Payment Fraud and BEC

Payment Fraud and Business Email Compromise
BEC losses (IC3)	2023: $2.95B; 2024: $2.77B; 2025: $3.05B
BEC complaints (IC3)	2024: 21,442; 2025: 24,768
All IC3 losses, 2025	$20.877B on 1,008,597 complaints
Recovery mechanism	FBI IC3 Recovery Asset Team / Financial Fraud Kill Chain (FFKC)
Related fraud types	Check fraud; romance/confidence; authorized push payment; vendor-impersonation; deepfake CEO fraud

Business email compromise (BEC) is a scam targeting businesses and individuals who regularly make wire or other payments, in which the criminal compromises or impersonates a trusted email account, supplier, executive, attorney or title company to induce a payment to an account the criminal controls.^[1] Payment fraud is the umbrella for losses arising from payment instruments and channels themselves: wires, ACH, checks, cards, peer-to-peer transfers and cryptocurrency. Unlike the internal frauds of the fraud tree, most of these schemes are committed by outsiders; the control failure is usually a verification step that was skipped. The FBI Internet Crime Complaint Center (IC3) 2025 report records BEC as the second-highest-loss category in cyber-enabled crime after investment fraud.^[1] This article stresses the examination techniques for reconstructing a payment fraud and recovering funds.

1 Scale and trends (FBI IC3)

IC3's 2025 Internet Crime Report records 1,008,597 complaints and $20.877 billion in reported losses, a 26% rise over 2024. Selected categories follow.^[1]

Category	2025 complaints	2025 loss	2024 loss	2023 loss
Investment	72,984	$8.65B	$6.57B	$4.57B
Business email compromise	24,768	$3.05B	$2.77B	$2.95B
Tech/customer support	47,794	$2.13B	—	—
Confidence/romance	23,159	$929M	$672M	$653M
Credit card/check fraud	18,774	$283M	$200M	$174M

Two points matter for interpretation. First, IC3 data are self-reported and include only complaints filed, so true totals are higher. Second, BEC losses are lumpy: a few large wires drive the annual total, so year-to-year changes should be read with caution. The report also records 22,364 complaints mentioning artificial intelligence, with adjusted losses above $893 million; businesses reported more than $30 million in BEC losses with a likely AI nexus, and victims reported over $19 million in romance-scam losses with a likely AI nexus.^[1]

2 Typologies

• Executive impersonation ("CEO fraud"): a spoofed or compromised executive account instructs finance to wire funds urgently and confidentially.
• Vendor email compromise / invoice redirection: the criminal, often after compromising a supplier's mailbox, sends genuine-looking invoices with changed bank details.
• Real-estate and escrow BEC: a buyer receives "wiring instructions" from a spoofed title company or attorney. IC3 describes a March 2025 case in which a senior citizen attempted to wire over $1.3 million to a fraudulent account before the Recovery Asset Team froze the funds.^[1]
• Payroll diversion: a fake employee request changes direct-deposit details.
• Account takeover (ATO): criminals take over bank or payment-platform logins and move funds through many transactions; IC3 notes ATO cases can involve 50 or more simultaneous ACH transfers to different banks.^[1]
• Deepfake-enabled impersonation: synthetic voice or video in place of email; see section 7.

3 Forensic techniques: email and identity

1. Preserve first. Take a forensic copy of the relevant mailboxes, mail-server logs and the originals of the fraudulent emails (as .eml or .msg with full headers), recording hash values and custodian; see Chain of Custody and Digital Forensics. Screenshots are not sufficient.
2. Analyze message headers. Read the Received chain from the bottom up to find the originating server; compare From, Reply-To, Return-Path and Message-ID domains; read Authentication-Results for SPF, DKIM and DMARC outcomes. A critical caution: a lookalike domain registered by the criminal will often pass its own SPF, DKIM and DMARC checks, because authentication only proves that the sender controls the domain it claims, not that the domain is the one you expect.
3. Detect lookalike domains. Compare sender domains to legitimate ones by edit distance, homoglyphs (the digit 1 for the letter l; Cyrillic characters), added hyphens and alternate top-level domains. Look up registration date and registrar with WHOIS/RDAP; domains registered days before the fraud are strong indicators. Use passive DNS and certificate-transparency logs to find sibling domains from the same infrastructure; see OSINT Tools.
4. Hunt for mailbox compromise. In Microsoft 365 or Google Workspace, review audit logs for: new inbox rules that forward, delete or move mail containing words such as "invoice," "payment" or "wire"; forwarding addresses; OAuth app consents; unusual sign-in IPs and impossible travel; legacy-protocol logins; and MFA changes. Mailbox rules that hide replies are a hallmark of a compromised account, as opposed to a mere spoof.
5. Reconstruct the timeline. Build a minute-by-minute schedule: first malicious login, rule creation, lure email, payment instruction, bank release, and discovery. Time zones must be normalized to UTC.
6. Verify identities out-of-band during the investigation: call known numbers (not those in the email), and interview the payer's employees (Interviewing) to establish who approved, what verification was attempted, and what policy was in force.

