What happened
- The FBI Internet Crime Complaint Center (IC3) published its 2025 Internet Crime Report in 2026.
- BEC complaints were 24,768 in 2025, 21,442 in 2024 and 21,489 in 2023.
- BEC adjusted losses were $3,046,598,558 in 2025, $2,770,151,146 in 2024 and $2,946,830,270 in 2023.
- Across all IC3 complaints, 2025 saw 1,008,597 complaints and total losses of $20.877 billion, up 26% versus 2024.
- The FBI defines BEC as: "BEC is a scam targeting businesses or individuals working with suppliers and/or businesses regularly performing wire transfer payments... by compromising email accounts and other forms of communication... to conduct unauthorized transfer of funds."
These are self-reported complaints submitted to IC3. They are not a census of all fraud, and they should not be read as the total number of businesses affected.
Root cause, per the sources
This is an annual statistic, not a single incident, so there is no single root cause. The FBI definition describes the mechanism as compromising email accounts and other forms of communication to conduct unauthorized transfers of funds.
The exposure behind it
BEC depends on a recipient believing a message came from someone they trust. That is easier when a company domain can be spoofed because email authentication (SPF, DKIM, DMARC) is missing or not enforced, or when a registered lookalike of the domain exists. Those are conditions visible from outside.
What PixelPrivate can check
Email authentication checks
We check SPF, DKIM and DMARC for your domain and flag a DMARC policy that is not enforcing.
Learn moreBrand Shield
We look for registered domains that resemble yours, as findings for you to review.
Learn moreWhat PixelPrivate cannot do
- PixelPrivate does not detect intrusions, fraud or active attacks. It performs passive external checks and reports exposures.
- We cannot see inside mailboxes without the Microsoft 365 connector, and even then we do not detect fraud or tell you a payment request is fake.
- We cannot claim that PixelPrivate would have prevented this incident, and we do not claim that.
What to do this week
- Check that your domain has SPF, DKIM and a DMARC record, and plan a move toward an enforcing policy.
- Agree a call-back rule: bank-detail changes are confirmed by phone using a number you already hold.
- Search for registered lookalikes of your domain and note which ones you do not own.
- Tell the people who pay invoices what a changed-bank-details request looks like.
Sources
- FBI Internet Crime Complaint Center (IC3), “2025 Internet Crime Report”, Published 2026. https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
Last reviewed 2026-10-06. Figures are quoted as reported by the cited source.
Related hypothetical scenarios
Questions about this incident
Are these figures the total BEC losses?
No. They are adjusted losses from complaints submitted to the FBI IC3, which are self-reported and not a census.
Does PixelPrivate detect BEC?
No. PixelPrivate checks email authentication posture and lookalike domains. It does not detect fraud.
What changed between 2024 and 2025?
The report lists 24,768 BEC complaints in 2025 against 21,442 in 2024, and adjusted losses of $3,046,598,558 against $2,770,151,146.
