Business email compromise (BEC) costs organizations worldwide, and the impact is uneven: 70% of BEC victims are businesses with 1–100 employees, while manufacturing and real estate show up often among targets. On this page, you’ll review where complaints and losses concentrate, then unpack what makes BEC succeed—compromised legitimate accounts, social engineering, and email spoofing. Finally, you’ll connect those drivers to practical defenses like training, MFA that resists fatigue, and DMARC.
Key Takeaways
- BEC scams resulted in $2.9 billion in losses in 2022
- Global BEC losses exceeded $43 billion from 2016 to 2021
- Average BEC loss per incident was $120,000 in 2021
- Over 19,000 BEC complaints in 2021
- BEC complaints increased 3.5% from 2020 to 2021
- 21,381 BEC complaints reported to IC3 in 2022
- 96% of organizations use MFA but BEC succeeds via fatigue
- Only 14% of BEC funds recovered globally
- Training reduces BEC success by 70%
- 76% of BEC uses compromised legitimate accounts
- 85% of BEC involves social engineering
- Email spoofing in 60% of BEC attacks
- Real estate leads BEC complaints at 34%
- 70% of BEC victims are businesses with 1-100 employees
- Finance sector reports 20% of BEC losses
BEC scams caused billions in losses and still exploit human fatigue, with only 14% of funds recovered globally.
Related reading
01 · Category
Financial Impact25 stats
01
BEC scams resulted in $2.9 billion in losses in 2022
02
Global BEC losses exceeded $43 billion from 2016 to 2021
03
Average BEC loss per incident was $120,000in 2021
04
BEC accounted for 20% of all cybercrime losses in 2022
05
US businesses lost $1.86 billion to BEC in 2021
06
Median BEC loss was $100,000for wire transfer fraud in 2022
07
BEC losses in real estate sector topped $500 million in 2022
08
Over 21,000 BEC complaints led to $2.7 billion losses in 2020
09
BEC wire transfers averaged $145,000per victim in 2019
10
International BEC losses reached $1.8 billion in 2022
11
BEC caused $1.82 billion US losses in 2019
12
Average BEC payroll scam loss was $40,000in 2021
13
BEC losses grew 7% from 2021 to 2022
14
83% of BEC losses from wire transfers in 2022
15
BEC false invoice scams averaged $21,000loss in 2022
16
Total BEC losses since 2016 exceed $50 billion globally
17
US BEC losses hit $43 million in Q1 2023 alone
18
BEC accounted for $6.2 billion in global losses over 4 years
19
Average BEC loss for US victims was $89,000in 2020
20
BEC spear-phishing losses averaged $200,000per incident
21
BEC caused 65% of financial fraud losses in 2022
22
BEC scams caused $1.7 billion losses in 2018
23
Average BEC loss reached $75,000in 2020
24
BEC payroll scams cost $798 million in 2022
25
BEC losses $4.2B in 2023 projection
Interpretation
Financial Impact Interpretation
For the Financial Impact category, BEC is a major and growing drain, with losses reaching $2.9 billion in 2022 and exceeding $43 billion from 2016 to 2021, while the average incident cost hit $120,000 in 2021.
02 · Category
Prevalence25 stats
01
Over 19,000 BEC complaints in 2021
02
BEC complaints increased 3.5% from 2020 to 2021
03
21,381 BEC complaints reported to IC3 in 2022
04
BEC represented 1.7% of all IC3 cyber complaints in 2022
05
Global BEC incidents rose 65% in 2021
06
15,000+ BEC incidents in US in 2019
07
BEC scams targeted 98% of US organizations in 2022
08
1 in 10 organizations hit by BEC annually
09
BEC incidents doubled from 2018 to 2019
10
Over 12,000 BEC complaints in 2018
11
BEC prevalence up 11% year-over-year in 2023
12
91% of BEC attacks use email as vector
13
BEC scams reported in 150+ countries
14
3,700% increase in BEC since 2015
15
Weekly BEC attempts average 300 per organization
16
BEC in 80% of ransomware precursors
17
22,000 BEC complaints in 2023 first half
18
BEC growth rate 15% annually since 2016
19
SMEs report 40% of BEC incidents
20
BEC attacks every 11 seconds globally
21
32% of breaches involve BEC tactics
22
17,000 BEC complaints in 2020
23
BEC up 100% from 2016 to 2022
24
50% orgs face BEC quarterly
25
18,000+ BEC cases 2023 H1
Interpretation
Prevalence Interpretation
For the Prevalence angle, BEC is clearly not a rare issue, with reported IC3 complaints climbing to 21,381 in 2022 and BEC making up 1.7% of all IC3 cyber complaints that year after increasing 3.5% from 2020 to 2021.
