Business Email Compromise and CEO Fraud: What the Evidence Shows
Key takeaways · 14 min read
- Business email compromise cost US complainants $3.05 billion in 2025, from 24,768 reports to the FBI: 2.5% of complaints but 14.6% of all reported losses.
- Those are reported losses only. The FBI’s global count of exposed losses since 2013 passed $55 billion by the end of 2023, and nobody knows how much was never reported.
- Speed decides recovery. When the FBI’s fast-freeze process was used in 2025, banks froze 58% of the money at stake; once funds are withdrawn, they are usually gone.
- A 2024 deepfake video call cost the engineering firm Arup HK$200 million, and studies find people detect deepfakes at little better than chance.
Most fraud steals small sums from many people. Business email compromise works the other way round. A criminal persuades one person in an accounts department, a law firm or a town hall to send one large payment to the wrong account, usually by pretending to be a supplier or a senior colleague. In 2025 the average loss reported to the FBI for this crime was about $123,000, roughly six times the average across all internet crime.
It needs no malware and little technical skill. Often the only tools are an email account, a lookalike web domain and a well-timed request. In 2025 it was the second most costly category in the FBI’s annual crime report, behind only investment fraud, even though it made up a small share of complaints.
This article sets out how the scam works, what the official figures do and do not capture, how often stolen money is recovered, and what research says about the controls organisations rely on. It is general information, not legal or financial advice.
How the scam works
The FBI describes BEC as a scam aimed at businesses and people who regularly pay suppliers by wire, carried out by compromising email accounts and, increasingly, phone numbers and virtual meeting apps. There are three common versions. In payment diversion, a criminal who has read a mailbox inserts a “new bank details” message into a real transaction. In invoice fraud, a fake or altered supplier invoice arrives. In executive impersonation, someone posing as the chief executive or finance director demands an urgent, confidential transfer.
A 2025 case study of a Czech scientific-instrument maker with more than 650 staff shows how ordinary the mechanics are. In 2017 a criminal took over a distributor’s mailbox, which had a weak password and no second login factor. The attacker deleted the genuine invoice, re-sent it from a domain one character different from the manufacturer’s, changed the bank details to an account in Warsaw, and attached a bank-change letter bearing the chief executive’s signature, copied from the company’s annual report.
The distributor paid and had to bear the loss. A 2020 review in the Journal of Financial Crime by the criminologists Cassandra Cross and Rosalie Gillett found that research on this crime had focused on technical defences, to the neglect of the human side: the scam succeeds by exploiting trusted relationships, which is why technical filters alone often fail to stop it.
The reported numbers
The best-known figures come from the FBI’s Internet Crime Complaint Center, known as IC3. In 2025 it received 1,008,597 complaints reporting $20.9 billion in losses. Business email compromise accounted for 24,768 of those complaints and $3.05 billion. Investment fraud, at $8.6 billion, was the only larger category. The annual BEC total has been remarkably steady, at between $2.7 billion and $3.1 billion a year since 2022.
Business email compromise losses reported to the FBI
Losses in complaints to the Internet Crime Complaint Center, by year. Reported losses only.
Sources: FBI IC3, 2024 Internet Crime Report (2022–2024 figures); FBI IC3, 2025 Internet Crime Report.
What stands out is the size of each loss. BEC made up 2.5% of complaints in 2025 but 14.6% of reported losses. Dividing losses by complaints gives roughly $123,000 per BEC report, against about $20,700 for all complaints. That is a crude average, pulled up by a few very large cases, but it explains why one successful email can matter so much to a small firm, a charity or a parish council.
Few complaints, large losses
Business email compromise compared with all complaints to IC3 in 2025. Averages are our calculation.
| Measure | All complaints | BEC |
|---|---|---|
| Complaints | 1,008,597 | 24,768 |
| Reported losses | $20.9 billion | $3.05 billion |
| Share of all losses | 100% | 14.6% |
| Average loss per complaint | about $20,700 | about $123,000 |
Source: FBI IC3, 2025 Internet Crime Report. Averages divide total losses by complaints and are skewed by large cases.
