Business Email Compromise scams extracted $2.9 billion from businesses in a single recent year. This article examines the latest data on how these attacks bypass security, which sectors are most vulnerable, and the financial impact per incident.
Key Takeaways
- BEC scams resulted in $2.9 billion in losses in 2022
- Over 19,000 BEC complaints in 2021
- 96% of organizations use MFA but BEC succeeds via fatigue
- 76% of BEC uses compromised legitimate accounts
- Real estate leads BEC complaints at 34%
Business email compromise remains a major threat, with high success rates and serious financial losses for victims.
Related reading
01 · Category
Financial Impact25 stats
01
BEC scams resulted in $2.9 billion in losses in 2022
02
Global BEC losses exceeded $43 billion from 2016 to 2021
03
Average BEC loss per incident was $120,000in 2021
04
BEC accounted for 20% of all cybercrime losses in 2022
05
US businesses lost $1.86 billion to BEC in 2021
06
Median BEC loss was $100,000for wire transfer fraud in 2022
07
BEC losses in real estate sector topped $500 million in 2022
08
Over 21,000 BEC complaints led to $2.7 billion losses in 2020
09
BEC wire transfers averaged $145,000per victim in 2019
10
International BEC losses reached $1.8 billion in 2022
11
BEC caused $1.82 billion US losses in 2019
12
Average BEC payroll scam loss was $40,000in 2021
13
BEC losses grew 7% from 2021 to 2022
14
83% of BEC losses from wire transfers in 2022
15
BEC false invoice scams averaged $21,000loss in 2022
16
Total BEC losses since 2016 exceed $50 billion globally
17
US BEC losses hit $43 million in Q1 2023 alone
18
BEC accounted for $6.2 billion in global losses over 4 years
19
Average BEC loss for US victims was $89,000in 2020
20
BEC spear-phishing losses averaged $200,000per incident
21
BEC caused 65% of financial fraud losses in 2022
22
BEC scams caused $1.7 billion losses in 2018
23
Average BEC loss reached $75,000in 2020
24
BEC payroll scams cost $798 million in 2022
25
BEC losses $4.2B in 2023 projection
Interpretation
Financial Impact Interpretation
Business Email Compromise has perfected the art of swindling billions with the simplicity of a well-crafted lie, proving that the most sophisticated cybercrime often arrives dressed as an urgent, believable email from your boss.
02 · Category
Prevalence25 stats
01
Over 19,000 BEC complaints in 2021
02
BEC complaints increased 3.5% from 2020 to 2021
03
21,381 BEC complaints reported to IC3 in 2022
04
BEC represented 1.7% of all IC3 cyber complaints in 2022
05
Global BEC incidents rose 65% in 2021
06
15,000+ BEC incidents in US in 2019
07
BEC scams targeted 98% of US organizations in 2022
08
1 in 10 organizations hit by BEC annually
09
BEC incidents doubled from 2018 to 2019
10
Over 12,000 BEC complaints in 2018
11
BEC prevalence up 11% year-over-year in 2023
12
91% of BEC attacks use email as vector
13
BEC scams reported in 150+ countries
14
3,700% increase in BEC since 2015
15
Weekly BEC attempts average 300 per organization
16
BEC in 80% of ransomware precursors
17
22,000 BEC complaints in 2023 first half
18
BEC growth rate 15% annually since 2016
19
SMEs report 40% of BEC incidents
20
BEC attacks every 11 seconds globally
21
32% of breaches involve BEC tactics
22
17,000 BEC complaints in 2020
23
BEC up 100% from 2016 to 2022
24
50% orgs face BEC quarterly
25
18,000+ BEC cases 2023 H1
Interpretation
Prevalence Interpretation
While the staggering 3,700% rise in Business Email Compromise since 2015 suggests cybercriminals have found a devastatingly profitable formula, the fact that a BEC attempt now strikes somewhere globally every 11 seconds means your inbox is quite literally on the clock.
