Business email compromise is a fraud in which someone poses, by email, as a person or company you trust and asks you to send money. It usually arrives as a supplier's new bank details or an urgent request from a senior colleague. The FBI received 24,768 complaints about it in 2025, with reported losses of $3,046,598,558.
What is business email compromise?
The FBI's Internet Crime Complaint Center describes it as a scam aimed at businesses and people who transfer money, usually through a compromised or impersonated business email account. The fraud needs no malware and often no link. It needs a believable sender and a believable request. The cases in this site's attack archive fall into three shapes.
- A lookalike sender. The fraudster writes from an address that differs from a real supplier's by a letter, a word or an ending.
- A real mailbox. The fraudster gets into a genuine account, reads the conversations, and writes from inside them.
- A senior name. The fraudster poses as an executive and asks for a confidential payment.
Examples: the lookalike supplier
Cottage Grove, Minnesota lost $1,276,061.33 in 2021 to emails from geislingerandsonsinc.com. Its sewer contractor used geislingerandsons.com. The impostor said the company had moved its banking and attached the forms.
Milwaukee sent $460,866 in 2025 after an email from scherrerconstruction.us. The builder only uses .com. The receiving bank held the money, and police recovered it.
Peterborough, New Hampshire paid out $2,347,310.12 in 2021 after emails that copied its partners. One was signed "Tanerr" instead of Tanner.
Examples: the fake supplier with perfect paperwork
Fort Lauderdale paid $1.2 million in 2023 to someone posing as the builder of its police headquarters. The forms matched the company's earlier submissions. A bank flagged the transfer, and the money came back.
Dickinson Public Schools in North Dakota sent nearly $5 million meant for its renovation contractor between November 2025 and February 2026. The FBI recovered it, and a man was indicted.
Pulaski County, Arkansas paid about $1.9 million of its jail medical contractor's bills to a stranger for months in 2026, after one email changed the bank details.
Boulder County, Colorado redirected a $237,241.18 check in 2022. The fake vendor said it had been hacked and needed new payment details.
CityHousing Hamilton in Ontario paid about CA$552,000 in 2024, two weeks after the real vendor had warned it to call before any bank change.
Examples: the real mailbox and the hijacked thread
New Haven's schools lost $5.9 million in 2023. The attackers read a manager's mailbox for weeks, then wrote as the school bus company.
Portland, Oregon wired about $1.4 million in 2022 from instructions sent inside a compromised city mailbox. The treasurer flagged the mismatch, and the confirmation came from the impostor.
Eagle Mountain, Utah lost nearly $1.13 million in 2022 after someone joined an ongoing email thread about a major infrastructure project.
Pine Bluff School District in Arkansas wired $3,204,639.55 in December 2025. Fake wiring instructions were slipped into a thread with a genuine invoice.
Example: the executive and the deepfake call
At Arup in Hong Kong, a finance employee received a phishing email in the name of the UK finance chief in January 2024. A video call with deepfaked colleagues removed the employee's doubt, and HK$200 million went out in 15 transfers.
How business email compromise is found
In most of these cases nobody spotted the email. The real supplier asked why it had not been paid, as in New Haven, Cottage Grove, Milwaukee and Pulaski County. Or a bank flagged the transfer, as in Fort Lauderdale. Speed decides recovery. The FBI's 2025 report describes an Oregon city office that lost over $6 million. The receiving account had already been frozen in another case, so the originating bank recalled the wire. When victims reported quickly, the FBI's Recovery Asset Team placed holds on business email compromise funds with success rates between 71% and 74% from 2021 to 2023.
How to prevent business email compromise
- Call before you pay new details. The FBI's Internet Crime Complaint Center advises verifying every payment change in person or through a known telephone number.
- Hold the first payment. A change of bank details waits until the call is made, whoever asks.
- Use two approvals for large transfers. Pine Bluff added dual authorisation and verbal confirmation after its loss.
- Protect the mailboxes. The same FBI advisory recommends multi-factor authentication on email accounts. Alerts on new mailbox rules help, because intruders use rules to hide replies.
- Report fast. Call your bank first, then file at ic3.gov in the US or with your national fraud service.
For a single message, the seven checks for Gmail and Outlook cover the sender, the links and the request. For accounts payable, the fake invoice checklist covers what to check before you pay.
How much business email compromise costs
The FBI's annual reports put losses at $2,395,953,296 in 2021 and $3,046,598,558 in 2025. Across October 2013 to December 2023, its 2024 advisory counted 305,033 incidents worldwide and $55,499,915,582 in exposed losses. In 2025 the FBI recorded $30,256,592 in business email compromise losses that involved AI.
What Antilure draws for a business email compromise attempt
On a message that asks to change payment details, Antilure draws a banner inside the email in Gmail or Outlook with the line "don't reply or pay, check with the sender another way", marks the request, and explains the sender, on your own computer. Download Antilure.
Sources
- 2025 IC3 Annual Report, FBI Internet Crime Complaint Center, 6 April 2026.
- Business Email Compromise (BEC), FBI Internet Crime Complaint Center, checked 7 November 2026.
- Internet Crime Report 2021, FBI Internet Crime Complaint Center, 22 March 2022.
- Internet Crime Report 2023, FBI Internet Crime Complaint Center, 6 March 2024.
- Business Email Compromise: The $55 Billion Scam, FBI Internet Crime Complaint Center, 11 September 2024.
- Cyber Criminals Conduct Business Email Compromise through Exploitation of Cloud-Based Email Services, FBI Internet Crime Complaint Center, 6 April 2020.
Every case above links to its own page in the attack archive, with its sources.