Business email compromise: what FBI IC3 reports, what FinCEN says, and how 10-K and 8-K filers disclose it

Business email compromise cost U.S. complainants $3,046,598,558 in 2025 on 24,768 complaints, according to the FBI’s Internet Crime Complaint Center, the largest loss figure IC3 has printed for the category and second only to investment fraud among the crime types in its 2025 report.¹ Companies prevent it, in the words the SEC used in its 2018 report on nine public companies that lost nearly $100 million, with internal accounting controls over payment authorization and vendor data “attuned to this kind of cyber-related fraud,” and with training on those controls.¹⁰

The numbers below are copied from each year’s IC3 report, FinCEN’s two advisories and SEC EDGAR. They count complaints and filings. They do not measure all business email compromise: they count only what victims chose to report to IC3 and what companies chose to file.

What BEC is, in the FBI’s and FinCEN’s definitions

The FBI’s 2025 report defines BEC as “a scam targeting businesses or individuals working with suppliers and/or businesses regularly performing wire transfer payments,” carried out by “compromising email accounts and other forms of communication such as phone numbers and virtual meeting applications, through social engineering or computer intrusion techniques to conduct unauthorized transfer of funds.”¹ The phone numbers and virtual meetings are a widening of the older wording the SEC quoted in 2018, which spoke of businesses that “often work with foreign suppliers.”¹⁰

FinCEN’s definition, in its advisory of 2019-07-16, is about the account rather than the method. BEC “Targets accounts of financial institutions or customers of financial institutions that are operational entities, including commercial, non-profit, non-governmental, or government entities.”⁸ Its companion, email account compromise, targets “personal email accounts belonging to an individual.”⁸ The same advisory says the payments are not only wires: FinCEN had seen BEC schemes induce “convertible virtual currency payments, automated clearing house transfers, and purchases of gift cards.”⁸

IC3 complaint counts and losses by year

Each figure here is the one printed in that year’s report, in its table of crime types by loss and by count. The 2019, 2020 and 2021 reports use the combined category BEC/EAC; from 2022 the reports print BEC alone. The 2018 figure comes from the three-year comparison table in the 2020 report.⁶

Reported losses grew 71.5% from 2019 to 2025, from $1,776,549,688 to $3,046,598,558.⁷¹ They dipped once, from $2,946,830,270 in 2023 to $2,770,151,146 in 2024, before the 2025 rise.³²

Complaints went the other way for most of the period. IC3 received 23,775 BEC/EAC complaints in 2019 and 19,369 in 2020, and the count stayed between 21,442 and 21,832 from 2022 to 2024 before reaching 24,768 in 2025.⁷⁶⁴²¹ Dividing one by the other gives a reported loss per complaint of about $74,723 in 2019, $137,132 at the 2023 peak and $123,005 in 2025. That is an average of reported figures, and a few large cases move it.

The figures are what complainants reported, as IC3 adjusted them. They are not audited, and they include only victims who filed a complaint.¹

The 2025 report also says where money can still be stopped. Its Recovery Asset Team ran the Financial Fraud Kill Chain on 3,900 incidents in 2025 with $1,163,919,846 in attempted theft and froze $679,013,183, a 58% success rate.¹ The report says that in the past “the majority of FFKC incidents initiated by the IC3 RAT were Business Email Compromises (BECs)”, and that in 2025 the process saw a rise in tech support and account takeover cases.¹ Its advice for a company that finds a fraudulent transfer is short: “time is of the essence,” contact the bank and request a recall, and file a complaint with IC3 “Regardless of the amount lost.”¹

What FinCEN’s alerts add

FinCEN sees BEC through suspicious activity reports filed by banks, a different window from IC3’s complaints. Its 2019 advisory said that since its first BEC advisory of 2016 it had received “over 32,000 reports involving almost $9 billion in attempted theft from BEC fraud schemes affecting U.S. financial institutions and their customers.”⁸

The advisory’s main point is in its title: vulnerable business processes. Criminals “identify processes vulnerable to compromise, whether through openly available information about their targets or through cyber-enabled reconnaissance efforts,” then “insert themselves into communications by impersonating a critical player in a business relationship or transaction.”⁸ It notes that a scheme’s chance of success “often depends on the criminal’s knowledge of their victim’s normal business processes, as well as weaknesses in the victim’s authorization and authentication protocols.”⁸ For a finance department that sentence is a scoping note: the process map of payables and treasury is the attack surface.

