The short version
2026 editionKey takeaways
Each takeaway links to its canonical data row. Reported figures belong to their cited producer; modeled results are labeled as calculations.
- BEC complaints reported to IC3 in 2025: 24,768 (2025).Federal Bureau of Investigation, Internet Crime Complaint Center
- BEC losses reported to IC3 in 2025: $3,046,598,558.00 (2025).Federal Bureau of Investigation, Internet Crime Complaint Center
- BEC complaints reported to IC3 in 2024: 21,442 (2024).Federal Bureau of Investigation, Internet Crime Complaint Center
- BEC losses reported to IC3 in 2024: $2,770,151,146.00 (2024).Federal Bureau of Investigation, Internet Crime Complaint Center
- BEC complaints reported to IC3 in 2023: 21,489 (2023).Federal Bureau of Investigation, Internet Crime Complaint Center
- BEC losses reported to IC3 in 2023: $2,946,830,270.00 (2023).Federal Bureau of Investigation, Internet Crime Complaint Center
- BEC complaints reported to IC3 in 2022: 21,832 (2022).Federal Bureau of Investigation, Internet Crime Complaint Center
- BEC losses reported to IC3 in 2022: $2,742,354,049.00 (2022).Federal Bureau of Investigation, Internet Crime Complaint Center
- BEC complaints reported to IC3 in 2021: 19,954 (2021).Federal Bureau of Investigation, Internet Crime Complaint Center
- BEC losses reported to IC3 in 2021: $2,395,953,296.00 (2021).Federal Bureau of Investigation, Internet Crime Complaint Center
- BEC complaints reported to IC3 in 2020: 19,369 (2020).Federal Bureau of Investigation, Internet Crime Complaint Center
- BEC losses reported to IC3 in 2020: $1,866,642,107.00 (2020).Federal Bureau of Investigation, Internet Crime Complaint Center
How large are reported business email compromise losses?
FBI IC3 records complaint counts and reported losses, not the total prevalence of business email compromise. The series below preserves the reporting edition so each figure can be traced to its source table.
Scroll horizontally to compare all columns →
| Reporting year | BEC complaints | Reported loss (USD) |
|---|---|---|
| 2025 | 24,768 | $3,046,598,558.00 |
| 2024 | 21,442 | $2,770,151,146.00 |
| 2023 | 21,489 | $2,946,830,270.00 |
No inflation adjustment or per-victim average is calculated. The two historical windows are identified separately rather than presented as an audited, invariant incident series.
Primary source: Federal Bureau of Investigation, Internet Crime Complaint Center — checked September 13, 2026
What did the earlier BEC reporting window show?
FBI IC3 records complaint counts and reported losses, not the total prevalence of business email compromise. The series below preserves the reporting edition so each figure can be traced to its source table.
Scroll horizontally to compare all columns →
| Reporting year | BEC complaints | Reported loss (USD) |
|---|---|---|
| 2022 | 21,832 | $2,742,354,049.00 |
| 2021 | 19,954 | $2,395,953,296.00 |
| 2020 | 19,369 | $1,866,642,107.00 |
No inflation adjustment or per-victim average is calculated. The two historical windows are identified separately rather than presented as an audited, invariant incident series.
Primary source: Federal Bureau of Investigation, Internet Crime Complaint Center — checked September 13, 2026
Does a complaint count measure a company’s probability of being attacked?
No. Without a defined exposed-business denominator and representative reporting, complaint counts cannot estimate an individual company’s risk. Missing reports and repeat submissions also limit a prevalence interpretation.
IC3 notes that complaint classifications and losses can change during analysis, some people may submit more than once, and losses are de-duplicated where possible.
Primary source: Federal Bureau of Investigation, Internet Crime Complaint Center — checked September 13, 2026
Is aggregate loss divided by complaints a typical victim’s loss?
No. Even a correctly aligned arithmetic mean would not establish a median or the loss faced by a typical business. This page deliberately does not publish a per-victim estimate.
Readers needing a typical-loss claim should look for a study reporting the loss distribution and a clearly defined victim population.
How can this evidence support a payment-workflow review?
Use the report as context for reviewing how payment-detail changes and approvals are recorded. Keep that operational review separate from claims that any software prevents fraud.
This statistical resource does not certify a security control or promise that a documented approval process eliminates loss.
How this report was built
Methodology and limitations
- We transcribed the BEC row of the 2022 and 2025 reports’ three-year comparison tables, checking both extracted text and rendered PDF pages. Each count and dollar figure has an exact printed-page and year-column locator.
- The recent window uses the 2025 report’s 2023–2025 figures; the earlier window uses the 2022 report’s 2020–2022 figures. These are edition-specific assessments, not a reconstruction of every underlying complaint.
- We do not combine BEC with phishing, ransomware or all cybercrime to enlarge the evidence count. Earlier reports also discuss BEC/email-account compromise terminology; no claim of unchanged detection or reporting coverage is made.
What these numbers cannot tell you
- Voluntary complaint reporting does not cover every attack, loss or victim. The totals must not be represented as a random sample of businesses.
- Crime classifications and loss assessments can evolve. Changes in reported dollars do not isolate changes in criminal activity from reporting, valuation and classification effects.
- Amounts are nominal USD, not inflation-adjusted losses, insured losses, recovered funds or the economic cost of all business disruption.
Freshness and corrections
Maintained by the Workspace369 editorial team. Review with each FBI IC3 annual report and retain edition-specific revisions. The edition date changes only when the evidence or content is substantively reviewed; it does not change the underlying observation period.
First edition: . Data extraction, source attribution and arithmetic checked for this edition. No independent peer review is claimed.
Found an error or a newer primary release? Send a correction with the source and affected statistic. Confirmed corrections should be recorded in the revision history before republishing.
Primary sources and provenance
Every reported numeric cell links directly to its producer. The downloads include exact table or workbook locators, observation periods, access dates, formulas and input references.
- Federal Bureau of Investigation, Internet Crime Complaint Center2022 Internet Crime Report: three-year BEC comparison ↗Publication date not recorded; see the original source. Accessed September 13, 2026.U.S. federal government data; attribution requested. No agency endorsement.
- Federal Bureau of Investigation, Internet Crime Complaint Center2025 Internet Crime Report: three-year BEC comparison ↗Publication date not recorded; see the original source. Accessed September 13, 2026.U.S. federal government data; attribution requested. No agency endorsement.
Made to be checked, then cited
How to cite this report
For a source-reported statistic, credit the original publisher and link to the exact row here when using our compilation. For a modeled result, cite Workspace369 and include the assumptions. Linking to this page does not make us the original producer of third-party data.
Workspace369. (2026-09-13). Business Email Compromise Statistics and Reported Losses. https://workspace369.com/research/business-email-compromise-statistics/. Primary sources and observation periods as listed in the report.