What the numbers miss
IC3 counts complaints, not crimes. A firm that spots a diversion in time, settles quietly with its insurer or decides the embarrassment is not worth it never enters the statistics. The annual reports do not estimate how much goes unreported, and no reliable figure exists. Simpson and Moore, who analysed nine months of 2017 IC3 BEC data, could only study the losses that victims chose to report.
Two other sources hint at the gap. The FBI’s periodic public service announcements use a wider measure, “exposed loss”, which counts attempted as well as completed thefts, in the United States and abroad. By that measure, BEC exposed $55.5 billion across 305,033 incidents worldwide between October 2013 and December 2023. And in a 2025 industry survey of 521 US corporate treasury and finance staff by the Association for Financial Professionals, 63% said their organisation had faced attempted or actual BEC in 2024.
The FBI’s running global tally
Exposed losses from business email compromise since October 2013, including attempted thefts, from FBI public service announcements.
| Period | Incidents | Exposed loss |
|---|---|---|
| Oct 2013 – Dec 2022 | 277,918 | $50.9 billion |
| Oct 2013 – Dec 2023 | 305,033 | $55.5 billion |
| US victims only, to Dec 2023 | 158,436 | $20.1 billion |
Sources: FBI IC3 public service announcements PSA230609 (June 2023) and I-091124-PSA (September 2024). Exposed loss is not the same as money actually lost.
The survey and the exposed-loss figure measure attempts as well as losses, so neither is a true count of harm. They point the same way, though: the FBI’s annual $3 billion is a floor, and the real cost of this crime is unknown.
From email to video call
In January 2024 an employee in the Hong Kong office of Arup, the British engineering firm, received a message about a confidential transaction, apparently from the company’s UK-based chief financial officer. The employee then joined a video conference in which the finance chief and other colleagues appeared. All of them were fakes, built from public video and audio. The employee made 15 transfers totalling HK$200 million, about US$25 million, to five Hong Kong bank accounts. Arup confirmed that fake voices and images were used and said its internal systems were not compromised.
The case is famous because it is rare, but the trend behind it is measurable. IC3 received 22,364 complaints in 2025 that referred to artificial intelligence, with $893 million in reported losses across all crime types. Its 2024 definition of BEC already listed virtual meeting apps alongside email as a route in.
People are poor judges of synthetic media. A 2024 meta-analysis of 56 studies involving 86,155 participants found overall deepfake detection accuracy of 55.5%, not significantly better than chance. Generated text is similar: in a 2024 preprint study of 101 people, fully AI-written spear-phishing emails drew a 54% click-through rate, the same as emails written by human experts and far above the 12% for generic phishing.
Machine-written lures work as well as expert ones
Share of recipients who clicked the link, by who wrote the phishing email. Small study of 101 participants; preprint.
Source: Heiding F, Lermen S, Kao A, Schneier B, Vishwanath A, arXiv:2412.00586 (2024), not peer reviewed at the time of writing.
The lesson usually drawn is that spotting the fake is the wrong goal. If a voice, a face and a writing style can all be imitated, the only reliable check is one the criminal does not control.
The race to freeze the money
Once a fraudulent transfer has been made, the clock matters more than anything else. In 2018 the FBI set up a Recovery Asset Team to work with banks under a process it calls the Financial Fraud Kill Chain, which tries to freeze funds before they are moved on. As described to US industry in 2019, it applied to wires of $50,000 or more, sent within the previous 72 hours, with a bank recall already started. The criteria may have changed since.
The results look good on paper. In 2024 the team acted on 3,020 complaints involving $848.4 million and froze $561.6 million, a 66% success rate. In 2025 it acted on 3,900 incidents involving $1.16 billion and froze $679 million, or 58%. But these are the fast cases, reported within days, and frozen is not the same as returned. The 3,900 incidents also span all fraud types, against 24,768 BEC complaints alone that year.
The slow cases look like Ashfield. Its fraudulent payment was found a week later, and the receiving account had been opened, emptied and closed within about two weeks. Distance adds friction: Simpson and Moore found that money sent abroad was less likely to be recovered.
When the FBI moves fast
Financial Fraud Kill Chain cases handled by the IC3 Recovery Asset Team, all fraud types.
