The FBI’s $43.3 billion figure for business email compromise (BEC) scams is a historical cumulative estimate, not a current annual total. In a May 4, 2022 public service announcement, the FBI’s Internet Crime Complaint Center (IC3) reported $43,312,749,946 in domestic and international exposed dollar loss for records dated June 2016 through December 2021. The FBI defines exposed loss to include actual and attempted losses, so the figure is not the same as confirmed net losses suffered by victims.
What the FBI’s $43 billion figure measures
The figure behind the headline comes from FBI/IC3’s May 2022 announcement, “Business Email Compromise: The $43 Billion Scam”. Its $43,312,749,946 total covers domestic and international exposed dollar loss recorded from June 2016 through December 2021. The underlying records included filings from the FBI/IC3, law enforcement and financial institutions.
As an Amazon Associate I earn from qualifying purchases.
“Exposed loss” includes actual and attempted losses. It therefore should not be described as money that every victim definitively lost, as a recovered amount, or as a net figure after recoveries. The FBI/IC3 figures are reported data, not a guaranteed census of every BEC incident.
How the later FBI total compares
On September 11, 2024, the FBI/IC3 published a later cumulative PSA, “Business Email Compromise: The $55 Billion Scam”. It reported $55,499,915,582 in domestic and international exposed dollar loss for October 2013 through December 2023. That series begins earlier and spans a longer period than the 2022 tally; the two figures are not a like-for-like measure of growth over the same dates.
#1 Best Overall
| FBI/IC3 measure | Amount | Reporting period and meaning |
|---|---|---|
| 2022 cumulative PSA | $43,312,749,946 | June 2016–December 2021; domestic and international exposed loss, including actual and attempted loss. |
| 2024 cumulative PSA | $55,499,915,582 | October 2013–December 2023; domestic and international exposed loss, including actual and attempted loss. |
| 2023 annual complaints | 21,489 complaints; adjusted losses over $2.9 billion | Calendar-year complaint measure reported in the FBI/IC3 2023 Internet Crime Report, not the cumulative PSA series. |
| 2024 annual complaints | $2,770,151,146 in complaint losses | Calendar-year 2024 figure in the FBI/IC3 2024 IC3 Annual Report, not a cumulative exposed-loss total. |
Annual complaint figures and cumulative exposed-loss totals describe different measures and time periods. They should not be added together or compared as if they were the same series. The 2024 PSA is the latest cumulative BEC PSA identified in the cited FBI/IC3 materials.
What business email compromise is
The FBI describes BEC, also called email account compromise (EAC), as a scam that targets businesses and individuals who make legitimate requests to transfer funds. Criminals commonly compromise a real business or personal email account through social engineering or computer intrusion, then use the trusted account or conversation to persuade someone to send money to an unauthorized destination.
Not every scheme is a wire-transfer request. BEC variants may also seek employees’ personally identifiable information or access to related accounts. Common scenarios described by the FBI include:
Recommended Free Tools
- A compromised vendor email asking a customer to change payment or account information.
- A fraudulent request for employee W-2 information.
- Redirection of funds in a real-estate transaction.
- Requests to buy large quantities of gift cards.
The FBI has also warned that schemes increasingly use custodial accounts at financial institutions for cryptocurrency exchanges or third-party payment processors, as well as direct transfers to those platforms, where funds can be dispersed quickly.
How to reduce the risk of BEC fraud
BEC exploits trusted communication and routine payment processes. The FBI/IC3’s guidance focuses on strengthening account access and checking payment instructions through a separate, trusted route.
- Use multi-factor authentication. Add two-factor or multi-factor authentication to email and other important accounts as an additional security layer.
- Verify payment changes independently. Before acting on a new or changed payment instruction, call a known, independently verified number. Do not use a phone number or other contact detail supplied in the suspicious message.
- Check addresses and links. Review the full sender address and URLs for mismatches or misspellings, rather than relying only on a familiar display name.
- Keep sensitive information out of email replies. Do not provide credentials or personal information by email in response to an unexpected request.
- Monitor financial accounts. Watch for irregularities that could indicate an unauthorized transfer or account change.
What to do after a fraudulent transfer
- Contact your financial institution immediately. Report the transfer and ask whether it can recall the funds. Procedures vary by institution.
- File a complaint with the FBI’s Internet Crime Complaint Center. Report promptly at IC3.gov.
The FBI says prompt reporting can assist financial institutions and law enforcement in possible recovery efforts. It does not guarantee that funds will be recovered.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