4 Forensic techniques: payment tracing and recall

Speed is the primary variable. The victim should contact its bank immediately, request a wire recall and any necessary indemnification documents, and file an IC3 complaint with full transaction details. The IC3 Recovery Asset Team (RAT), established in 2018, streamlines communications between financial institutions and FBI field offices to freeze funds through the Financial Fraud Kill Chain (FFKC). In 2025 it handled 3,900 incidents involving $1.164 billion in attempted theft and froze about $679 million, a 58% success rate; domestic incidents numbered 3,574 ($507 million frozen) and international 326 ($172 million frozen). For the 655 incidents involving critical-infrastructure organizations, $146.6 million of $261.5 million (56%) was frozen.^[1] IC3 also describes a case in which an Oregon city government office lost over $6 million in a BEC attack and the originating bank was able to issue a recall after the recipient account had been flagged through an earlier FFKC freeze.^[1]

4.1 Following the funds

1. Obtain the wire confirmation: originator and beneficiary account numbers, routing numbers, Fedwire IMAD/OMAD or SWIFT UETR/reference, and timestamps.
2. Send preservation letters and subpoenas or legal process to the beneficiary bank for account-opening documents, signature cards, IDs, KYC data, IP logs from online banking, and statements showing onward transfers (the "second hop").
3. Build a flow chart of each hop: amount, date, destination, and what remains. Apply the same tracing rules used in Asset Tracing. Recipients are frequently money mules or victims of other scams (the FFKC case above found the recipient account owner had been told to send $1 million to a Hong Kong account in an overpayment scam).
4. For funds converted to cryptocurrency, follow on-chain with Cryptocurrency Tracing to an exchange that can freeze.
5. Pool complaints sharing the same beneficiary account or wallet: multiple victims strengthen probable cause and recovery claims (see Money Laundering).

4.2 Bank-side analytics

Financial institutions screen for BEC and mule activity with: (a) beneficiary-change analytics, flagging a payment to a vendor within a short window after a bank-detail change; (b) first-time payee and amount outlier tests; (c) name-to-account mismatch checks (confirmation-of-payee style); (d) pass-through ratio for recipient accounts (outflows divided by inflows within 24–48 hours); (e) velocity and fan-in patterns, where many unrelated payers send to one new account. See Fraud Detection Analytics and AI Fraud Detection Platforms.

5 Check fraud examination

Check fraud remains significant despite digital payments. FinCEN's alert FIN-2023-Alert003 (February 27, 2023) described a nationwide surge in mail-theft-related check fraud; in the six months to August 31, 2023 FinCEN received 15,417 Bank Secrecy Act reports on such activity associated with more than $688 million, and asked institutions to use the key term "FIN-2023-MAILTHEFT" in suspicious activity reports.^[2] IC3's 2025 credit-card/check category shows 18,774 complaints and $282.7 million.^[1]

Technique	What the examiner does	Evidence produced
Image examination	Compare the presented item with the account's signature card, prior checks, paper stock; look for washing (chemical alteration of payee and amount), overwritten fields, mismatched ink and fonts	Document-examiner opinion; see Document Examination
MICR and routing data	Verify the MICR line, check number sequence, and routing numbers; test for counterfeit checks with valid account numbers but out-of-sequence numbers	Exception report showing number gaps and duplicates
Positive pay / payee positive pay	Match presented checks to the issued-check file by number, amount and payee	Unmatched-item report, issue file timestamps
Remote deposit review	Detect duplicate deposits of the same check at different banks or through mobile and teller channels; compare deposit device IDs	Duplicate presentment analysis
Kiting analysis	Chart deposits and withdrawals between two or more accounts to find circular check float	Float schedule; ratio of checks drawn on affiliated accounts
Endorsement review	Study back-of-check endorsements for chain of custody and deposit-account owner mismatches	Endorsement chain exhibit

6 Worked examples

Illustrative figures; domain names are fictitious.

Example A: lookalike domain. The company's supplier domain is example-corp.com. The fraud emails come from ap@examp1e-corp.com (digit 1 replacing the letter l). Edit distance is 1 (one substitution). WHOIS shows registration 6 days before the first message, while the real domain has been registered for 14 years. Headers show spf=pass smtp.mailfrom=examp1e-corp.com and dmarc=pass header.from=examp1e-corp.com. The passes confirm only that the criminal controls the lookalike. The examiner reports that the sender was not the supplier, which defeats any argument that the payer's email-security tools should have blocked an "authenticated" message. A reply-to difference and a first-time sender flag are additional indicators.

