Invoice fraud · checked 26 October 2026
Business email compromise statistics (FBI, 2025)
Business email compromise (BEC) is when criminals use a hacked or fake email account to get a business to pay them: a fake invoice, "new bank details", or a boss asking for an urgent transfer. Here's how big it was in the FBI's latest annual report.
The 2025 numbers
- 24,768 BEC complaints to the FBI's Internet Crime Complaint Center (IC3).
- $3,046,598,558 in reported BEC losses, about $3.05 billion.
- That's roughly $123,000 lost per complaint on average.
- All cybercrime: 1,008,597 complaints and $20.877 billion in reported losses. BEC was about 15% of the money.
- Investment fraud was the largest category, at about $8.65 billion.
These are only crimes reported to IC3. Many businesses never report, so the real figures are higher.
What it means for a small business
- Few incidents, big losses each. BEC is a small share of complaints but a large share of the money, because each one usually targets a real payment.
- The weak point is a process, not technology. Most cases succeed because a bank-detail change or urgent request is acted on from email alone.
- Speed matters if it happens. Banks can sometimes recall a payment if they hear about it within hours. Paid a fake invoice?
The controls that stop it
Call back on a known number before any bank-detail change, require two people to approve changes, and hold first payments to new details. 8 controls to prevent invoice fraud · red flags · how to report it.
Source: FBI Internet Crime Complaint Center, 2025 Internet Crime Report (released April 2026). Per-complaint average and share are our own arithmetic from the report's figures. Read 26 October 2026.
Check a suspicious email free Set up call-backs and approvals