FinCEN’s alert of 2024-11-13, FIN-2024-Alert004, adds generative AI. It says FinCEN observed, beginning in 2023 and continuing in 2024, “an increase in suspicious activity reporting by financial institutions describing the suspected use of deepfake media in fraud schemes.”⁹ Among the schemes it names BEC, and it says criminals “have reportedly used GenAI tools to target companies by impersonating an executive or other trusted employee and then instructing victims to transfer large sums or make payments to accounts ultimately under the scammer’s control.”⁹ It asks banks to tag related reports with the key term “FIN-2024-DEEPFAKEFRAUD”.⁹

IC3 began counting the same thread in 2025. Its report tags 22,364 complaints across all crime types with the descriptor “AI Related”, with $893,346,472 in reported losses; the descriptor is counted across crime types rather than as one of them.¹

How issuers disclose BEC losses and controls

EDGAR full-text search, run once per calendar year and reduced to distinct filings, finds the phrase “business email compromise” in 22 10-Ks filed in 2019, 74 in 2023, 129 in 2025 and 157 so far in 2026, to 2026-11-11.¹¹ The 8-K count is small and uneven: between 1 and 14 a year, 62 over the whole period, counting the exhibits filed with each 8-K.¹¹

The 10-K figure is mostly risk-factor and cybersecurity-item language: a filer names BEC as one kind of attack it faces. The 8-Ks say more, because a company files one when it has news. Each of the 62 8-Ks was read on sec.gov and its sentences naming the scheme coded by a published rule: an incident or loss (a filer that “was the victim”, an amount “lost”, “diverted” or “wired”, or that “experienced” a compromise), then a control or remediation, then a risk mention.¹¹ Thirteen had no sentence the reader could isolate. Of the other 49, 5 report an incident or loss, 10 describe a control and 34 name it as a risk.¹¹

The five incident filings come from four companies. Journey Medical Corp reported in its results for 2021 that wire fraud costs of “approximately $9.5 million were attributable to funds erroneously wired to fraudulent accounts as a result of a sophisticated business email compromise fraud scheme.”¹³ Comera Life Sciences said that in February 2022 it determined it was “affected by a business email compromise fraud” that diverted company capital to unknown parties, and booked a $590 thousand loss in the quarter to 2022-03-31.¹⁴ BeiGene’s updated risk factors of 2024-09-30 say one of its third-party vendors “experienced a business email compromise which resulted in us sending payment to a fraudulent bank account.”¹⁵ NETSTREIT’s earnings release for the second quarter of 2024 is the clearest of the set:

The anatomy of a payment-redirect case

The SEC’s 2018 report describes two variants among the nine issuers it investigated. In the first, perpetrators emailed finance personnel from spoofed executive addresses, directing them to work with a purported outside attorney who then had them wire funds abroad; the SEC said these “were not sophisticated frauds in general design or the use of technology.”¹⁰ In the second, perpetrators hacked foreign vendors’ email accounts, asked issuer staff to change the vendors’ banking information and “attached doctored invoices reflecting the new, fraudulent account information.”¹⁰ One company made 14 wire payments over several weeks, losing over $45 million, before a foreign bank raised the alarm; another paid eight invoices totaling $1.5 million over several months.¹⁰

What the SEC said about internal accounting controls

The report is not an enforcement action; the Commission said it “determined not to pursue an enforcement action in these matters.”¹⁰ What it did was point to Exchange Act Section 13(b)(2)(B)(i) and (iii), which require issuers to keep internal accounting controls sufficient to provide reasonable assurances that transactions are executed, and access to assets is permitted, only with management’s authorization.¹⁰

The nine issuers had controls. They “had procedures that required certain levels of authorization for payment requests, management approval for outgoing wires, and verification of any changes to vendor data. Yet they still became victims of these attacks.”¹⁰ The SEC’s reading is that staff took the email itself as enough to act on. In one case an accounting employee “did not follow the company’s dual-authorization requirement for wire payments”; in another, an employee read the authorization matrix as granting approval authority “at a level reserved for the CFO.”¹⁰ In two cases the recipients of fake executive emails were chief accounting officers.¹⁰

After the frauds each issuer sought to enhance its payment authorization procedures and its verification of vendor changes; issuers that had learned of the fraud from third parties bolstered account reconciliation and outgoing payment notification; and all of them enhanced training.¹⁰ The report’s conclusion states the standard: issuers “must calibrate their internal accounting controls to the current risk environment and assess and adjust policies and procedures accordingly.”¹⁰ It also says the Commission is not suggesting that every victim of such a scam has violated the controls requirements.¹⁰

Where the deepfake explainer fits

A deepfake is a new way to deliver the request in step two; the controls in steps three and four are the same ones the SEC listed in 2018. FinCEN’s 2024 alert is the document that ties the two, by naming BEC among the schemes generative tools now support.⁹ The filings that describe deepfake attempts on finance teams, and the Federal Reserve’s remarks on them, are in deepfakes and payment fraud; the log entries on the subject are under fraud and deepfakes; and FinCEN’s documents are listed in the FinCEN tracker.

How these figures were made: IC3 values are copied from each report’s crime-type tables and kept in the site’s research file with the report’s URL; EDGAR counts come from full-text search per calendar year, paged to the end and counted by accession number; the 8-K coding rule is in the site’s research script, and every chart is recomputed from those files by scripts/cfonews-ai/articles/compute.mjs.