Business Email Compromise Losses: What FBI IC3 Data Reveals About Small Business Targets

Business email compromise losses surpassed $2.9 billion in reported damages in 2023, and the FBI’s Internet Crime Complaint Center (IC3) data for 2024 confirms the trend is accelerating, not reversing. Most coverage stops at the headline number. What it misses is the anatomy behind it: who attackers choose first, which internal roles they impersonate, how long schemes run before anyone notices, and why companies with fewer than 100 employees absorb a disproportionate share of the damage. This post works through that anatomy layer by layer, so business owners and their operations teams know exactly what they are up against.

1. The Scale of the Problem in Plain Numbers
2. How Attackers Identify Targets Under 100 Employees
3. Which Roles Attackers Impersonate – and Why
4. Dwell Time and the Detection Gap
5. Why Finance and Operations Staff Remain the Highest-Value Targets
6. Real-World Attack Patterns From IC3 Case Data
7. Building a Defense Posture That Matches the Threat
8. Questions to Ask Your IT Firm Right Now
9. Recovery Options and Reporting After an Incident

The Scale of Business Email Compromise Losses in Plain Numbers

The FBI IC3 2023 Annual Report – the most recently published full-year dataset – recorded 21,489 business email compromise complaints with adjusted losses exceeding $2.9 billion. That figure reflects only what was reported. The IC3 consistently estimates actual losses run three to five times higher, because organizations – especially smaller ones – routinely decline to report out of concern for reputational damage or legal exposure.

Preliminary IC3 data and CISA advisories published in 2024 point to a continued increase, driven partly by the rise of phishing-as-a-service platforms that have removed the technical barrier for attackers. A threat actor who could not have mounted a convincing impersonation campaign in 2020 can buy a ready-made kit today for under $200.

For context: business email compromise losses represent more total financial damage than ransomware, investment fraud, and tech support scams combined in IC3 filings. The category gets a fraction of the media attention those threats receive, because money moves quietly. That quiet is precisely why it works.

How Attackers Identify Targets Under 100 Employees

The common assumption is that attackers cast wide nets and hit whoever responds. IC3 case narratives and CISA advisory documentation tell a different story: smaller companies are frequently chosen deliberately, not accidentally, for several compounding reasons.

First, smaller organizations are extensively indexed in public-facing data. A company with 30 to 80 employees typically has a website listing leadership names, a LinkedIn presence identifying the CFO or operations director, public vendor registration records if they work with government or institutional clients, and often an open email directory deducible from a single confirmed address format.

Second, smaller companies run thinner control environments. A 500-person company likely has a dedicated accounts payable team with multi-step wire approval. A 40-person company often has one person who initiates and one who approves – and those two people may sit next to each other and confirm transactions verbally rather than through a documented workflow.

Third, smaller companies generate less noise. An attacker monitoring a compromised inbox at a small firm is less likely to be flagged by anomaly-detection tools, because smaller environments produce less baseline data to define what “normal” looks like.

The targeting methodology typically starts with open-source intelligence: harvesting names from LinkedIn, identifying the company’s bank or payment processor from public records or prior phishing runs, then timing the attack around observable business events – fiscal year-end, contract signings, or leadership transitions announced on social media.

Which Roles Attackers Impersonate – and Why

IC3 case data and FBI private industry notifications identify a consistent impersonation hierarchy. The CEO or executive director is the most impersonated role by volume. The CFO or controller is the most impersonated role by dollar loss per incident. Vendors and suppliers rank third – and that category has grown substantially since 2022.

CEO impersonation works because it exploits organizational deference. An employee receiving a message that appears to come from the top of the organization faces a socially engineered choice: question the authority of leadership, or execute the request quickly and avoid appearing obstructionist. Most people act, especially when the message conveys urgency.

CFO impersonation is more targeted and more lucrative. Attackers running a CFO impersonation campaign typically have deeper intelligence about the company’s internal financial processes – enough to reference actual vendor names, approximate invoice ranges, and internal terminology, all harvested from a prior email compromise or social engineering of lower-level staff.

Vendor impersonation – sometimes called vendor email compromise – has become its own growing sub-category. An attacker compromises a vendor’s email account, or spoofs it convincingly, then sends updated banking instructions to the target company. Because the email appears to come from a known, trusted source, this variant has a particularly high success rate. IC3 data shows vendor impersonation carries some of the highest per-incident loss averages across all business email compromise categories.

