The business email compromise statistics everyone quotes come from one place: the FBI's Internet Crime Complaint Center, whose 2025 annual report puts reported losses to business email compromise at $3,046,598,558, against $2,770,151,146 in 2024 and $2,946,830,270 in 2023. Those are complaint totals, not a measure of the crime — nobody files a complaint for an attempt that failed, and many victims file nothing at all. Read properly they still say something a payments desk can act on, and it is not the headline: it is that the average reported loss is roughly six times the average across every other kind of internet crime, and that well under two thirds of the money the federal recovery process even reaches ever comes back. Botminds' Drawdown & Payoff Request Processing exists for the handful of minutes in which that outcome is still avoidable, and this page is about how to count what happens in them.
Everything here is from the published reports of federal agencies, linked at each figure, with our own arithmetic marked as ours. Where a desk example appears it runs on fictional sample data at a fictional bank's funding desk. One figure sometimes attached to this subject — a widely quoted share of organisations saying wires were the payment most targeted — comes from a private industry survey and is deliberately absent, because it is not a source this guide will rest on.
The headline totals for 2025, and what they are a share of
$3,046,598,558
reported lost to business email compromise in 2025, up from $2,770,151,146 in 2024
$20.877bn
reported lost across all complaint types in 2025, from 1,008,597 complaints — a 26% rise in losses on 2024
$20,699
the average loss across all complaint types; business email compromise averages about six times that
How much is lost to business email compromise each year?
About three billion dollars a year in the United States, as reported — $3.05 billion in 2025, $2.77 billion in 2024, $2.95 billion in 2023. The three-year shape matters more than any single year: the total has moved within roughly ten per cent of three billion dollars for three consecutive years, which means the problem is neither exploding nor going away.
That flatness is itself a finding. Over the same period the overall internet-crime loss total rose sharply, reaching $20.877 billion in 2025 from 1,008,597 complaints, a 26% rise in losses on the year before. Business email compromise is therefore a shrinking share of a growing problem — about 15% of reported losses in 2025 — not because less is being stolen this way but because other categories, investment fraud above all, have grown faster.
One figure gives the longer view. FinCEN, which sees the suspicious activity reports rather than the victim complaints, recorded in 2019 that "since the 2016 BEC Advisory was issued, FinCEN has received over 32,000 reports involving almost $9 billion in attempted theft from BEC fraud schemes affecting U.S. financial institutions and their customers" (FinCEN Advisory FIN-2019-A005). That is a different measurement of a different thing — attempted theft seen by banks, not realised loss reported by victims — and it is several times larger. Both numbers are honest; they are counting different events.
Complaints, losses and the gap between the two
A complaint count and a loss total answer different questions, and conflating them produces most of the bad analysis in this field. In 2025 business email compromise accounted for 24,768 complaints — about 2.5% of the million filed — and about 15% of all reported losses. It is a small-volume, high-value crime, and the ratio is the useful statistic.
Divide one by the other and the average reported business email compromise loss in 2025 is roughly $123,000, against $20,699 across all complaint types. In 2024 the same arithmetic gives about $129,000, and in 2023 about $137,000. The average has drifted down for three years while the total rose, which is what you would expect if the number of attempts is growing faster than the amount taken in each one.
Where business email compromise sits among 2025's reported losses
Business email compromise and phishing are different crimes in the data
They are routinely treated as the same thing, and the reports separate them for good reason: one is a volume crime against individuals and the other is a targeted crime against a payment process. The 2025 figures make the difference impossible to miss.
Two categories, 109 times apart on the average loss
Phishing and spoofing: 191,561 — the largest category by volume
Business email compromise: 24,768 — about one eighth as many
Phishing and spoofing: $215,843,126
Business email compromise: $3,046,598,558, about fourteen times more
Phishing and spoofing: About $1,127
Business email compromise: About $123,000 — our arithmetic on both figures
Phishing and spoofing: Credentials, card details, a click — usually from anyone who will give them
Business email compromise: One payment instruction changed, in a transaction that was already going to happen
Phishing and spoofing: Unsolicited contact impersonating a legitimate business to obtain data
Business email compromise: A scam targeting businesses and individuals "regularly performing wire transfer payments", by compromising email and other communications to conduct unauthorized transfer of funds
Phishing and spoofing: Authentication, filtering, user awareness
Business email compromise: Verification of the destination before the money moves, and a second person on the release
The practical consequence is that spending aimed at phishing does not necessarily touch business email compromise. Filtering and awareness training reduce the number of compromised mailboxes. They do not help at all on the day a letter arrives from a lookalike domain that was never anybody's mailbox, carrying an account change in a transaction the desk was expecting.
What the official numbers do not count
Five things, and each one pushes the published figure down rather than up.
