technology: Cyber Security Breaches Survey 2025/2026
- Anti-Phishing Working Group: Phishing Activity Trends Report, 2nd Quarter 2026
Related NHI Mgmt Group resources: Phishing Statistics Guide · Cybersecurity Statistics Guide · Deepfake CEO Fraud Response Playbook · Fraud Prevention Guide for Digital Businesses · Identity Attack Statistics Guide