Dwell Time and the Detection Gap

One of the most important – and least discussed – dimensions of business email compromise losses is dwell time: the gap between the initial account compromise or first fraudulent contact and the moment the victim organization realizes something is wrong. In a ransomware attack, detection is forced by the attack itself. In business email compromise, the attacker’s entire goal is to stay invisible long enough for a fraudulent transaction to process and funds to move.

FBI case narratives and incident response findings consistently show average dwell times in business email compromise campaigns ranging from three weeks to several months for the reconnaissance and relationship-building phase. The fraudulent transaction request typically comes only after weeks of observation – or low-stakes correspondence designed to establish familiarity.

In vendor impersonation cases, the attacker may correspond with the target company over one to three billing cycles before introducing a fraudulent banking change. By that point, the accounts payable team has developed a routine interaction pattern with what they believe is a legitimate contact. Suspicion is low precisely because the relationship feels established.

Detection most commonly happens one of three ways: the real vendor contacts the company about a missing payment, the company’s bank flags an anomalous outgoing wire, or an employee calls the vendor through a separate channel to confirm payment details. Fewer than 20 percent of IC3-reported cases saw the victim organization detect the fraud before the transaction completed.

For companies without dedicated security monitoring or formal vendor payment verification workflows, that detection window is nearly absent.

Why Finance and Operations Staff Remain the Highest-Value Targets

The targeting of finance and operations staff is not random. It reflects a precise understanding of where transactional authority sits in a small organization. At a company under 100 employees, the person processing payroll, approving wire transfers, managing vendor payments, and handling executive expenses is often one or two people – sometimes the same person.

That concentration of authority, combined with the volume of legitimate financial communication those roles handle daily, creates ideal conditions for social engineering. Finance staff receive high volumes of payment-related emails. They are conditioned to act quickly on time-sensitive financial requests. And in smaller organizations, they often lack a peer review layer or a documented escalation path for when something feels off.

Operations staff are targeted differently but equally deliberately. They control vendor relationships, have visibility into contract terms and renewal timelines, and communicate with a wide range of external parties. An attacker who compromises or convincingly spoofs an operations contact gains access to the full web of a company’s vendor and partner relationships – a multiplier for subsequent fraud against those third parties.

IC3 data also shows that business email compromise losses are industry-agnostic. Real estate, professional services, healthcare, manufacturing, non-profit, and technology companies all appear in complaint data at roughly proportional rates to their share of the small-business economy. The attack surface is the role and the authority it carries, not the industry.

Real-World Attack Patterns From IC3 Case Data

IC3 annual reports include anonymized case summaries that show how these attacks unfold in practice. Several patterns appear repeatedly across the 2022, 2023, and preliminary 2024 data.

• A professional services firm received a message from what appeared to be its managing partner, requesting an urgent wire transfer to a new vendor for a project kickoff. The managing partner’s email had been compromised two weeks earlier. $180,000 transferred before the compromise was discovered.
• A non-profit received updated banking instructions from what appeared to be a longtime grant-funding organization. The instructions came from a domain that differed from the real funder’s by one transposed character. The non-profit processed a $95,000 grant payment to a fraudulent account.
• A healthcare services company received a message from its apparent CFO directing payroll to be redirected to a new account for one pay period “due to an audit issue.” Two payroll runs totaling $220,000 deposited into an attacker-controlled account before the real CFO returned from travel and the fraud surfaced.
• A manufacturing supplier received a call followed by an email from what appeared to be a major customer, requesting that future invoices go to a new accounts payable contact. Over three months, 11 invoices totaling $430,000 went to a fraudulent entity before the real customer asked about missing payments.

None of these attacks required sophisticated malware. None required a network intrusion in the traditional sense. Every one of them required only that someone with financial authority acted on a convincing but fraudulent instruction without an independent verification step.

Building a Defense Posture That Matches the Threat

Defending against business email compromise losses requires controls at three layers simultaneously: email infrastructure, human behavior, and financial workflow. Technical controls alone are not enough. Workflow controls alone are not enough. The defense has to be layered across all three.

