BEC Cost Calculator

Model what one business email compromise could cost you, using the FBI's 2025 Internet Crime Report as the per-incident figure. Every assumption stays visible and editable.

This is a model, not a forecast. IC3 publishes what victims reported. It does not publish the odds that any particular company is targeted, and neither does anyone else. The number of incidents below is your assumption, not evidence. The tool supplies one figure from the report and does the multiplication; it cannot tell you what will happen.

Your organization

Total headcount. Shown for context only. It does not scale the exposure figure, because IC3 publishes no loss-per-employee rate.

people

People who can initiate or approve a payment. This is the group BEC actually targets.

people

Your typical wire or supplier payment. Leave blank to use the IC3-derived average of $123,005 per reported incident.

USD

How many BEC attempts you assume would succeed in a year. There is no published base rate for this. It is a planning input, and the output is only as good as it is.

per year

Modeled exposure

Estimate, not a prediction

Modeled annual exposure $123,005, from 1 assumed incidents at $123,005 each.

Modeled annual exposure$123,005

1 assumed incident × $123,005 per incident

Loss per successful incident$123,005

Calculated from IC3 2025: $3,046,598,558 in reported BEC losses ÷ 24,768 complaints. IC3 does not publish this average itself.

Assumptions behind that number

  • Incidents per year: 1. Your input, and no published source supports any particular value.
  • Loss per incident: $123,005. calculated from IC3 2025 totals.
  • Not included: recovery costs, legal fees, downtime, insurance excess, and reputational damage. IC3 records the reported loss only, so this model does too. The real cost of an incident is higher than the figure above.
  • Recovery is possible: IC3 operates a Recovery Asset Team that can freeze fraudulent wires when an incident is reported quickly. The model assumes no recovery, which makes it a gross figure, not a net one.

What IC3 actually published

From the 2025 IC3 Annual Report (April 2026). These are the figures as printed; the average is the only derived value on this page.

Reported business email compromise complaints and losses by year, from the IC3 annual reports
YearBEC complaintsReported losses
202321,489$2,946,830,270
202421,442$2,770,151,146
202524,768$3,046,598,558
  • BEC losses rose 10.0% between 2024 and 2025, against 1,008,597 complaints and $20.877 billion in total reported losses across all crime types.
  • BEC is not the costliest crime type by total losses. Investment fraud reported $8,648,617,756 in 2025, nearly three times BEC. What BEC leads on is the average per complaint: $123,005 against $118,500 for investment fraud and $8,950 for ransomware.
  • Wire transfer or ACH was the most frequently reported transaction type in BEC complaints, at 86%, which is why the average payment size in your finance process is the most useful number you can put into this model.
  • $30,256,592 of 2025 BEC losses were reported in complaints that referenced AI. IC3 applies that descriptor when the complaint text mentions AI, not when AI involvement is confirmed.

What the figures do and don’t cover

  • The figures are complaints voluntarily reported to a US federal channel, not measured losses. Incidents that were never reported to IC3 are not in them.
  • Each complaint is counted under exactly one crime type, so a BEC that also involved a data breach appears once.
  • IC3 describes its statistics as an assessment taken at a point in time, which may change.

Sources

Every dollar figure on this page comes from the 2025 IC3 Annual Report, published April 2026. The per-incident average is calculated from two figures in it and is labelled as such wherever it appears.

DMARC at enforcement closes one BEC route: mail sent as your exact domain

It won't stop a lookalike domain or a compromised mailbox, and no honest tool claims otherwise. What it does stop is someone putting your domain in the From line. Palisade's agent investigates every sender, drafts the fixes, and proposes each policy step. You approve before anything ships.

Get my domain to enforcement

1 domain free up to 1,000 emails/month

Related: score your domain’s authentication or check a suspicious link.

What is a BEC cost calculator?

Business email compromise is the attack where someone convinces a person who can move money to move it to the wrong account, usually by impersonating an executive, a supplier, or a colleague. Divide the FBI’s reported BEC losses by its complaint count and the average comes to about $123,005 per incident, higher than any other crime type in the report, though IC3 does not publish that average itself. This calculator turns that into a number you can put in front of a budget conversation: a per-incident loss taken from the FBI Internet Crime Complaint Center, multiplied by an incident count you set yourself. It is a model with its assumptions in the open, not a risk score, because nobody publishes the data a real risk score would need. On the controls side, the piece of this that authentication addresses is exact-domain spoofing: see where your domain stands with the email security score, or read how the attack works.