On this page
If a supplier invoice, property closing payment or business transfer has gone to bank details that turn out to be false, contact the sending bank immediately. Ask its fraud team to seek a recall and contact the receiving institution. At the same time, preserve the payment instruction and the original email. Waiting for a complete investigation can leave less money available to freeze.
The FBI’s 2025 IC3 Annual Report, pages 7–8, records 24,768 business email compromise complaints and $3,046,598,558 in reported losses. These are reports to IC3, rather than a worldwide total or a finding that a particular bank or trading partner is liable. Our guide to the report’s statistics and limitations explains that distinction.
How invoice fraud can survive an ordinary email check
Business email compromise, often shortened to BEC, exploits a transaction the recipient already expects. A message may replace the beneficiary account on a genuine invoice, announce a supplier’s “new bank details” or impersonate a lawyer handling a property purchase. The amount, timing and commercial background can all look convincing.
There are different technical possibilities. A lookalike address can impersonate a genuine sender. An attacker may also enter an actual mailbox and insert instructions into an existing conversation. A familiar email thread therefore does not establish that new payment details are authentic. The FBI’s BEC guidance describes both spoofing and compromise of legitimate communications.
Keep a further distinction clear: an employee deceived into approving a payment and a criminal logging into a bank account are different factual events. Both may involve deception, but they require different evidence about instructions, authentication and control. For the latter scenario, see our guide to phishing and account takeover.
Run the bank response, security response and evidence work together
1. Give the bank a specific payment to act on
Use the bank’s independently verified contact details. Provide the transfer reference, amount, currency, execution time, sending account, beneficiary account and recipient bank. Say that the beneficiary instructions are suspected to be fraudulent. Request a recall or reversal, contact with the receiving institution and any indemnification documents the bank requires. Record the case reference and the time each request was made.
This follows the IC3 BEC response guidance. A request is not a completed reversal: ask whether the bank has sent the recall, whether another institution has acknowledged it and whether any funds are actually held. Keep written confirmations alongside the telephone chronology.
2. Secure communications without destroying the record
Tell the organization’s security team which accounts and conversation are affected. Preserve relevant messages and available audit records while the team investigates sessions, forwarding rules and unauthorized access. If an email account has been compromised, continuing to discuss the incident through that mailbox may disclose the response to the attacker. Coordinate through a separate, trusted channel.
Security and payment staff should share confirmed facts, including newly discovered recipient accounts. A mailbox reset does not recall a transfer; a recall request does not remove an attacker’s access.
3. Report a usable transaction chronology
For an IC3 report, include the banking information and the sequence that links the misleading instruction to the payment. Where another country is involved, preserve local complaint references too. Our guide to reporting cyber fraud from outside the United States addresses the international reporting context. An IC3 submission does not guarantee an investigation, a reply or a freeze.
What the Financial Fraud Kill Chain figures actually mean
The IC3 Recovery Asset Team coordinates with financial institutions and law enforcement through the Financial Fraud Kill Chain, or FFKC. The report describes domestic coordination and international work involving FinCEN and law enforcement partners. Where information is available at initiation, the domestic process can extend beyond the initial recipient to subsequent transfers. See pages 17–18 of the report.
| Measure | Reported figure | Meaning |
|---|---|---|
| Initiated incidents | 3,900 | The incidents in this process, rather than every fraud complaint. |
| Attempted theft | $1,163,919,846 | The money denominator used in the report’s success calculation. |
| Funds frozen | $679,013,183 | Money frozen; this does not establish final repayment to victims. |
| Reported success rate | 58% | Approximately the share of attempted theft frozen, not the percentage of victims refunded. |
These results explain the value of a fast, detailed report. They do not predict the result of an individual case. Nor does the report establish a universal 72-hour filing cutoff after which reporting becomes pointless. Act immediately, and report even if the payment is older. The available route depends on the transaction, the institutions involved and what remains identifiable or reachable.
An evidence file that answers the disputed questions
Organize the file around what changed and what happened because of that change. The following matrix separates evidence from conclusions that still need investigation.
| Question | Useful record | Limit |
|---|---|---|
| Who sent the instruction? | Original email with full headers, attachments and available mailbox audit logs. | A display name or screenshot alone does not establish who controlled the account. |
| What was altered? | Original contract and invoice, revised instructions, earlier verified beneficiary details. | A mismatch identifies a change; its source still needs investigation. |
| Where did money go? | Bank-issued payment confirmation, account identifiers, recall messages and confirmed onward transfers. | An account holder’s name does not by itself prove knowledge of the fraud. |
| When was the fraud discovered? | Dated supplier verification, internal escalation, bank notices and complaint references. | Use actual timestamps and time zones; distinguish recollection from contemporaneous records. |
Preserve originals before making an annotated working copy. If the bank identifies an onward payment, record its source and exact details; do not fill gaps with guesses. The report’s page 23 example includes a recipient account holder described as another scam victim. That is a concrete reason to avoid treating receipt of money as proof of complicity.
Does the customer, supplier or bank bear the loss?
The IC3 statistics cannot answer that question. A case-specific assessment needs the governing contract and law, the genuine payment obligation, who communicated and approved the changed details, the applicable verification arrangements and what each party did after discovery. Whether funds were frozen is a separate issue from who may ultimately owe compensation.
For future payments, make changed account details a reason for independent verification. Call a contact using a number already held in trusted records, verify the exact beneficiary and account, and document the check. A telephone number inside the suspicious message simply creates another opportunity for impersonation.
Sources and scope
Statistics and FFKC explanations: FBI, 2025 IC3 Annual Report, pages 7–8, 17–18, 23 and 62. Operational guidance: IC3, Business Email Compromise, and FBI, Business Email Compromise. The evidence matrix is an editorial framework for organizing a specific incident; it is not an IC3 eligibility rule or a promise of recovery.
