--- title: "FBI: Businesses lost $3.1 billion in email ‘impersonation’ scams" description: Total losses caused by Business Email Compromise (BEC) have grown 13-fold since January in identified exposed losses, reaching over $3 billion, FBI says. image: https://businessinsights.bitdefender.com/hubfs/Blog_pics/iStock_000057720756_XXXLarge.jpg --- [![](https://businessinsights.bitdefender.com/hubfs/2021/09/logo-white.svg)](https://businessinsights.bitdefender.com/?hsLang=en-us) [![CONTACT AN EXPERT](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/341979/1d8885e9-1179-49b1-a5ec-9c75f5f670dd.png)](https://hubspot-cta-redirect-eu1-prod.s3.amazonaws.com/cta/redirect/341979/1d8885e9-1179-49b1-a5ec-9c75f5f670dd) - [For Home](https://www.bitdefender.com/solutions/) - [For Business](https://www.bitdefender.com/business/) - [Resources](https://www.bitdefender.com/business/resource-library.html) - [Webinars](https://www.bitdefender.com/business/webinars.html) # [BUSINESS INSIGHTS](https://businessinsights.bitdefender.com/?hsLang=en-us) [#Enterprise Security](https://businessinsights.bitdefender.com/topic/enterprise-security) [#Threat Research](https://businessinsights.bitdefender.com/topic/threat-research) By [**Razvan Muresan**](https://businessinsights.bitdefender.com/author/razvan-muresan) / Jun 24, 2016 # FBI: Businesses lost $3.1 billion in email ‘impersonation’ scams Share this [![Share on email](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/email-color.png)](mailto:?subject=Check%20out%20https://businessinsights.bitdefender.com/fbi-businesses-email-impersonation-scams&utm_medium=social&utm_source=email%20&body=Check%20out%20https://businessinsights.bitdefender.com/fbi-businesses-email-impersonation-scams&utm_medium=social&utm_source=email) [![Share on twitter](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/twitter-color.png)](https://twitter.com/intent/tweet?original_referer=https://businessinsights.bitdefender.com/fbi-businesses-email-impersonation-scams&utm_medium=social&utm_source=twitter&url=https://businessinsights.bitdefender.com/fbi-businesses-email-impersonation-scams&utm_medium=social&utm_source=twitter&source=tweetbutton&text=) [![Share on linkedin](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/linkedin-color.png)](http://www.linkedin.com/shareArticle?mini=true&url=https://businessinsights.bitdefender.com/fbi-businesses-email-impersonation-scams&utm_medium=social&utm_source=linkedin) [![Share on facebook](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/facebook-color.png)](http://www.facebook.com/share.php?u=https://businessinsights.bitdefender.com/fbi-businesses-email-impersonation-scams&utm_medium=social&utm_source=facebook) Total losses caused by Business Email Compromise (BEC), a sophisticated scam targeting businesses working with foreign suppliers and businesses that regularly pay by wire transfer, have grown 13-fold since January in identified exposed losses, reaching over $3 billion, [FBI says](https://www.ic3.gov/media/2016/160614.aspx#fn1). The scam has been reported by victims in all 50 states and in 100 countries. Reports indicate that fraudulent transfers have been sent to 79 countries, mostly to Asian banks in China and Hong Kong. The BEC scam claimed 22,143 domestic and international victims, and a combined exposed dollar loss of $3,086,250,090, which includes actual and attempted loss. Victims range from small businesses to large corporations and deal in a wide variety of goods and services, indicating a specific sector does not seem to be targeted, according to federal reports. “It is largely unknown how victims are selected; however, the subjects monitor and study their selected victims using social engineering techniques prior to initiating the BEC scam”, the FBI says. “The subjects are able to accurately identify the individuals and protocols necessary to perform wire transfers within a specific business environment. Victims may also first receive “phishing” e-mails requesting additional details regarding the business or individual being targeted (name, travel dates, etc.).” “Some individuals reported being a victim of various Scareware or Ransomware cyber intrusions immediately preceding a BEC incident. These intrusions can initially be facilitated through a phishing scam in which a victim receives an e-mail from a seemingly legitimate source that contains a malicious link. The victim clicks on the link, and it downloads malware, allowing the actor(s) unfettered access to the victim’s data, including passwords or financial account information.” The BEC scam is linked to other forms of fraud, including romance, lottery, employment and rental scams. According to the FBI, the victims are usually US-based (from October 2013 to May 2016, 14,032 from the total of 15,668 victims were US victims) and may be recruited as unwitting money mules. The mules receive the fraudulent funds in their personal accounts and are then directed by the subject to quickly transfer the funds to another bank account, usually outside the US. Upon direction, mules may open bank accounts or shell corporations to further the fraud scheme. The FBI has seen five frequent scenarios attackers use during a BEC scam. In the latest one, fraudulent requests are sent using a business executive’s compromised e-mail. The entity in the business organization responsible for W-2s or maintaining PII, such as the human resources department, bookkeeping, or auditing section, has frequently been identified as the targeted recipient of the fraudulent request for W-2 and/or PII. Some of these incidents are isolated and some occur before a fraudulent wire transfer request. Victims report they have fallen for this new BEC scenario, even if they were able to successfully identify and avoid the traditional BEC