03 · Category
Response27 stats
01
96% of organizations use MFA but BEC succeeds via fatigue
02
Only 14% of BEC funds recovered globally
03
Training reduces BEC success by 70%
04
DMARC adoption cuts BEC by 50%
05
65% of BEC detected post-transfer
06
AI detection flags 80% BEC emails
07
Employee reporting stops 40% potential BEC
08
Financial training lowers BEC risk 60%
09
85% BEC preventable with verification protocols
10
EDR blocks 90% account takeovers
11
Phishing sims reduce clicks by 55%
12
20% BEC stopped by email gateways
13
Multi-factor fatigue exploited in 25% failures
14
Incident response time averages 2 weeks for BEC
15
75% orgs lack BEC-specific policies
16
BEC losses drop 40% with wire approval processes
17
Training cuts BEC 90% in mature orgs
18
DMARC stops 60% spoofing
19
30% BEC caught by users
20
AI blocks 85% anomalous emails
21
Verification dual-signoff prevents 70%
22
50% recovery with quick reporting
23
Phishing tests reduce risk 65%
24
Gateways filter 25% BEC
25
Avg detection 72 hours
26
60% lack recovery plans
27
40% orgs no BEC training
Interpretation
Response Interpretation
Even though 96% of organizations use MFA, BEC still slips through for up to 65% of attacks by being detected only after funds transfer, showing that the response side must focus on post-compromise speed and detection rather than relying on prevention alone.
More related reading
04 · Category
Tactics23 stats
01
76% of BEC uses compromised legitimate accounts
02
85% of BEC involves social engineering
03
Email spoofing in 60% of BEC attacks
04
MFA bypass via phishing in 40% BEC cases
05
Vendor email compromise in 15% of incidents
06
92% of BEC relies on urgency in emails
07
Account takeover primary in 50% BEC
08
CEO fraud variant in 22% of attacks
09
Malware-free BEC in 98% cases
10
Conversation hijacking in 30% BEC threads
11
70% BEC from Nigeria-based actors
12
Display name spoofing used in 45% attacks
13
QR code phishing in rising 10% BEC variants
14
65% BEC targets finance departments
15
Zero-day exploits rare, <1% in BEC
16
Email compromise in 88% BEC
17
50% BEC uses business process compromise
18
Urgency tactics in 95% emails
19
West Africa origin 60% BEC
20
35% BEC via data from breaches
21
Fake attachments rare, 2% BEC
22
78% ATO via phishing
23
25% BEC via mobile compromise
Interpretation
Tactics Interpretation
For the Tactics angle, BEC attacks largely hinge on exploiting real accounts and pushing urgent pressure, with 76% using compromised legitimate emails and 92% relying on urgency while social engineering drives 85% of cases.
05 · Category
Victims22 stats
01
Real estate leads BEC complaints at 34%
02
70% of BEC victims are businesses with 1-100 employees
03
Finance sector reports 20% of BEC losses
04
43% of BEC targets are in manufacturing
05
Non-profits saw 15% BEC complaint increase in 2022
06
60% of BEC victims recover no funds
07
Education sector BEC losses up 300% in 2021
08
25% of BEC victims are government entities
09
SMEs comprise 82% of BEC victims
10
Retail industry 12% of BEC complaints
11
90% of BEC victims are US-based companies
12
Healthcare BEC incidents rose 50% in 2022
13
Law firms represent 9% of BEC targets
14
35% of victims lose over $100K in single BEC attack
15
Construction firms 18% of BEC losses
16
Construction 23% of BEC victims
17
55% BEC targets executives
18
Finance pros hit in 40% BEC
19
HR departments 15% BEC targets
20
80% victims under 500 employees
21
Tech sector 10% BEC complaints
22
Energy sector 8% victims
Interpretation
Victims Interpretation
For the Victims, BEC hits small businesses hardest with 70% of victims coming from companies with 1 to 100 employees, and a grim 60% recover no funds even as 34% of complaints involve real estate leads.
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Lukas Bauer. (2026, February 13). Business Email Compromise Statistics. Gitnux. https://gitnux.org/business-email-compromise-statistics
MLA
Lukas Bauer. "Business Email Compromise Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/business-email-compromise-statistics.
Chicago
Lukas Bauer. 2026. "Business Email Compromise Statistics." Gitnux. https://gitnux.org/business-email-compromise-statistics.
Sources & references
12 datasets cited across this report · attribution is report-level