Why business email compromise stays so expensive

Every year the FBI's Internet Crime Complaint Center (IC3) publishes what victims reported to it. Business email compromise - an email that impersonates a colleague, executive or supplier to get money moved - has sat near the top of the loss table for the past four reports:

In 2024 BEC was the second-costliest crime type in the whole report, behind investment fraud. For comparison, IC3 recorded about $60 million in ransomware losses for 2023. That ransomware figure is known to be incomplete - it leaves out downtime and recovery costs, and many victims never file - but even with generous adjustment, impersonation emails move more money than any email threat that involves malware.

Source: FBI IC3 Internet Crime Reports 2021-2024. Averages are calculated from the published totals.

A six-figure average is easy to read as an enterprise problem. It is not. The complaint count has hovered around 21,000 a year, and the losses are spread across companies of every size. An average is pulled up by a few very large transfers; the typical small-business loss is smaller, but it is also a larger share of what the business has in the bank.

Two things make the real number higher than the reported one. Many businesses never report a loss - because the money was recovered, because they are embarrassed, or because nobody knew where to report it. And the loss is rarely just the transfer: there is the payment owed to the real supplier, the time spent with the bank, the insurer and the auditor, and sometimes a damaged supplier relationship.

Over the last decade, email-borne malware got steadily harder to land: attachments are opened in sandboxes, links are rewritten and checked at click time, browsers block known bad sites. Almost none of that touches BEC.

• There is no payload. A BEC message is a few lines of plain text. There is no file to detonate and often no link to check, so the defences built around inspecting payloads have nothing to inspect.
• It costs almost nothing. A lookalike domain costs about ten dollars and takes minutes to register. Writing the email is free, and language models now write it fluently, in the right tone, in any language.
• It is low volume by design. One message to one person, sent once. Reputation systems learn from patterns across many mailboxes; a single message from a domain that did not exist last week gives them nothing to learn from.
• The victim completes the attack. A real employee authorises a real payment through a real bank. Nothing downstream looks wrong until the genuine supplier asks, weeks later, why they have not been paid.

The pattern below is a composite. Names and domains are fictional.

BEC is aimed, not sprayed. It lands on the few people who can move money without a second signature: accounts payable, payroll, executive assistants, and at small companies the owner or office manager who does all of those jobs. A company with 30 staff may have two or three such people, and attackers know which two or three.

That is why a company-wide count of blocked messages says little about BEC risk. The question that matters is how much dangerous mail reaches those specific inboxes. Zoes' Most Targeted Members view answers exactly that, ranking people by the severity of what they receive rather than by volume.

Ranked roughly by how much loss each control prevents for the effort it takes:

The single most effective control is a written payment-verification rule that everyone with access to money has read. It does not need to be long. A version that fits most small companies:

The fourth line matters more than it looks. BEC works by making a careful employee feel that checking is the risky option - that the CEO will be annoyed, or the supplier will stop shipping. A rule that explicitly protects people who slow down removes that pressure.

Share the policy with your regular suppliers too. When they know you always call to confirm bank changes, a request that asks you not to call stands out immediately - to them and to you.

If a payment has already gone to the wrong account, the order of operations matters:

1. 1Call your bank's fraud line, not your branch, and ask for a recall of the transfer. Give them the amount, time, and receiving account.
2. 2In the US, file at ic3.gov the same day. The FBI's Recovery Asset Team works with banks to freeze funds, and it can only help while the money is still in the receiving account.
3. 3Assume a mailbox may be compromised: reset the password, sign out all sessions, and check for forwarding rules and inbox rules that hide replies.
4. 4Contact the real supplier on a known number. They may be compromised too, and other customers may be receiving the same request.
5. 5Tell your insurer early. Many policies have notification windows and conditions about verification procedures.