Number of U.S. Business Email Attacks by State

In April 2025, an Oregon city government office received an email that looked like it came from a familiar vendor. It wasn't. The office wired more than $6 million before anyone caught the fraud, according to the FBI's Internet Crime Complaint Center (IC3). A separate case that same year involved a Missouri homebuyer who received a spoofed email from a "title company" with wire instructions for a $1.3 million closing payment. Both incidents made it into the FBI 2025 Internet Crime Report as examples of a scam that has cost American businesses and individuals more than $8 billion over the past three years alone.

Business email compromise, commonly called BEC, remains one of the most expensive categories of cybercrime the FBI tracks. It works because it targets people, not firewalls. A fraudster spoofs or hijacks a legitimate email account, poses as an executive, vendor, or attorney, and asks an employee to move money or sensitive data. No malware is required. No network needs to be breached. The email just needs to look real enough for one person to click "send" on a wire transfer.

The IC3 released its 2025 Internet Crime Report on April 6, 2026, and the numbers show BEC losses climbing again after a brief dip. Below is a breakdown of the national trend, a state-by-state look at cybercrime losses overall, and what businesses can do to reduce their exposure.

Business Email Compromise Losses in 2025

BEC complaints to the IC3 rose to 24,768 in 2025, up from 21,442 in 2024, and losses reached $3,046,598,558, according to the FBI's 2025 Internet Crime Report. That reverses a small decline the year before. BEC losses ran $2.95 billion in 2023, dipped to $2.77 billion in 2024, then climbed back above $3 billion in 2025. The average reported loss per BEC complaint now exceeds $122,000.

Wire transfers and automated clearing house (ACH) payments carried 86% of BEC losses in 2025, the FBI reported, which helps explain why the scam remains so damaging. Once money leaves through a wire, it often reaches a fraudulent account and moves again within hours, well before a bookkeeper or bank notices anything wrong. The Incident Response Best Practices that limit damage from a breach apply just as directly to a fraudulent wire: speed of detection determines whether funds can be recovered at all.

Companies aren't the only targets. The FBI's elder fraud data shows BEC complaints from people age 60 and older rose to 4,566 in 2025, with losses of $568 million, up from $385 million in 2024. Real estate closings, in particular, remain a frequent entry point, since a single closing can involve a large wire and multiple parties who are unfamiliar with each other's normal communication habits.

Where Cybercrime Losses Concentrated in 2025

The FBI publishes state-level totals for all reported cybercrime, though it doesn't break out BEC losses by state in the national report. The table below reflects total reported cybercrime losses and complaint volume by state for 2025. California, Texas, and Florida again reported the highest dollar losses, a pattern driven partly by population size and partly by the concentration of high-value targets, from tech companies to real estate transactions, in those states.

Source: FBI Internet Crime Complaint Center, 2025 Internet Crime Report, released April 6, 2026. Figures cover all reported cybercrime types, not BEC exclusively.

A Closer Look at Michigan and South Carolina

Michigan businesses and residents filed 22,191 complaints with the IC3 in 2025, reporting $381 million in total losses, which places Michigan 16th among all states for reported cybercrime losses. For a firm based in Livonia or anywhere else in southeast Michigan, that figure is a reminder that BEC and related fraud aren't a coastal problem. Wire fraud targeting title companies, manufacturers, and municipal offices happens in every part of the state.

South Carolina offers one of the few states where the FBI's local field office published BEC-specific figures. Business email compromise cost South Carolina businesses $64.5 million in 2025, up from $40.8 million in 2024, the FBI's Columbia field office reported. That's a 58% jump in a single year, in a state that ranked 21st nationally in total cybercrime losses. The increase illustrates a pattern seen across the country: overall complaint counts can hold steady while BEC losses climb, because a smaller number of successful, well-researched attacks now produce larger individual payouts.

How Artificial Intelligence Is Changing BEC Tactics

For the first time, the FBI's 2025 report quantified artificial intelligence's role in BEC schemes. Generative tools can produce an executive-sounding email in seconds, and voice cloning can mimic a CEO's voice on a phone call requesting an urgent wire. The FBI attributed more than $30 million in 2025 BEC losses to scams with a confirmed AI connection, out of $3.05 billion in total BEC losses. That's a small share of the total today, but it's the first year the FBI tracked it separately, and the tactic is spreading to other fraud types the agency monitors.

The rise of AI-assisted fraud is also why shadow AI, employees using unapproved AI tools without security oversight, has become as much a fraud risk as a data-privacy one. A staff member who pastes vendor correspondence into an unvetted chatbot to "clean it up" may be handing an attacker the exact language and tone needed to write a convincing spoofed email later.

Reducing Your Company's Exposure to BEC

Most BEC losses trace back to a handful of preventable gaps. Verifying payment or banking-detail changes through a second communication channel, such as a phone call to a known number rather than a reply to the email in question, stops the majority of attempts before money moves. Multifactor authentication on email accounts closes the door on the account-takeover version of BEC, where an attacker doesn't spoof an email but actually logs into a real one. Regular staff training on how to spot phishing attempts, paired with a documented process for approving wire transfers, gives employees a clear script to follow when a request feels off.

A zero trust approach to internal systems, combined with routine reviews of who has access to financial software, also limits how far a compromised account can reach. None of these controls are exotic or expensive. They're the same fundamentals that show up across most FBI recommendations for BEC prevention, and they work because BEC relies on a single moment of trust rather than a sophisticated technical exploit.

Frequently Asked Questions