Attempts that failed are not in it: a payment stopped by a callback produces no complaint. Losses nobody reports are not in it, and the Government Accountability Office is explicit that "the federal government has not reported on total losses associated with fraudulently induced payments, in part due to underreporting by victims" (GAO-24-107107, Payment Scams). Money later recovered is not netted off, so the reported total is gross rather than net. Losses that fall into another category — a redirected closing payment filed as real estate fraud, an account takeover filed as such — are counted there instead. And the indirect costs are nowhere: the investigation, the legal work, the re-papering of a payoff, the relationship with the payee who was impersonated.
So the published total is a floor with unknown clearance above it. That is not a reason to ignore it; it is a reason to stop treating a change of a few per cent between years as a trend, and to stop quoting a national total as if it were a risk measure for one institution. A supervisory assessment is often a better framing than an arithmetic one: the OCC's Fall 2025 Semiannual Risk Perspective names fraud, scams included, as a key driver of banks' operational losses, rising in both volume and sophistication, and calls for risk management that adapts as fast as the schemes do.
How much of it comes back, and how little of it is even reached
This is the number that should decide spending, and it is published. The FBI's Recovery Asset Team runs the Financial Fraud Kill Chain, which asks banks to freeze funds from fraudulent transfers. In 2025 it was used on 3,900 incidents covering $1,163,919,846 of attempted theft and froze $679,013,183 — a 58% success rate by value. In 2024 the figures were 3,020 complaints, $848.4 million and 66%.
Two years of the same measurements, and the direction each one moved
| What is measured | 2024 | 2025 | Direction |
|---|---|---|---|
| Business email compromise complaints | 21,442 | 24,768 | Up 16% |
| Business email compromise losses reported | $2,770,151,146 | $3,046,598,558 | Up 10% |
| Average reported loss per complaint | About $129,000 | About $123,000 | Down — more attempts, slightly smaller each |
| Incidents the kill chain was used on | 3,020 | 3,900 | Up 29% |
| Value the kill chain was asked to stop | $848.4 million | $1,163,919,846 | Up 37% |
| Value frozen | $561.6 million | $679,013,183 | Up 21% |
| Share of that value frozen | 66% | 58% | Down 8 points |
Two things are worth drawing out of that table. The recovery process is handling more money and saving a smaller share of it — the amount at stake grew by more than a third while the amount frozen grew by a fifth. And it reaches only a slice of the problem: 3,900 incidents of all kinds in 2025, against 24,768 business email compromise complaints alone, and $1.16 billion of attempted theft against $3.05 billion of reported loss.
(Why frozen is not the same as recovered is worked through in a sibling guide.) Read that as a budgeting fact rather than a criticism of the FBI. A dollar spent on verifying a destination before the wire is worth considerably more than a dollar spent on recovering it afterwards, because the recovery path begins at well under 100% and then multiplies by the chance of being reached at all. Where the loss lands when the recovery fails explains why the remaining exposure sits with the sender.
Does AI make business email compromise worse?
Probably, in time. The evidence published so far does not show it yet, and it is worth being precise about what the data actually says rather than repeating an assumption.
The 2025 Internet Crime Report tracks an AI descriptor, applied when a complaint contains a reference to artificial intelligence, and records 22,364 such complaints across all crime types. Of those, 135 were business email compromise — against 24,768 business email compromise complaints in total, or about one in two hundred. By value the AI-referenced share was $30,256,592 of $3,046,598,558, about one per cent. Where an AI connection does show up strongly is investment fraud, with 4,356 complaints and more than $632 million of losses in 2025.
Three cautions keep that from being read as reassurance. The descriptor records what the complainant mentioned, so it measures noticing rather than use — and the whole point of a convincing synthetic message is that nobody notices. The report itself observes that overall investment losses far exceeded the AI-tagged portion, "demonstrating that many victims do not realize the extent AI may be involved in scams". And business email compromise has never needed sophisticated language: the sample attack this page's desk examples draw on used a correctly formatted payoff letter and a domain one character from the real one. A control that compares the destination with the file is indifferent to how well the covering email was written, which is the strongest argument for putting the control there.
Why a lending payoff sits at the expensive end of the distribution
An average of $123,000 across all reported business email compromise is an average over a very wide distribution, and a commercial loan payoff sits at the far end of it. Three features put it there.
The amount is large and arrives as a single payment: a payoff is the entire outstanding balance, which on the fictional sample desk was $2,846,310.42 in one wire. The transaction is expected, so the fraudulent letter does not have to invent a reason for the money to move; it only has to change a destination in a payment that was already scheduled. And the window is short, because a payoff is tied to a good-through date and a same-day cut-off, which supplies the urgency an attacker would otherwise have to manufacture.
Add that the letter comes from a third party the borrower's bank may never have dealt with directly, and the only line that distinguishes a genuine payoff from a stolen one is a bank account number that nobody can verify by reading it. What a commercial payoff letter must carry sets out the rest of the document; the destination is the line the statistics are about.
