June 2026 retrospective · Added November 13, 2026.
The FBI’s 2025 IC3 Annual Report records 24,768 business email compromise complaints and $3,046,598,558 in reported losses. That is approximately $3.05 billion attributed to BEC in the report—not the total cost of all cybercrime or an estimate of every unreported incident.
The front door is often an ordinary message
A request to update bank details. A familiar invoice with a different destination. A message that appears to come from someone with authority. Business email compromise exploits business trust and routine workflows, making it a financial-control issue as well as a technology issue.
Our view is that the strongest response combines account protection with a process employees can follow even when a request is urgent.
Put friction where money changes direction
Require independent verification of new payment instructions using a known contact method.
Use a second approver for sensitive payment changes.
Review mailbox access, forwarding rules, and unusual identity activity.
Teach employees how to report a suspicious request quickly.
Protection needs layers
Email filtering is one layer. Identity protection, appropriate access controls, managed devices, and a clear incident-response process address other parts of the problem. No single tool removes the need for staff to verify an unusual financial request.
Ask a concrete question at your next leadership meeting: if a supplier’s payment instructions changed today, who would verify the change and how? If the answer depends on replying to the same email, the process needs attention.
Explore Proper Access Cybersecurity or compare protection plans.
Source: FBI 2025 IC3 Annual Report, complaint-count and loss tables, pages 7–8. Figures describe complaints submitted to IC3.