Incidents: 3,020
Money at stake: $848.4m
Frozen: $561.6m (66%)
$92.5m of the frozen sum was abroad
Incidents: 3,900
Money at stake: $1.16bn
Frozen: $679.0m (58%)
Frozen funds are not always returned
Sources: FBI IC3, 2024 and 2025 Internet Crime Reports. Success rate is frozen funds as a share of attempted theft in cases referred quickly.
What UK banks see
British banks report two closely related categories. In 2025, UK Finance recorded 2,305 cases of invoice and mandate fraud, in which a victim trying to pay a real supplier is persuaded to redirect the money, with losses of £41.3 million. It recorded 197 cases of CEO fraud, with losses of £5.6 million. About two-thirds of the invoice fraud losses fell on business and other non-personal accounts.
The share of money returned differs sharply. Victims of invoice and mandate fraud got back £20.0 million, or 48% of losses, through bank refunds or recovery from the receiving account. Victims of CEO fraud got back £1.1 million, or 20%. The numbers are small, and the reasons are not broken down, so the gap should not be over-read.
Share of losses returned to victims in the UK, 2025
Money returned through bank refunds or recovery from the receiving account, as a share of losses. Shares are our calculation.
Source: UK Finance, Annual Fraud Report 2026 (2025 data). 2,305 invoice and mandate cases; 197 CEO fraud cases.
UK reporting has a different scope from the FBI’s, so the two cannot be compared directly. What the British figures add is a reminder that even inside the banking system, where every transfer is traced, about half the money is not recovered.
The evidence on controls
The standard advice is procedural. The FBI’s 2024 announcement urges organisations to verify any change to payment details through a second channel, and the Czech firm’s response after its losses was of that kind: bank details can now be changed only by a signed contract amendment, a rule printed on every invoice. In its second case, in 2023, a customer’s bank stopped the transfer once the fraud was reported.
What is missing is proof of how well these controls work. Searching the research literature for this article, we found recommendations and case studies of call-back procedures, dual sign-off and supplier-detail checks, but no controlled trial measuring how many frauds they prevent. Cross and Gillett described a dearth of academic research on preventing this crime, and a 2025 systematic review in Computers & Security reached a similar conclusion.
Awareness training is often offered as the answer. A separate article on this site covers the evidence on phishing training, which is weaker than vendors suggest. For BEC the logic of verification is still strong: a call to a number already on file defeats a fake email, a fake voice and a fake face alike, because the criminal does not control it. The uncertainty is about how consistently busy staff make that call.
What the evidence suggests
Business email compromise is a crime of trust and timing. Reported US losses have held at about $3 billion a year, from a small number of complaints with very large average losses, and the true total is unknown because many cases are never reported. Recovery depends on speed: when the FBI and banks act within days, more than half the money at stake is often frozen, while a fraud found a week later is usually beyond reach. Deepfakes make impersonation easier and people cannot reliably spot them. Verification through a channel the criminal does not control is the logical defence, but its effectiveness has not been tested in controlled studies.
What to do
Steps sorted by when they matter. Each one says how strong the evidence is: Measured Official advice Untested
Before
- Verify any change to payment details through a second channel: a call to a number already on file. Official advice see Sources
- Make bank details changeable only by a formal, signed process, and say so on your invoices. Untested see Sources
- Turn on a second login factor for email. In the case study, the attacker took over a mailbox with a weak password and none. Untested see Sources
Afterwards
- If money has gone, call your bank and report to the police (in the US, the FBI’s IC3) the same day. Fast cases often had more than half the money frozen; a fraud found a week later is usually beyond reach. Measured see Sources
Step-by-step guide, with a printable checklist: Sent money to a scammer? What to do, in order
No controlled study has yet measured how many frauds these controls prevent.
Questions people ask
What is business email compromise?
A fraud in which criminals pose as a supplier, colleague or executive, usually by email, to get a payment sent to their own account. It often uses a hacked mailbox or a lookalike domain.
How much does BEC cost?
Complaints to the FBI reported $3.05 billion in losses in 2025. That counts only reported cases, so the real figure is higher.
Can money lost to BEC be recovered?
