BEC Remains FBI's Top Cybercrime Loss Category Despite Requiring No Hacking

Business Email Compromise (BEC) has consistently ranked as the largest category of reported cybercrime losses tracked by the FBI's Internet Crime Complaint Center, surpassing ransomware and credential theft. The attack requires no malware or encryption-breaking, instead exploiting the gap between emails that appear legitimate and those that actually are. BEC takes two main forms: account takeover, where attackers use stolen credentials to send from a real mailbox, and domain impersonation, where lookalike domains are registered to deceive recipients. Standard email authentication protocols like SPF, DKIM, and DMARC can block domain impersonation when properly enforced, but are powerless against messages sent from a genuinely compromised account. Common BEC schemes — including fake executive wire requests, vendor invoice fraud, and payroll diversion — all rely on patience and timing rather than any technical exploit.