Last reviewed: October 27, 2026 · Reading time: 9 minutes
Business email compromise (BEC) is the least glamorous cybercrime and one of the most expensive. There is no malware to detect and no ransom note. A criminal gets into, or convincingly imitates, an email account, then asks someone to pay an invoice, change bank details or send payroll somewhere new. The FBI’s latest figures show how well it still works.
- The FBI’s Internet Crime Complaint Center (IC3) received 24,768 BEC complaints in 2025, with reported losses of $3.05 billion, the second-costliest crime type after investment fraud.
- New York ranked 4th of all states, with 45,255 complaints and $1.23 billion in reported losses across all cybercrime.
- Total reported losses reached $20.9 billion, roughly three times the 2021 figure.
- Speed matters: when victims reported quickly, the FBI’s Financial Fraud Kill Chain froze $679 million, a 58% success rate.
The 2025 numbers
BEC losses have stayed close to $3 billion a year for three years running, while overall losses keep climbing:
| Year | Reported BEC losses | Change |
|---|---|---|
| 2023 | $2,946,830,270 | – |
| 2024 | $2,770,151,146 | −6% |
| 2025 | $3,046,598,558 | +10% |
Reported losses are only part of the picture. Many victims never file a complaint, and the figures don’t include downtime, investigation costs or the time spent untangling who paid whom.
How BEC actually unfolds
- Access or imitation. A phishing email harvests a Microsoft 365 password, or the attacker registers a look-alike domain. AI-written phishing has made both far more convincing; see our piece on AI phishing in 2026.
- Quiet observation. Inside a mailbox, the attacker sets inbox rules to hide replies and reads threads to learn who pays what, when.
- The request. A believable message arrives at the right moment: new bank details for a real supplier, an urgent wire for a closing, a payroll change.
- The money moves. Funds are quickly passed through mule accounts. Every hour of delay reduces the chance of recovery.
Controls that stop it
| Control | What it stops | Effort |
|---|---|---|
| Phishing-resistant MFA on every Microsoft 365 account | Most account takeovers from stolen passwords | Low |
| Alerts on new inbox rules and forwarding | Attackers hiding inside a mailbox | Low |
| Call-back verification on a known number for any payment or bank-detail change | The fraudulent payment itself, even if email is compromised | Low |
| DMARC, SPF and DKIM enforced on your domain | Spoofing of your own domain | Medium |
| Dual approval for wires above a threshold | Single points of failure in finance | Low |
| Independent Microsoft 365 backup | Evidence and data loss when an attacker deletes mail to cover tracks | Low |
That last point is often overlooked. Attackers routinely delete sent items and replies to hide what they did. A Microsoft 365 backup held outside your tenant lets you reconstruct the timeline, which you will need for your bank, your insurer and, for regulated firms, notification decisions.
If it happens: the first hour
- Call your bank and ask them to recall or freeze the transfer.
- File a complaint at ic3.gov immediately. The Financial Fraud Kill Chain only works on fresh, reported transfers.
- Reset the compromised account’s password, revoke sessions and remove malicious inbox rules.
- Preserve evidence before anything is cleaned up: mailbox audit logs, message trace and the affected messages.
- Check whether you have notification duties, for example under NYDFS Part 500’s 72-hour rule if you are a DFS-regulated entity. See our NYDFS Part 500 guide.
Check your Microsoft 365 for BEC weak spots
Ron Klink will review MFA coverage, mailbox rules, email authentication and backup for your Microsoft 365 tenant.
Sources
- Federal Bureau of Investigation, 2025 IC3 Annual Report, 2026.
- Verizon, 2025 Data Breach Investigations Report, April 2025.