incident. The data theft scenario (Scenario 5) of the BEC first appeared just prior to the 2016 tax season. Other scenarios include a business working with a foreign supplier, a business \[executive\] receiving or initiating a request for a wire transfer, business contacts receiving fraudulent correspondence through compromised e-mail and business executive and attorney impersonation. Here is a short list of the FBI recommendations to avoid BEC scams: - Avoid free web-based e-mail accounts: Establish a company domain name and use it to establish company e-mail accounts in lieu of free, web-based accounts. - Be careful what is posted to social media and company websites, especially job duties/descriptions, hierarchal information and out of office details. - Be suspicious of requests for secrecy or pressure to take action quickly. - Consider additional IT and financial security procedures, including the implementation of a two-step verification process. For example - ### Explore More Topics - [Enterprise Security (751)](https://businessinsights.bitdefender.com/topic/enterprise-security) - [Threat Research (203)](https://businessinsights.bitdefender.com/topic/threat-research) - [SMB Security (178)](https://businessinsights.bitdefender.com/topic/smb-security) - [Cloud Security (174)](https://businessinsights.bitdefender.com/topic/cloud-security) - [Ransomware (167)](https://businessinsights.bitdefender.com/topic/ransomware) - [Privacy and Data Protection (138)](https://businessinsights.bitdefender.com/topic/privacy-and-data-protection) - [Cybersecurity Awareness (136)](https://businessinsights.bitdefender.com/topic/cybersecurity-awareness) - [Endpoint Protection & Management (130)](https://businessinsights.bitdefender.com/topic/endpoint-protection-management) - [Endpoint Detection and Response (125)](https://businessinsights.bitdefender.com/topic/endpoint-detection-and-response) - [Managed Detection and Response (120)](https://businessinsights.bitdefender.com/topic/managed-detection-and-response) - [Virtualization & Data Center Security (82)](https://businessinsights.bitdefender.com/topic/virtualization-data-center-security) - [Threat Intelligence (78)](https://businessinsights.bitdefender.com/topic/threat-intelligence) - [IT Compliance & Regulations (71)](https://businessinsights.bitdefender.com/topic/it-compliance-regulations) - [Bitdefender Threat Debrief (56)](https://businessinsights.bitdefender.com/topic/bitdefender-threat-debrief) - [Managed Service Providers (53)](https://businessinsights.bitdefender.com/topic/managed-service-providers) - [#Featured (52)](https://businessinsights.bitdefender.com/topic/featured) - [Advanced Persistent Threats (46)](https://businessinsights.bitdefender.com/topic/advanced-persistent-threats) - [Events (39)](https://businessinsights.bitdefender.com/topic/events) - [Independent Testing (20)](https://businessinsights.bitdefender.com/topic/independent-testing) - [Cybersecurity Advisory Services (9)](https://businessinsights.bitdefender.com/topic/cybersecurity-advisory-services) - [Podcast (5)](https://businessinsights.bitdefender.com/topic/podcast) - [top (2)](https://businessinsights.bitdefender.com/topic/top) See all topics ### Subscribe to Blog Updates ## Read more about this topic ### [A major global cyber attack could trigger losses of up to $121 billion](https://businessinsights.bitdefender.com/cost-global-cyber-attack-losses?hsLang=en-us) ### [Cybersecurity market to exceed $100 billion by 2020; financial losses caused by cybercrime to reach $2 trillion](https://businessinsights.bitdefender.com/cybersecurity-market-cybercrime-losses?hsLang=en-us) ### [FBI Issues Warning about BEC Scams Using Cloud-based Email Services](https://businessinsights.bitdefender.com/fbi-issues-warning-about-bec-scams-using-cloud-based-email-services?hsLang=en-us) ![bitdefender](https://businessinsights.bitdefender.com/hs-fs/file-2685110570-png/Bitdefender-Mar2015-Theme/Images/avatar_img_footer.png) ![bitdefender](https://businessinsights.bitdefender.com/hs-fs/file-2676149282-png/Bitdefender-Mar2015-Theme/Images/logo_white_footer.png) - [![https://twitter.com/Bitdefender_Ent](https://businessinsights.bitdefender.com/hs-fs/file-2658233851-png/Bitdefender-Mar2015-Theme/Images/ft_soc_tw.png?width=33&name=ft_soc_tw.png)](https://twitter.com/Bitdefender_Ent) - [![Linkedin-icon-300x300](https://businessinsights.bitdefender.com/hs-fs/hubfs/Bitdefender-Mar2015-Theme/Images/Linkedin-icon-300x300.png?width=33&name=Linkedin-icon-300x300.png)](https://www.linkedin.com/company/bitdefender-gravityzone-enterprise-security) - [![](https://businessinsights.bitdefender.com/hs-fs/file-2676149307-png/Bitdefender-Mar2015-Theme/Images/ft_soc_yt.png)](https://www.youtube.com/user/BitdefenderSecurity) - [Legal Terms](https://www.bitdefender.com/legal/) - [Privacy Policy](https://www.bitdefender.com/site/view/legal-privacy-policy-for-bitdefender-websites.html) - [EULA](https://www.bitdefender.com/site/view/legal-eula.html) - [Contact Us](https://www.bitdefender.com/business/contact.html) Copyright © 1997-2023 Bitdefender All rights reserved. ![](https://px.spiceworks.com/px/5rec) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Razvan Muresan", "url" : "https://businessinsights.bitdefender.com/author/razvan-muresan" }, "datePublished" : "2016-06-24T14:00:00.000Z", "headline" : "FBI: Businesses lost $3.1 billion in email ‘impersonation’ scams", "image" : [ "https://businessinsights.bitdefender.com/hubfs/Blog_pics/iStock_000057720756_XXXLarge.jpg" ], "mainEntityOfPage" : { "@id" : "https://businessinsights.bitdefender.com/fbi-businesses-email-impersonation-scams", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://businessinsights.bitdefender.com/hubfs/Bitdefender_Logo_Transparent-2.png" }, "name" : "Bitdefender" } } ```