Business Email Compromise: per-incident cost, recovery economics, and the BEC docket

Business Email Compromise (BEC) is the phishing category in which an attacker spoofs or compromises an executive mailbox, a vendor mailbox, or a payroll system mailbox to redirect an outbound payment. It is the single most expensive phishing variant by aggregate annual dollar loss in the United States, and has been since at least 2018. The 2024 calendar-year picture, as reported by the FBI Internet Crime Complaint Center, looks like this: 21,442 BEC complaints filed, $2.77B aggregate adjusted loss, $129,191 mean loss per filed complaint, and an unknown but materially larger pool of unreported incidents. IC3 itself notes that the reported figure is widely understood to be a fraction of the true total because publicly-traded victims often suppress filings ahead of regulator disclosure and small businesses frequently fail to file at all.[IC3 2024]

IBM's Cost of a Data Breach 2025 tracks a different denominator: the all-in cost of a breach, including the wire-fraud loss itself, the incident response engagement, the breach-notification spend, regulatory fines where applicable, and the post-event customer-churn drag. IBM does not isolate BEC as an initial vector, but the two vectors a BEC attack rides land close together: stolen or compromised credentials at $4.67M per breach and phishing at $4.80M, both above the $4.44M global all-vector mean. Both trail ransomware-driven extortion ($5.08M) and malicious insider ($4.92M) per incident, yet lead the ledger on aggregate annual loss because the volume of compromised mailboxes dwarfs the count of ransomware deployments.[IBM 2025]

The headline figure is the sum of seven distinct cost lines, and the proportions matter for which controls actually pay back. In this model's allocation of a credential-rooted breach, direct wire-fraud loss accounts for approximately 41 percent of the incident total, incident response and forensic engagement for 18 percent, breach notification and customer credit-monitoring spend for 14 percent, legal and class-action exposure for 12 percent, post-event customer churn for 9 percent, regulatory fines and consent-order remediation for 4 percent, and security-control rebuild for the residual 2 percent. The wire loss line is what makes BEC viscerally expensive; the notification, legal, and churn lines are what make it durably expensive for two to three years after the event.

Sub-line proportions are this model's allocation, anchored to the IBM 2025 credential-vector breach cost and the IC3 2024 categorical breakdown. Wire-recovery posture per the FBI Financial Fraud Kill Chain guidance.[IBM 2025 + IC3 2024 + FBI FFKC]

IC3 splits BEC into five sub-categories that move at different rates and require different controls to defend. Conflating them is the most common board-level mistake. The dollar weight is now firmly with vendor email compromise, but the prevention surface is different per category.

The variable that dominates BEC outcome math is not technical sophistication. It is filing speed. The FBI Financial Fraud Kill Chain (FFKC) procedure freezes the receiving account if the victim files at IC3 within 72 hours and the loss is above $50,000 and the funds were sent to a domestic US bank. When all three conditions are met, the FBI Recovery Asset Team has posted recovery rates above 70 percent in recent annual reports. Outside those conditions, gross recovery sits closer to 25 to 30 percent because the funds have already moved through mule accounts into cryptocurrency, jurisdictionally-protected accounts, or split-deposit cash-out chains.

For a CFO sizing the financial exposure of a BEC event, this means the per-incident wire-loss assumption depends critically on whether the organisation has a pre-built filing playbook. A finance team that knows to call IC3 within hours can plausibly model the wire-loss line at 40 to 50 percent of its face value; a team that does not will lose the entire wire. The delta on a $1.92M average wire loss is roughly $960K of recoverable cash, easily the highest-leverage control investment in the entire BEC budget. The total cost of the playbook is approximately one tabletop exercise per year and an updated finance-team runbook. Compared to a $36 per-user-per-year Proofpoint TAP licence or a $40 per-user KnowBe4 deployment, the runbook is the cheapest dollar-per-recoverable-dollar control in the entire program.

The second variable in recovery economics is whether the destination account was domestic. International wires, especially to Hong Kong, the UAE, and Eastern European banking jurisdictions, recover at single-digit percentage rates because the FBI cannot freeze foreign accounts without inter-agency cooperation that takes weeks. The IC3 2024 report notes that the proportion of BEC funds routed through international banking has climbed from approximately 28 percent in 2020 to over 45 percent in 2024, which is a structural deterioration in recovery odds independent of any individual victim's response speed.[IC3 2024 + FBI FFKC procedural guidance]

BEC is not evenly distributed across industries. The vertical mix tracks two variables: how often the organisation moves large payments through email-mediated workflows, and how thin the segregation-of-duties layer is on outbound wires. Real estate, manufacturing, and professional services dominate the per-vertical BEC ledger; technology and SaaS sit comparatively low despite high attack volume because the typical SaaS payment cycle is automated through ACH on file with limited human approval surface.

Per-industry medians extracted from the IC3 2024 categorical-loss tables. Real estate sits highest because the typical title and escrow transaction moves a six-figure-to-low-seven-figure wire on a thirty-day closing cadence that attackers can map precisely from public real-estate listing data.[IC3 2024 industry annex]

Practitioners conflate BEC controls with phishing controls and end up over-spending on email-gateway licensing while leaving the high-leverage controls underfunded. The ranking below is built from the IBM 2025 cohort, cross-referenced with the SANS 2024 Top Phishing Controls list, and weighted by the per-dollar reduction in modelled BEC loss against a baseline $4.67M event cost.

BEC events that compromise a mailbox containing material non-public information or regulated personal data trigger disclosure obligations independent of the wire-fraud loss. The disclosure regime that applies depends on the victim's sector and jurisdiction, and the regulatory-fine line of the $4.67M total is meaningfully driven by which combination of frameworks engages.

For publicly-traded US issuers, SEC Item 1.05 of Form 8-K requires disclosure of a material cybersecurity incident within four business days of materiality determination. The materiality bar is judgement-dependent but a BEC mailbox compromise that exposed customer PII, financial controls, or M&A material is almost always disclosable. The 2024-2025 SEC docket includes several enforcement actions where the delay-to-disclosure itself was the violation, separate from any underlying control failure.

For EU data subjects, GDPR Article 33 triggers a 72-hour notification window to the supervisory authority and individual notification under Article 34 where there is high risk to data subjects. The fine band under Article 83(5) goes up to 4 percent of annual global turnover. A finance-team mailbox compromise that exposed EU citizen payment data routinely engages this regime.

For New York-licensed financial institutions, NYDFS 23 NYCRR 500 requires 72-hour notification of any cyber event that has a reasonable likelihood of materially harming the institution. The 2023 amendments added a 24-hour notification window for ransomware payments and a board-attestation requirement that effectively forces BEC events into board minutes.

For HIPAA-covered entities, an email-mailbox compromise that exposed PHI is a Breach under the Breach Notification Rule unless the entity can document a low-probability-of-compromise analysis. HHS OCR posts breach reports above 500 individuals on its public Breach Portal within 60 days, and the public-disclosure effect is material to the customer-churn line of the cost analysis. Cross-reference: /by-industry/healthcare.[SEC + GDPR + NYDFS + HHS OCR primary sources]

• All phishing attack vectors
• Whaling and CEO fraud cost
• Spear phishing cost
• AitM (Evilginx-style) phishing cost
• Phishing cost in financial services
• Phishing cost in manufacturing
• Abnormal Security cost
• KnowBe4 cost
• databreachcost.com (post-breach cost)
• incidentcost.com (general IR sizing)