Sometimes, if the bank and police are told within days. In fast cases handled by the FBI in 2025, 58% of the money at stake was frozen; late reports rarely succeed.
Can people spot a deepfake video call?
Not reliably. A meta-analysis of 56 studies put human detection accuracy at about 55%, close to guessing.
Do call-back checks stop BEC?
They are widely recommended and logically sound, because the criminal cannot answer a number already on file. No controlled study has yet measured how many frauds they prevent.
The short version
- Business email compromise cost US complainants $3.05 billion in 2025, from 24,768 reports to the FBI: 2.5% of complaints but 14.6% of all reported losses.
- Those are reported losses only. The FBI’s global count of exposed losses since 2013 passed $55 billion by the end of 2023, and nobody knows how much was never reported.
- Speed decides recovery. When the FBI’s fast-freeze process was used in 2025, banks froze 58% of the money at stake; once funds are withdrawn, they are usually gone.
- A 2024 deepfake video call cost the engineering firm Arup HK$200 million, and studies find people detect deepfakes at little better than chance.
- Verifying payment changes through a channel the criminal does not control is the logical defence, but no controlled study has measured how well it works.
This article summarises published research and official crime statistics for general information. It is not legal, financial or security advice, and it does not recommend any product or provider. If you think a payment has gone to a fraudster, contact your bank immediately, report it to the police and, in the United States, to the FBI at ic3.gov.
Further reading: the FBI IC3 2025 Internet Crime Report, for the annual figures and the Recovery Asset Team’s results. Cross and Gillett, Journal of Financial Crime (2020), for a review of what is and is not known about this crime. UK Finance’s Annual Fraud Report 2026, for British cases and recovery rates.
- Fancy Bear Goes Phishing, Scott J. Shapiro (2023). A Yale philosopher and programmer explains five famous hacks and why human shortcuts, not clever code, are usually the weak point. Readable and sharp; it deals with hacking in general rather than payment fraud.
- Duped, Timothy R. Levine (2020). A communication researcher sets out his truth-default theory: why people believe others unless something forces doubt. Strong on the science of deception; it is academic in style and not about fraud specifically.
- Scam Me If You Can, Frank Abagnale (2019). Plain advice on common frauds from a former con man turned fraud consultant. Practical in tone; parts of his own life story, told in earlier books, have since been disputed.
Sources
- FBI Internet Crime Complaint Center. 2025 Internet Crime Report (2026).
- FBI Internet Crime Complaint Center. 2024 Internet Crime Report (2025).
- FBI IC3. Business Email Compromise: The $55 Billion Scam, public service announcement I-091124-PSA (September 2024).
- FBI IC3. Business Email Compromise: The $50 Billion Scam, public service announcement 230609 (June 2023).
- Cross C, Gillett R. Exploiting trust for financial gain: an overview of business email compromise (BEC) fraud. Journal of Financial Crime (2020), doi:10.1108/JFC-02-2020-0026.
- Simpson G, Moore T. Empirical analysis of losses from business-email compromise. APWG eCrime Symposium (2020), doi:10.1109/eCrime51433.2020.9493250.
- Václavík L, Špatenka J, Petrová K. Resilience against business email compromise: a corporate case study (2025).
- Almutairi A, Kang B, Al Hashimy N. Business email compromise: a systematic review of understanding, detection, and challenges. Computers & Security (2025), doi:10.1016/j.cose.2025.104630.
- Diel A et al. Human performance in detecting deepfakes: a systematic review and meta-analysis of 56 papers. Computers in Human Behavior Reports (2024), doi:10.1016/j.chbr.2024.100538.
- Heiding F et al. Evaluating large language models’ capability to launch fully automated spear phishing campaigns. arXiv:2412.00586 (2024), preprint.
- UK Finance. Annual Fraud Report 2026.
- Association for Financial Professionals. 2025 Payments Fraud and Control Survey, press release, 15 April 2025.
- American Land Title Association. Hit by wire transfer fraud? Use the kill chain process, 31 January 2019.
- Dezeen, 17 May 2024; Hong Kong police briefing reported by the Philippine Daily Inquirer, February 2024.
- Greenfield Recorder, 17 September 2026.
