What the data shows
The FBI’s Internet Crime Complaint Center logged $3.046 billion in losses from business email compromise in 2025, from 24,768 reported complaints, making it the second most damaging crime type in the entire report by dollar amount, behind only investment fraud. The number climbed from $2.77 billion the year before, continuing a trend that hasn’t slowed despite years of warnings.
BEC is unusual among cybercrimes for what it doesn’t require. It doesn’t rely on malware, a stolen password, or breaking into a system. An attacker impersonates someone the victim already trusts: an executive, a vendor, a lawyer handling a transaction, and asks for a wire transfer or sensitive information through a well-written email. The FBI’s own report describes a real case: a senior citizen closing on a property received a compromised email appearing to come from the title company, containing wire instructions for over $1.3 million to a fraudulent account.
Why speed makes this hard to undo
The vast majority of BEC losses move through wire transfer or ACH payment, methods built for speed rather than reversibility. Once funds land in a fraudulent account, they’re moved again within hours in many cases, often routed through several accounts or converted to cryptocurrency before a victim even realizes something went wrong. Unlike a stolen credit card, where a bank can often reverse a charge after the fact, a completed wire transfer has very little built-in recovery mechanism.
The practical takeaway
Any request to change payment details, wire funds, or send sensitive information, especially one that arrives by email and carries urgency, deserves a verification step outside that same email thread. Call the person at a phone number you already have on file, not one provided in the message. This applies as much to real estate closings and vendor payments as it does to a request that appears to come from a company executive. If a fraudulent transfer has already happened, the FBI’s Recovery Asset Team can sometimes freeze funds before they move further, but only if a complaint gets filed at IC3.gov fast, within the first hours if possible.
BEC now often uses AI-generated writing to eliminate the awkward phrasing and typos that used to serve as warning signs. A well-written, professional-sounding email is no longer meaningful evidence that a request is legitimate.
Reference
Federal Bureau of Investigation, Internet Crime Complaint Center. “2025 Internet Crime Report.” https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
