Ask an owner what they fear from a computer criminal and the answer is usually ransomware, or a breach that empties a database. The FBI's loss tables say something else. The most expensive cybercrime of 2025 arrived by email, looked like a normal message from a colleague or a vendor, and took $3.05 billion.

In all, the FBI's Internet Crime Complaint Center logged nearly $21 billion in reported losses across every crime type it tracks. Business email compromise, where a fraudster impersonates an executive or a vendor to redirect a payment, generated 24,768 complaints worth $3.05 billion; about $123,000 per incident on average. Data breaches ($435 million), ransomware ($32.3 million), and intellectual-property theft ($26.7 million) added up to $494 million combined. Email fraud by itself was 86 percent of the four-category pool, about $3.5 billion in total, and more than six times the other three together.

Across those four categories, reported corporate victims climbed 18 percent to 34,728 in 2025, a six-year high (an Opstream analysis via Insurance Business America, September 22, 2026).

Why email beats exploits

Business email compromise is no technological feat. Some versions need no hack at all; others start with a stolen mailbox. Either way the money leaves because of one convincing email: the boss asking for a rush payment, or the long-standing vendor whose invoice now carries a new account number. The target is not your firewall; it is the habit of believing a familiar name on a familiar thread.

We have covered that vendor side before; exposure runs through relationships you never signed. Payment fraud is the same attack in miniature, run on a Tuesday, by anyone with a mailbox.

The AI push

The FBI's 2025 report gave artificial intelligence its own section for the first time: 22,364 complaints involving AI-touched schemes, worth nearly $893 million. Voice clones, fake identification documents, pressure tactics, in the FBI's own description. Inside the report's email-fraud section, businesses reported over $30 million in BEC losses involving AI in 2025.

The scale case arrived in September: about $108 million stolen after a scammer texted from a bank executive's identity and a cloned lawyer's voice confirmed on a follow-up call (Reuters, September 25, 2026). Text, phone call, plausible reason to hurry. That is the whole toolkit, and it gets cheaper every quarter.

And 2026 is already running hotter

The FBI tables carry a lag, so 2025 stays the latest complete year; the early 2026 indicators lean the same direction, and faster.

Fortra's monthly email-fraud tracker, built from live engagements with BEC criminals, logged the average wire-transfer request on the rise, $47,652 in March, $54,138 in May, $71,295 in June, an ask up almost half in three months while attack volume rose 22 percent in June alone. Coalition, one of the largest cyber insurers, reported BEC claims up roughly 30 percent in 2025 over the second half of 2024 and forecast steeper growth as automation spreads. Its briefing credits AI phishing kits, offered for $1,500 plus $500 a month, with breaking through the extra sign-in steps businesses use, compromising more than 12,000 inboxes across 10,000 organizations, and aiming at small businesses once considered too minor to target. A survey of 230 corporate finance leaders published October 8, 2026 (Certos) found 81 percent reporting attempted fraud involving AI-generated or enhanced content in the past year; only about half were confident they would catch one before money moved.

One honest note: the spookiest version, a deepfake voice giving the payment instruction, is still rare on insurers' claims books; most fraudulent transfers still start as plain email. Today's AI advantage runs through the cheap end: scale, drafting, sign-in bypasses, with deepfake-enabled growth projected into 2027 and beyond.

Where the money hits

Raw victim counts follow business counts. California had the most corporate cybercrime victims in 2025 at 4,725, with $486 million in losses. Adjust each state for the businesses on its ground and the map inverts: Alaska leads with 47.3 reported victims per 10,000 businesses, followed by Arizona (36.9), Washington (36.1), Texas (35.3), and Nevada (34.9). Colorado, Wyoming, and Utah all land in the top 15; Colorado businesses reported 792 victims and $59.9 million in losses in 2025, as the Daily Sentinel summarized the analysis.

One caveat: the FBI counts only what gets reported; the true scale of email fraud almost certainly runs larger.

What actually stops it

Nothing on this list requires new software.

Verify out of band. Any request to change payment details gets a phone call to a number you already had for that person or vendor before the email ever arrived. Never approve a change by replying on the same thread. This control blunts the most common tactic in the scheme.

Take a beat. The FBI's own anti-fraud guidance uses that phrase; urgency in a message is what makes a good employee skip the checking step. A payment that can wait thirty minutes can usually wait thirty more; the fraudster works the deadline, so respect the pause.

Split the approval. Two people, one call, before any wire or transfer changes course. Small teams can do this; it is a habit question.

Read your insurance paperwork. Many cyber policies still cap social-engineering and funds-transfer losses well below what they pay for breach response or ransomware, even though email fraud is now the larger loss driver by a wide margin (Insurance Business America; the Coalition rise above is the same story on an insurer's books). We wrote in July about cyber-insurance renewals getting harder, and the social-engineering sublimit is one of the line items that reward attention.

If the worst happens, move fast. Call the bank to attempt a recall and file a complaint at ic3.gov the same day, as the FBI recommends; recovery odds shrink with every hour the money moves.

The bottom line

The costliest attack on American businesses last year asked for no exploit and no login. It asked for trust in a channel nobody verifies. The counter is a two-minute phone call before payment mechanics change, and it works just as well on the odd invoice from the vendor you genuinely use. If you would like a second set of eyes on your payment process, have that conversation with someone who does this for a living.

Reporting sources: FBI Internet Crime Complaint Center 2025 Annual Report and FBI press release, April 6, 2026; Opstream analysis; Insurance Business America, September 22, 2026; Fortra BEC Global Insights, June 2026; Risk & Insurance on the Coalition claims briefing, October 15, 2026; Certos, October 8, 2026; Grand Junction Daily Sentinel write-up; Reuters, September 25, 2026.