What Is Business Email Compromise? The FBI's 2025 Numbers: $3.05 Billion Lost, 24,768 Complaints, and the Call to Your Bank That Gets Money Back
If an email asks you to pay a new bank account, call a number you already had on file before you send anything, and if you have already sent a wire, call your bank in the first hours and ask for a recall. Business email compromise, known as BEC, cost reporting victims $3,046,598,558 in 2025, according to the FBI's Internet Crime Complaint Center. That made it the second most expensive type of cyber-enabled fraud it counts, behind investment fraud. This page covers what BEC is, what the FBI's 2025 report says, and what works.
What is business email compromise?
The FBI defines BEC as a scam that targets businesses, or individuals working with suppliers, and businesses that regularly make wire transfers. Fraudsters compromise email accounts and other channels such as phone numbers and virtual meeting applications, using social engineering or computer intrusion, to get funds moved without authorization. The common thread is that the request looks like it comes from someone you already trust: a title company, an attorney, a supplier or an executive.
How big is it?
The numbers below are from the FBI's 2025 Internet Crime Report. They count complaints that people chose to file, so they are a floor, not a total.
Total losses reported to the FBI in 2025 were $20.877 billion across 1,008,597 complaints, up 26 percent in losses from 2024.
BEC: 24,768 complaints and $3,046,598,558 in losses in 2025, against 21,442 complaints and $2,770,151,146 in 2024, and 21,489 and $2,946,830,270 in 2023. That is about 16 percent more complaints and about 10 percent more loss than a year earlier.
BEC ranked second by loss among the top cyber-enabled fraud types, behind investment fraud at $8,648,617,756 and ahead of tech support scams at $2,134,675,818.
For victims aged 60 and over, BEC losses were $568,048,472 in 2025 against $385,001,099 in 2024, on 4,566 complaints against 3,300. The FBI notes that this count includes older people reporting on behalf of a business.
Is AI making it worse?
The FBI says criminals could use chat generators to write convincing emails in a chief executive's voice and voice cloning to request a wire, and it adds that there are multiple BEC tactics and not all are AI-enabled. It reports that in 2025 more than 22,000 complaints of all kinds contained AI-related information, with adjusted losses above $893 million, and that businesses reported losses over $30 million to BEC scams involving AI. By that count, AI-involved BEC was a small share of the $3.05 billion. The old tricks still account for almost all of it.
What does it look like in practice?
The report gives three cases from its Recovery Asset Team.
In March 2025, a person closing on a property received an email from what looked like the title company, with wire instructions for over $1.3 million to a fraudulent account. The team froze the recipient account and found that other victims' wires had arrived in it too.
In April 2025, an Oregon city government office reported a BEC loss of over $6 million. The team's earlier freeze on the same recipient account meant the receiving bank warned the sending bank, which confirmed the wire instructions were fraudulent and recalled the $6 million.
In August 2025, people closing on a home received an email impersonating their attorneys and wired over $449,000. They reported it, and the full amount was still sitting in the account, on hold.
What gets money back?
Speed. The FBI's Recovery Asset Team runs a process called the Financial Fraud Kill Chain, in which it asks banks to freeze fraudulent recipient accounts. In 2025 it handled 3,900 incidents involving $1,163,919,846 in attempted theft and froze $679,013,183, a 58 percent success rate. The FBI's guidance is to contact your financial institution immediately, request a recall of the funds along with any indemnification documents, and file a complaint at ic3.gov regardless of the amount, with full transaction details, because IC3 may be able to help banks and law enforcement freeze funds. It also notes that BEC used to make up most of these incidents, and that 2025 saw a rise in tech support and account takeover cases.
How do you prevent it?
These steps are our suggestions, not the FBI's list.
Treat any change to payment details as suspect until you have confirmed it by calling a number you already held, not one from the email.
Require a second person to approve new payees and bank detail changes, and add a waiting period for large first-time payments.
Protect mailboxes with phishing-resistant sign-in and check for forwarding rules you did not create. A stolen mailbox session is one route to BEC. We wrote on November 7 about phishing that takes Microsoft and Google work sessions through fake event pages.
Tell the people who handle money, and anyone closing on a property, that wire instructions arriving by email should be confirmed by phone.
Decide in advance who calls the bank, and have the number ready. The first hours matter more than anything else.
Indicators
None. This is an explainer on a fraud type, not a campaign, so we added nothing to the feed.
Limits
All figures are the FBI's, from complaints filed with IC3, and the report says each complaint has one crime type and that losses are de-duplicated as much as possible. Many victims never report. We did not verify any figure beyond the report itself, and the percentage changes are our arithmetic from its numbers. The prevention steps are our judgment.
Five percent of this is wrong somewhere. It always is. The FBI's next report will move every number here.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments