BEC fraud drains $8.5 billion over three years, FBI reports

The FBI's Internet Crime Complaint Center (IC3) sounded the alarm over business email compromise (BEC) scams, which drained nearly $8.5 billion from U.S. businesses between 2022 and 2024. In its newly released 2024 Annual Report, the agency labeled the fraud losses "staggering," with BEC responsible for close to $2.8 billion in damages last year alone.

BEC—a cyber-enabled fraud where attackers spoof or hijack email accounts to trick employees into sending funds to criminals—ranked seventh in number of complaints but second in total losses among all crimes reported to IC3 in 2024. There were 21,442 BEC complaints last year, just 47 fewer than in 2023, showing a steady and persistent threat despite growing awareness and defensive measures.

Fraudsters favor internet-based tools

Overall, IC3 received nearly 860,000 complaints in 2024. Of these, almost 83 percent of reported losses—$13.7 billion—stemmed from fraud committed or facilitated using internet-based tools. Phishing and spoofing were the most common types of crimes, with more than 193,000 incidents, while ransomware accounted for over 3,100 cases. Notably, a new scam involving fake toll violation notices saw more than 59,000 complaints.

In his introduction to the report, B. Chad Yarbrough, the FBI's operations director for criminal and cyber activity, emphasized how far the threat has grown: "During its infancy, IC3 received roughly 2,000 complaints every month. For the past five years, IC3 has averaged more than 2,000 complaints every day."

Vendor impersonation a common BEC attack method

Adding weight to the concern, the Association for Financial Professionals released its 2025 Payments Fraud and Control Survey just days before the IC3 report. According to the AFP, 63 percent of organizations experienced BEC attacks last year. Of those, vendor impersonation was the most common method, with 60 percent of respondents reporting attempts of that nature.

The vast majority of attacks targeted wire transfers, highlighting how criminals continue to focus on high-value payment channels.

The AFP survey also revealed that the ability to recover stolen funds has declined significantly. In 2023, 41percent of organizations were able to recover at least 75 percent of lost funds after a BEC attack. By 2024, that figure had dropped to just 22 percent, underscoring the urgent need for prevention rather than recovery.

New rules aim to curb fraud, streamline recovery

In response to the growing threat, Nacha—the governing body for the ACH Network—implemented rule changes aimed at curbing fraud and streamlining fund recovery. Phase 2 of Nacha's Risk Management Framework, taking effect in 2026, will require financial institutions to enhance fraud monitoring for ACH credits and implement standardized practices for identifying and responding to fraud.

Nacha's rules are designed to not only detect suspicious activity earlier but also make it easier to trace and potentially recover stolen funds once a fraud has occurred. Industry experts say this could significantly improve outcomes for businesses targeted by BEC scammers.

Businesses urged to employ strict internal controls

BEC remains one of the costliest and most difficult-to-detect forms of cyber-enabled fraud. Its success often hinges on social engineering and timing, rather than technical breaches, making it harder to guard against with traditional IT defenses. As such, law enforcement and financial institutions alike continue to urge businesses to implement strict internal controls—such as dual approvals for wire transfers and independent vendor callbacks—to reduce the risk.

As cybercriminals grow bolder and more sophisticated, the FBI warns that only a combined strategy of technology, training, and policy will keep BEC and other cyber scams in check.

Notice to readers: These are archived articles. Contact information, links and other details may be out of date. We regret any inconvenience.