At the email infrastructure layer, the foundational requirements are domain authentication protocols – SPF, DKIM, and DMARC – that prevent spoofing of your own domain. These are well understood and should already be in place. Beyond that, email filtering configured to flag external-domain messages that spoof internal display names catches a large percentage of CEO and CFO impersonation attempts before they reach an inbox.

At the human layer, the most effective control is also the simplest: a verified, out-of-band confirmation requirement for any new payment destination or any change to existing vendor banking information. That means a phone call to a number already on file – not a number provided in the same email thread. This single control, consistently enforced, would prevent the majority of vendor impersonation losses documented in IC3 filings.

At the financial workflow layer, dollar-threshold approvals and dual-authorization requirements for wire transfers create a structural barrier. Set the threshold low enough to matter – not at $1 million for a 30-person company. Many IC3-reported incidents involved transactions well under $100,000, amounts that often fall below internal review thresholds at smaller organizations.

Monitoring your own email environment matters too. Unusual login activity, forwarding rules created without authorization, and changes to reply-to addresses are the fingerprints of an ongoing email account compromise. Without monitoring in place, those signals go undetected for weeks – enabling the extended dwell time that makes business email compromise losses so severe.

Organizations looking to assess their current exposure against these control categories can start with a review of their cybersecurity posture and email security configuration alongside a qualified IT partner. The goal is to find the gaps before an attacker does. You can also explore our managed IT services to understand how continuous monitoring closes the detection gap described in IC3 case data.

Recovery Options and Reporting After an Incident

If your organization has already experienced business email compromise losses, speed determines whether any funds can be recovered. The FBI’s IC3 complaint portal is the primary reporting channel, and filing immediately is critical. The IC3 operates the Financial Fraud Kill Chain process, which can in some cases halt or reverse wire transfers if the fraudulent transaction is reported within 72 hours.

Beyond the IC3: notify your bank immediately and request a recall of the outgoing wire. Contact the receiving bank if that information is available. File a report with your local FBI field office – these cases are a federal priority, and field offices have dedicated teams assigned to them. The FBI’s business email compromise resources page provides step-by-step guidance for victims.

Recovery rates are low overall – the IC3 estimates fewer than 30 percent of reported losses are fully recovered – but the probability improves sharply with fast action. Organizations that wait several days before reporting typically recover nothing. Those that report within hours have meaningfully better outcomes.

Document everything immediately after discovery: email headers, wire transfer confirmations, any phone or email communications with the apparent fraudster, and the timeline of events as your team reconstructs it. This documentation supports the FBI investigation and any claim under a cyber liability or crime policy.

Questions to Ask Your IT Firm Right Now

Business email compromise preparedness is a fair and important question to put directly to your IT or cybersecurity firm. The answers will tell you quickly whether your current setup matches the threat level reflected in FBI IC3 data.

• Are our email authentication records (SPF, DKIM, DMARC) correctly configured, and have they been tested against spoofing attempts recently?
• Do we have monitoring in place that would alert us if a new email forwarding rule was created on an executive or finance team account?
• What would our current environment catch – and what would it miss – if a vendor’s email account were compromised and used to send us fraudulent banking instructions?
• Do we have a documented, enforced process for verifying payment destination changes through a channel other than email?
• If someone on our finance team received a wire request that appeared to come from our CEO while the CEO was traveling, what controls exist to stop that transfer before it processes?

An IT firm that cannot answer these questions clearly does not have the security depth your organization needs. Business email compromise losses are not a theoretical risk – this is the single highest-loss cybercrime category in FBI data, year after year, and the typical victim looks exactly like most small and mid-sized businesses operating today.

If you want a direct conversation about where your email security and financial workflow controls stand, Book a Free Cybersecurity Strategy Call. It’s 20 minutes with our team – no sales pressure, no obligation, no pitch deck.

The Bottom Line

Business email compromise losses at small companies are not the result of unsophisticated victims making obvious mistakes. They are the result of methodical, patient attackers exploiting the structural realities of smaller organizations: concentrated authority, lean finance teams, and workflow norms that favor speed over verification. The FBI IC3 data does not describe an abstract threat. It describes the company next door – and quite possibly yours. The defenses exist. The question is whether they are in place before the first fraudulent request lands in your inbox.