03 · Category
Response27 stats
01
96% of organizations use MFA but BEC succeeds via fatigue
02
Only 14% of BEC funds recovered globally
03
Training reduces BEC success by 70%
04
DMARC adoption cuts BEC by 50%
05
65% of BEC detected post-transfer
06
AI detection flags 80% BEC emails
07
Employee reporting stops 40% potential BEC
08
Financial training lowers BEC risk 60%
09
85% BEC preventable with verification protocols
10
EDR blocks 90% account takeovers
11
Phishing sims reduce clicks by 55%
12
20% BEC stopped by email gateways
13
Multi-factor fatigue exploited in 25% failures
14
Incident response time averages 2 weeks for BEC
15
75% orgs lack BEC-specific policies
16
BEC losses drop 40% with wire approval processes
17
Training cuts BEC 90% in mature orgs
18
DMARC stops 60% spoofing
19
30% BEC caught by users
20
AI blocks 85% anomalous emails
21
Verification dual-signoff prevents 70%
22
50% recovery with quick reporting
23
Phishing tests reduce risk 65%
24
Gateways filter 25% BEC
25
Avg detection 72 hours
26
60% lack recovery plans
27
40% orgs no BEC training
Interpretation
Response Interpretation
These statistics reveal a frustrating truth: while we've built a formidable shield against BEC with tools like MFA, DMARC, and AI, our most sophisticated security layer—the employee—remains simultaneously our greatest vulnerability and our most powerful defense, depending entirely on how well we train and support them.
More related reading
04 · Category
Tactics23 stats
01
76% of BEC uses compromised legitimate accounts
02
85% of BEC involves social engineering
03
Email spoofing in 60% of BEC attacks
04
MFA bypass via phishing in 40% BEC cases
05
Vendor email compromise in 15% of incidents
06
92% of BEC relies on urgency in emails
07
Account takeover primary in 50% BEC
08
CEO fraud variant in 22% of attacks
09
Malware-free BEC in 98% cases
10
Conversation hijacking in 30% BEC threads
11
70% BEC from Nigeria-based actors
12
Display name spoofing used in 45% attacks
13
QR code phishing in rising 10% BEC variants
14
65% BEC targets finance departments
15
Zero-day exploits rare, <1% in BEC
16
Email compromise in 88% BEC
17
50% BEC uses business process compromise
18
Urgency tactics in 95% emails
19
West Africa origin 60% BEC
20
35% BEC via data from breaches
21
Fake attachments rare, 2% BEC
22
78% ATO via phishing
23
25% BEC via mobile compromise
Interpretation
Tactics Interpretation
The modern BEC criminal is a pragmatic con artist who rarely bothers with complex malware or zero-days, instead simply hijacking the authority of a legitimate account through a blend of social engineering, urgency, and a shocking amount of coffee-spilling panic to trick finance departments into paying West African-based actors.
05 · Category
Victims22 stats
01
Real estate leads BEC complaints at 34%
02
70% of BEC victims are businesses with 1-100 employees
03
Finance sector reports 20% of BEC losses
04
43% of BEC targets are in manufacturing
05
Non-profits saw 15% BEC complaint increase in 2022
06
60% of BEC victims recover no funds
07
Education sector BEC losses up 300% in 2021
08
25% of BEC victims are government entities
09
SMEs comprise 82% of BEC victims
10
Retail industry 12% of BEC complaints
11
90% of BEC victims are US-based companies
12
Healthcare BEC incidents rose 50% in 2022
13
Law firms represent 9% of BEC targets
14
35% of victims lose over $100K in single BEC attack
15
Construction firms 18% of BEC losses
16
Construction 23% of BEC victims
17
55% BEC targets executives
18
Finance pros hit in 40% BEC
19
HR departments 15% BEC targets
20
80% victims under 500 employees
21
Tech sector 10% BEC complaints
22
Energy sector 8% victims
Interpretation
Victims Interpretation
Here is a one-sentence interpretation that weaves in key themes from your statistics: While small and mid-sized businesses often view their size as a shield, this data starkly reveals they are actually the preferred and most vulnerable prey for BEC scammers, with devastating success rates that spare few sectors from crippling financial hits.
report visual · Projection
BEC losses: growth into 2022
BEC losses grew 7% from 2021 to 2022, with 2022 losses totaling $2.9B.
1,860,000,000 Losses (USD) / Growth rate (%)
Start
+7%
CAGR · 1y
1,990,200,000 Losses (USD) / Growth rate (%)
Projected
20222023
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Lukas Bauer. (2026, February 13). Business Email Compromise Statistics. Gitnux. https://gitnux.org/business-email-compromise-statistics
MLA
Lukas Bauer. "Business Email Compromise Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/business-email-compromise-statistics.
Chicago
Lukas Bauer. 2026. "Business Email Compromise Statistics." Gitnux. https://gitnux.org/business-email-compromise-statistics.
Sources & references
12 datasets cited across this report · attribution is report-level