Is business email compromise the most expensive cyberattack?

When the answer changes

The answer can change only when a source makes the ranking testable.

Use this decision rule:

• If an official report compares BEC with other attack categories using the same reported-loss metric and period, describe BEC's rank exactly as that report states it.
• If a source reports BEC losses without comparing categories, say that it reports BEC losses. Do not add a rank.
• If a source identifies one expensive incident, describe it as a single incident. Do not use it to rank an attack category.
• If a source uses a different measure, such as records exposed, affected people, downtime, or ransom demand, keep that measure separate from financial loss.
• If the source does not define its population or method, treat its ranking as unsupported.

Do not turn a headline, vendor marketing statement, or isolated incident figure into an industry-wide ranking. The comparison method must be available to readers.

What the FBI's 2025 figures actually show

The IC3 annual report is the source that makes this ranking testable, because it publishes losses and complaint counts for every crime type it tracks, over the same period, using the same self-reported metric.

For 2025 it records $3,046,598,558 in BEC losses across 24,768 complaints, inside a total of $20.877 billion across 1,008,597 complaints. Ranked by total reported losses, investment fraud is far larger at $8,648,617,756. The report states the order plainly: investment-related fraud was the largest component of losses, followed by business email compromise and tech support scams.

So the popular claim fails on total losses. It holds on a different measure. Dividing IC3's published losses by its published complaint counts gives an average reported loss per complaint:

BEC has the highest average of any category, and roughly fourteen times the average of a ransomware complaint. IC3 does not publish these averages, so treat them as calculated from its figures rather than quoted from the report.

Three caveats travel with every number above. The data is self-reported complaints to a United States federal channel, not measured losses. Each complaint is counted under a single crime type, so a phishing email that ends in a fraudulent wire appears once, not twice. And IC3 describes its own statistics as an assessment taken at a point in time, which may change.

The honest published claim is therefore one of these: BEC is the second-costliest crime type in the FBI's 2025 figures; or the average BEC complaint reports the largest loss of any category; or BEC is the most expensive attack on business email, which is a narrower class than "cyberattack."

Worked evidence rule for a BEC cost claim

Use a claim only when it can be expressed with the source's own scope and metric.

Publishable claim shape:
[Official source] reports [amount or rank] for [defined BEC category]
during [reporting period], measured as [defined loss metric], compared with
[defined attack categories or population].
Do not publish:
"Business email compromise is the most expensive cyberattack."
unless the cited source explicitly supports that exact comparison.

The first shape gives readers a way to assess the claim. The second omits the source, period, metric, and comparison class.

The same rule applies to statements such as "90% of cyber incidents begin with email" or "a stated percentage of cyberattacks use email." Those figures need a primary study that defines what counted as an incident or attack, who was measured, and how the percentage was calculated. A percentage without those details cannot establish a general fact about all organizations.

What to check before using a BEC cost claim

Start with the source named in the statement. Look for the report itself, rather than a summary page, and record the reporting period and definition of loss. Then check whether it compares BEC against other categories under the same method.

If the evidence concerns your own organization rather than an industry-wide ranking, keep the question operational:

• Identify the business process that handles payment, supplier, payroll, or account-change requests.
• Record which verification step is required before that process releases money or changes details.
• Review the organization’s broader email security controls alongside the approval process.
• Preserve the relevant evidence for incident response and follow the organization’s reporting procedure when fraud is suspected.

That check does not detect every BEC attempt, prove that a payment request is legitimate, monitor a production environment continuously, or establish the cost of any attack category.