FBI Data: $55.5bn in BEC Losses Over a Decade as Invoice Fraud Evolves

The $55 Billion Problem: Why Invoices Alone Cannot Secure B2B Payments

Business email compromise has become one of the most financially damaging fraud threats facing organisations globally — and the numbers confirm it is getting worse. According to the FBI's Internet Crime Complaint Center (IC3), cumulative exposed losses to BEC reached $55.5 billion across 305,033 incidents spanning 186 countries and all 50 US states between October 2013 and December 2023. The IC3 labelled the phenomenon "The $55 Billion Scam" in a public service announcement published in September 2024.

That figure alone demands attention. What makes it more urgent is its trajectory: between December 2022 and December 2023, identified global exposed losses to BEC grew by 9%, according to the same IC3 PSA. The threat is not stabilising.

How BEC Works — and Why B2B Payments Are Exposed

The IC3 defines BEC as a scheme targeting businesses and individuals performing legitimate transfer-of-funds requests, executed through social engineering or computer intrusion. Attackers typically manipulate communications to redirect payments to accounts they control — exploiting the trust that counterparties place in routine financial instructions.

Cumulative exposed losses to BEC reached $55.5 billion across more than 300,000 incidents in 186 countries over a decade, with identified losses growing a further 9% in 2023 alone — a scale that underscores why invoice-based verification is no longer sufficient.

The IC3's September 2024 PSA highlights a notable evolution in how stolen funds are moved. In 2023, the IC3 observed growth in BEC cases where funds were directed to financial institutions housing custodial accounts held by third-party payment processors, peer-to-peer processors, and cryptocurrency exchanges — channels that can complicate recovery and tracing efforts. This shift signals that perpetrators are actively adapting to conventional fraud-detection approaches.

Why an Invoice Is Not Enough

The scale and evolution of BEC fraud points to a structural vulnerability in B2B payments: the invoice, however authentic-looking, cannot by itself confirm that payment instructions are legitimate. Social engineering and computer intrusion are specifically designed to produce communications and documentation that appear genuine. As the IC3 evidence demonstrates, the problem is not that businesses fail to follow process — it is that the process itself has become a target.

In analytical terms, this creates a clear case for layered verification at the point of payment initiation, rather than reliance on document authenticity alone.

Regulatory Responses: What the Evidence Supports

Two regulatory developments are relevant to this problem, though they draw on sources outside the IC3-centred research package underpinning this article; readers should consult the cited primary sources directly before drawing operational conclusions.

Confirmation of Payee (CoP) in the UK: According to the Payment Systems Regulator's published scheme documentation, Confirmation of Payee checks whether a payee's name matches the account details provided before a payment is authorised. According to PSR and Pay.UK primary documentation, the PSR has played a central role in mandating CoP adoption, with Pay.UK operating the scheme at an infrastructure level. CoP was introduced as a regulatory initiative to address precisely the kind of misdirected-payment risk that BEC exploits.

EU Instant Payments Regulation: According to the Instant Payments Regulation as published in the Official Journal of the European Union, euro credit transfers are subject to an IBAN-name verification requirement. Readers should verify the precise scope and implementation timeline of this requirement against the official text, as this article has not independently confirmed all implementation details from the primary legislative source.

Editorial note: the regulatory section above draws on sources outside the IC3-centred verified research package. Figures, timelines and institutional roles in that section should be verified against the PSR, Pay.UK and EU primary sources directly.

Why It Matters

The IC3 data makes the operational implication plain: in a fraud environment where $55.5 billion in exposed losses has accumulated over a decade — and where annual losses are still growing — payments infrastructure cannot treat invoice receipt as a sufficient control. The migration of BEC proceeds toward custodial accounts at payment processors and crypto exchanges further narrows the window for intervention. Verification must happen before funds move, not after.