Business email compromise cost US businesses about $2.79 billion in 2024 across 21,442 cases reported to the FBI's Internet Crime Complaint Center, an average of roughly $130,000 per case. The most common pattern is vendor impersonation: an attacker researches a real vendor, sends updated banking details from a near-identical address, and the payment goes to the criminal account.
A finance manager gets an email from a trusted supplier, with the correct name, a familiar thread history, and updated bank details. The team processes the payment. Days later the real supplier asks why the invoice is still unpaid, and the money is gone. That is business email compromise, and it is not a hack in the Hollywood sense. It is a con that uses email the way email already works.
The FBI's Internet Crime Complaint Center logged 21,442 BEC cases in 2024, with reported losses of about $2.79 billion, making it the second-costliest cybercrime category behind investment fraud. Total reported internet crime losses hit a record $16.6 billion across 859,532 complaints, up 33 percent in a single year. Divide the BEC total by the case count and the average incident cost about $130,000, which is the number a small business should plan around.
The attack has a shape, and knowing the shape is the defense. Week one, the attacker compromises or impersonates a vendor's email account, often through a phishing link the vendor clicked months earlier, and watches quietly: who pays invoices, how the boss writes, when a big payment is due. Week two, a note arrives with new banking details, timed to land just before a real invoice is due. Week three, the real vendor asks about the unpaid invoice, and the target discovers the fraud.
Vendor impersonation accounts for 61 percent of all BEC attacks, according to Abnormal AI's 2026 Attack Landscape Report, and the spoofed address is usually one character off: billing at acm3corp instead of billing at acmecorp. Finance and accounting roles receive generic internal impersonation attacks at a rate of 72.8 percent, well above the organizational average of 37 percent. The attacker does not need to break anything. They need one person to trust one email.
Dual approval for wire transfers is the control that matters most. Any wire above a threshold, typically $5,000 to $10,000 for small businesses, requires two authorized people to approve it through the financial system, not through email. A second pair of eyes on a changed bank account is the cheapest insurance in the building, and it works even when the attacker has done everything else right.
The second control is out-of-band verification: any request to update banking information triggers a required verification call to a phone number already on file, never one provided in the email. The third is speed of reporting. The FBI's Financial Fraud Kill Chain can sometimes recover funds if the fraud is reported within 72 hours, and less than 15 percent of losses are recovered when it is not. File the complaint with IC3 and specifically request the Kill Chain process for wire recovery.
BEC keeps succeeding despite growing awareness because it targets process, not technology. The emails are researched, the timing is right, and the request is plausible: a vendor changing banks is a normal event. Hoxhunt's research found 40 percent of BEC phishing emails were AI-generated as of mid-2024, which means the grammar and tone that used to give the scam away are gone.
The defense is therefore procedural, not technical. No filter catches a well-written email from a lookalike domain every time, and no training session survives a busy Tuesday when the CEO appears to be asking for a rushed wire. The businesses that avoid the loss are the ones where changing a payment destination requires a phone call to a known number and a second approval, every time, with no exceptions for urgency. Urgency is the tell, not the reason.
Two earlier posts on this site cover ground “Business Email Compromise: The Fake Invoice That Costs $130,000” builds on: Fake Ticket Listings: The Resale Checks That Catch Most Scams, Fake Charity Scams After a Disaster: How to Check Before You Give, and Counterfeit Listings on Marketplaces: How to Report Them, and What Actually Gets Taken Down.
It is a scam where attackers impersonate or compromise a trusted email account, often a vendor or an executive, and trick a business into wiring money or sharing data. The goal is usually a wire transfer or invoice fraud, not stealing a password, and the attacks are researched and targeted at specific organizations.
The FBI's IC3 2024 report logged 21,442 BEC cases worth about $2.79 billion, an average of roughly $130,000 per case. Total reported internet crime losses in 2024 were $16.6 billion across 859,532 complaints, and BEC was the second-costliest category.
Call the vendor on a phone number you already have on file, never one from the email requesting the change. Treat any banking update as a required out-of-band verification, and require dual approval for wires above a threshold, typically $5,000 to $10,000 for small businesses.
Sometimes, if you act fast. Report to the FBI's Internet Crime Complaint Center within 72 hours and specifically request the Financial Fraud Kill Chain process for wire recovery. Less than 15 percent of losses are recovered when the fraud is not reported within that window.