IC3 says there were 241K+ reports of business email compromise scams globally from June 2016 to July 2019, totaling $43B+ in actual and attempted losses
The Federal Bureau of Investigation (FBI) said today that the amount of money lost to business email compromise (BEC) …
Context & Ripple Effects
The FBI had already identified BEC as responsible for roughly half of estimated 2019 cybercrime losses, while FinCEN recorded a rise in attempted BEC theft from $110 million per month in 2016 to $301 million in 2018. IC3’s worldwide tally supplies a broader measure of the scam category that began as executive-impersonation “CEO fraud” and remains prominent in the FBI’s cybercrime reporting.
First-order effects
- FBI and IC3 gain a stronger global evidentiary baseline for prioritizing BEC: the reported total spans both successful and thwarted attempts, showing the scale of payment-diversion pressure beyond confirmed losses alone.
- Organizations exposed to executive-impersonation scams face a threat category whose reported volume and claimed value far exceed the earlier $2.3 billion CEO-fraud estimate cited by the FBI.
Second-order effects
- The IC3 tally reinforces FinCEN’s earlier signal that BEC attempts were accelerating, making payment controls and fraud reporting central pressure points rather than peripheral cybersecurity concerns.
- BEC’s large share of reported cybercrime losses means changes in overall FBI cybercrime-loss totals will be harder to interpret without separating fraud attempts from completed theft.
Third-order effects
- If successive FBI and IC3 reports continue to show BEC among the largest loss categories, cybercrime measurement will increasingly shape security priorities around fraud prevention and payment verification, not only network intrusion defense.
- The pattern points to a durable shift from narrowly defined CEO impersonation toward BEC as a broad, globally measured financial-crime category.
The trend: Business email compromise is becoming a core financial-cybercrime metric, with reporting increasingly tracking both attempted payment diversion and realized losses.