Business email compromise, or BEC, is a request to move money that appears to come from someone entitled to ask for it: an owner, a vendor, a closing attorney. The FBI describes it as a scam aimed at businesses that regularly pay by wire transfer, carried out by taking over or imitating email accounts, phone numbers and virtual meetings so that money is sent where it should not go.

It is also one of the most expensive crimes the FBI tracks. In its 2025 annual report, the FBI's Internet Crime Complaint Center recorded 24,768 BEC complaints and $3.05 billion in reported losses, up from $2.77 billion in 2024. Only investment fraud cost victims more. Ohio ranked eighth among the states for complaints of all kinds and thirteenth for losses, at $421 million.

How much of this is AI

On the FBI's numbers, less than the headlines suggest. The same report counts just over $30 million in 2025 BEC losses where AI was reported to be involved, about one percent of the total, and it says plainly that “not all are AI-enabled.” That figure only covers cases where the victim knew AI had been used, so the true share is higher. In its section on investment scams, the report notes that many victims do not realize how far AI was involved.

What AI changes is quality and volume. The report describes chat generators producing “official-sounding emails mimicking a company's CEO or other officials,” and voice cloning used to ask for a wire payment. A 2024 FBI announcement lists the same tools: AI-written text that reads as believable, and cloned voices of public figures or people the target knows. The practical effect is that the warning signs staff were taught no longer hold. Awkward grammar and a generic greeting are not reliable signs of a fake.

A campaign Microsoft described in September 2026 shows the scale. Between August 3 and 5, more than a million emails went out, each appearing to come from an executive at the recipient's own company and asking accounts payable to process an ACH payment of nearly $50,000. About 88% were sent to recipients in the United States. The fabricated invoice sat directly below the executive's signature, and the messages were sent through accounts on third-party email services. Microsoft found signs that generative AI helped build the messages, and was careful to say those signs do not establish how much of the content AI produced. Our Threat Intelligence Center has the full breakdown.

What AI does not change

However well written the request is, it ends the same way: someone at your firm has to send the money. That step belongs to you, and it does not depend on anyone spotting a fake.

The control is a callback rule. Any request to change where a vendor is paid, and any payment above an amount you set, is confirmed by phone before it goes out, using a number you already had on file. The number in the email, the invoice or the signature block does not count, because the sender controls those. The same holds for a voice on the phone. The FBI's advice is to hang up, look up the number yourself, and call back.

Two details decide whether the rule holds. It has to come from the owner, in writing, because the person following it will at some point be questioning what looks like the owner's own instruction. And it has to apply to owners and partners without exception, since a request that arrives already approved from the top is what these messages imitate.

The other half of BEC is a real mailbox in the wrong hands. In one case covered in our Threat Intelligence Center, the CEO of a small real estate firm had multi-factor authentication removed from his own account at his request. An attacker got into the mailbox, learned how he wrote to finance, and copied it, starting with a test payment under $1,000 and raising the amounts from there. No AI was needed. That is the argument for multi-factor authentication with no exceptions on every mailbox that can request or approve a payment.

If a payment has already gone out

Time is what matters most. The FBI's Recovery Asset Team works with banks to freeze fraudulent transfers. In 2025 it was brought into 3,900 incidents and froze $679 million of the $1.16 billion at stake, a 58% success rate. Its guidance is to contact your bank immediately and ask for a recall of the funds, then file a complaint at ic3.gov with the full transaction details, whatever the amount.

Four things to put in place

1. Write the callback rule down. Name the amount, name who makes the call, and have the owner sign it.
2. Check multi-factor authentication on every mailbox that can request or approve a payment, and close any exception, starting with the most senior.
3. Keep your bank's fraud number where finance will find it. Nobody should be searching for it after a transfer has gone.
4. Read the social engineering section of your cyber or crime insurance policy. Some policies pay only when a callback was made and documented.

If you want to know where your own firm stands, a security assessment is where that conversation starts.

This article was rewritten on October 12, 2026 and replaces an earlier version.