Email fraud accounts for most US business cybercrime losses

Business email compromise accounted for the vast majority of US corporate cybercrime losses last year, according to an analysis by procurement platform Opstream. The fraud generated just over $3 billion in losses, dwarfing the combined total from ransomware, data breaches, and stolen intellectual property.

BEC involves a fraudster impersonating an executive or vendor to redirect a wire payment. These scams generated 24,768 reported incidents in 2025, which is more than the other three major cybercrime categories put together. (Opstream)

Ransomware caused only $32.3 million in reported losses, FBI data shows. That’s a tiny fraction of the $3 billion lost to email fraud. Total reported victims across all categories climbed 18% to nearly 34,700, the highest level in six years. (FBI Internet Crime Complaint Center)

The surge comes as the federal government ramps up its response. In March, the White House issued Executive Order 14390 to coordinate against the criminal networks behind this fraud. Congress also passed legislation to study whether federal cybersecurity help is actually reaching small businesses.

California, Texas, Florida and New York had the most total victims in 2025, largely due to having the most businesses to target. But adjusted for population size, Alaska had the highest concentration of victims at 47.3 per 10,000 businesses. Western and Mountain states are disproportionately represented in the top rankings. (Opstream)

Geography matters here. While California and Texas had the most total victims, Alaska had the highest concentration of attacks per business. Arizona, Washington, and Nevada also ranked high. If you run a small office in any of these states, your email is a prime target for fraudsters impersonating vendors or executives. (Opstream)

Here’s the problem. Most owners think ransomware is the only thing that drains bank accounts. It isn’t. Email fraud is the bigger, quieter bleed. We’d rather you turned on multi-factor authentication and complained about the extra step than lost a month’s revenue to a fake invoice. It’s cheap to fix now, expensive to fix later.

Sources: Insurance Business.