The business processes the reports say are targeted
FinCEN's analysis is the most useful official account of how targets are chosen, because it describes a method rather than a volume. Criminals "identify processes vulnerable to compromise, whether through openly available information about their targets or through cyber-enabled reconnaissance efforts … and then insert themselves into communications by impersonating a critical player in a business relationship or transaction". A scheme's success, it adds, "often depends on the criminal's knowledge of their victim's normal business processes, as well as weaknesses in the victim's authorization and authentication protocols" (FinCEN Advisory FIN-2019-A005).
The advisory names the education, real estate and agriculture sectors as targets reached through publicly available information about vendors, contracts and processes, and sets out why real estate transactions in particular are attractive: large dollar volumes, communication between counterparties conducted by email, and "a common lack of strong authentication processes for verifying identity and validity of instructions in associated communications".
Every one of those three applies to a commercial loan payoff. The amounts are large, the letters travel by email, and the authentication of the instruction is frequently nothing more than its appearance. Recognising that is the entire argument for a verified payee file and a mandatory callback, and what that callback has to cover to be worth anything is the operational half of it.
Four counts worth keeping on your own desk
A national total cannot tell an institution whether its own control is working, because it counts failures and your control produces non-events. The four measurements below do tell you, they can be taken from records a funding desk already produces, and they move before a loss does.
Four measurements a payments desk can take from its own records
1
Instruction changes caught before release
Every outgoing payment whose beneficiary, bank, routing or account differed from the verified file — whether or not it turned out to be fraud.
The comparison that fires the lock.
2
Callbacks made, and what each one found
Confirmed, denied, or no answer. A quarter with many callbacks and no denials is a healthy quarter, not a wasted one.
The call log, with the number dialled and who answered.
3
Releases that reached the cut-off with under an hour to spare
The margin a callback needs. This number falling is the early warning that the next verification will be skipped.
Arrival, check and release times against the cut-off.
4
Payments sent to a payee for the first time
The first payment sets the file every later comparison depends on. Count them, and verify them like a change.
The verified payee file, and what was added to it.
Two of them are leading indicators rather than lagging ones, which is what makes them worth the trouble. A falling margin before the cut-off says the desk is being squeezed, and a squeezed desk skips verifications. A rising count of first payments to new payees says the file every comparison depends on is being written faster than it is being checked. Neither shows up in a loss total until it is too late to act on.
A quarter of callbacks and caught instruction changes, against the cut-off
The triggers that produce those counts are settings rather than fixed behaviour, which matters because the measurements are only comparable if the rules behind them are versioned. On the sample desk the release cut-off, the warning before it, the dual-control limit and the callback triggers are all configurable, every change is a new version approved by the head of loan operations, and the release lock itself cannot be switched off.
The rules behind the counts, each change a new version
Questions people ask
How many business email compromise complaints are filed each year?
24,768 in 2025, 21,442 in 2024 and 21,489 in 2023, according to the FBI's Internet Crime Complaint Center. Complaints rose 16% in 2025 while reported losses rose 10%, so the average loss per complaint fell. Remember what a complaint is: a victim who noticed, identified the category and chose to report it to a federal body. Attempts that were stopped, and losses nobody reported, are not in the count.
What percentage of business email compromise losses are recovered?
No published figure answers that for the whole category. What is published is the Financial Fraud Kill Chain's result: in 2025 it froze $679,013,183 of the $1,163,919,846 of attempted theft it was asked to stop, a 58% success rate, down from 66% in 2024. That is the share of the money the process reached, not the share of all losses — and the money it reached, across every crime type it handles, came to a little over a third of the reported business email compromise total alone.
What is the average business email compromise loss?
About $123,000 per reported complaint in 2025, dividing the report's loss total by its complaint count. Treat that as the middle of a very wide distribution rather than a typical case: the same average covers a redirected $4,000 invoice and a redirected multi-million-dollar payoff. For a commercial lending desk the relevant figure is the size of a single payoff, not the national average.
Is business email compromise getting worse?
By reported loss it has been roughly flat for three years, within about ten per cent of three billion dollars. By complaint count it rose 16% in 2025. By share of all internet-crime losses it is falling, because other categories are growing faster. The honest summary is that it is persistent rather than accelerating — and that the published series is too noisy, and too incomplete, to support a confident claim either way.
How quickly must a fraudulent wire be reported?
Immediately, and in hours rather than days. The FBI's guidance is to contact your financial institution at once and request a recall with any indemnification documents it needs, and to file at ic3.gov with the full transaction details whatever the amount, because that is what starts the federal freeze process. Funds are typically moved on from the receiving account quickly, and a freeze has nothing to catch once they have gone.
Which business processes do the reports say are targeted?
Those with large payments, email-based communication between counterparties and weak verification of instructions. FinCEN names education, real estate and agriculture as sectors reached through publicly available information about vendors and contracts, and singles out real estate transactions for their large dollar volumes and common lack of strong authentication. Commercial loan payoffs share all three features, which is why the control belongs on the destination rather than on the covering email.