Example B: vendor-change analytics. The accounts-payable system's change log shows a bank-detail change for Vendor V on May 3, submitted by an email request, with no callback recorded. The next payment run on May 8 pays Vendor V $184,300, versus a historical median payment of $41,000, so the payment is 4.5 times the median ($184,300 / $41,000 = 4.5) and the first to the new account. Rule: flag any payment released within 10 days of a bank-detail change that exceeds 2 times the vendor's median. This case triggers on both conditions. On May 9 the real vendor asks about its unpaid invoice; the loss is $184,300 and the clock on a recall request has already run for one day.

Example C: mule pass-through. Recipient account R receives three transfers totaling $18,500 from three unrelated payers over two days and sends out $17,950 within 24 hours of the last credit. Pass-through ratio = 17,950 / 18,500 = 97%; retained balance $550 (3%). The account was opened 11 days earlier with a deposit of $100. These indicators justify a freeze request and a review of other inflows to R for additional victims.

Example D: check kiting. Accounts A (Bank 1) and B (Bank 2) belong to the same owner. On day 1 a $50,000 check drawn on B is deposited to A; before it clears, on day 2 a $55,000 check drawn on A is deposited to B; day 3, $60,000 on B to A; day 4, $65,000 on A to B; and so on with each cycle $5,000 larger. By the sixth cycle the outstanding float is a $75,000 check. If 100% of deposits in the period are checks drawn on the owner's other account, and no external deposits fund either account, ledger balances are fictitious. The examiner charts deposits against collected balances by day; the pattern of rising, alternating amounts is the evidentiary signature.

7 Romance scams, APP fraud and deepfakes

Romance (confidence) scams. IC3 recorded 23,159 complaints and $929 million in 2025. The offender builds a relationship with a fabricated persona, then solicits funds for emergencies, travel or investments. Examination: reverse-image search of profile photos; metadata and account-creation analysis of social profiles; message-language analysis; payment-trail tracing to the beneficiary accounts or crypto wallets; and a victim interview that preserves the complete chat history. Many romance scams blend into investment fraud (see Ponzi and Investment Fraud) and target older adults (Elder Financial Exploitation).

Authorized push payment (APP) fraud. In APP fraud the victim themselves initiates a real payment but is deceived about its purpose or recipient. In the United Kingdom, from October 7, 2024 the Payment Systems Regulator's mandatory reimbursement requirement applies to faster payments: sending firms must reimburse in-scope victims within five business days (with a possible "stop the clock" investigation pause), reimbursement is capped at £85,000 per claim, and the cost is split 50:50 between the sending and receiving firms.^[3] In the United States, Regulation E (12 C.F.R. part 1005) protects against unauthorized electronic fund transfers; a transfer the consumer was tricked into authorizing is generally treated differently, which is why recall and freeze mechanisms matter so much.

Deepfake-enabled CEO fraud. In the best-known reported case, Arup confirmed in 2024 that a Hong Kong employee was deceived by a video call in which fake versions of colleagues appeared, resulting in 15 transfers totaling HK$200 million (about US$25 million).^[4] Forensic response: secure the meeting recording and platform logs; extract the participants' account identifiers and join IP addresses; analyze audio and video for synthesis artifacts and compression anomalies (see Video Forensics); and trace the payments as in section 4. Preventive controls are procedural, since detection of synthetic media is unreliable: out-of-band callback to a known number, dual authorization for payments above a threshold, pre-agreed code words for executives, and a rule that no video or voice instruction alone can change payee details. See Emerging Trends.

8 Red flags and controls

• Urgent, confidential payment requests that bypass normal approval; requests to change bank details by email.
• Sender domain subtly different from the correct one; reply-to that differs from sender.
• First-time payee, new account in a different bank or country, or payee name that does not match the account.
• Mailbox forwarding or deletion rules; sign-ins from unusual locations.
• Checks presented out of sequence; payee or amount altered; duplicate deposits.
• Controls: verified callback to a number on file; dual approval; vendor-master change control with independent verification; positive pay; DMARC enforcement and external-sender banners; MFA; immediate incident playbook (call bank, request recall, file IC3 complaint, preserve logs).

General warning signs are collected in Red Flags; legal reporting duties tie to AML Law and the AML Statutory Framework; agencies are described in Federal Enforcement Agencies.

See also: Ponzi and Investment Fraud, Healthcare and Insurance Fraud, Digital Forensics, Cryptocurrency Tracing.

References

1. FBI Internet Crime Complaint Center. 2025 Internet Crime Report. ic3.gov
2. FinCEN. "FinCEN Alert on Nationwide Surge in Mail Theft-Related Check Fraud Schemes Targeting the U.S. Mail," FIN-2023-Alert003, Feb. 27, 2023. fincen.gov
3. Payment Systems Regulator (UK). APP fraud mandatory reimbursement requirement, effective Oct. 7, 2024 (summarized by Bird & Bird).
4. CNN Business. "British engineering giant Arup revealed as $25 million deepfake scam victim," May 16, 2024. abc17news.com (syndicated)
5. 12 C.F.R. part 1005 (Regulation E); Uniform Commercial Code Articles 3 and 4; Electronic Fund Transfer Act, 15 U.S.C. §1693 et seq.