Empirical Analysis of Losses from Business-Email Compromise

We examine approximately nine months of data on losses from business email compromise (BEC) reported to the FBI’s Internet Crime Complaint Center in 2017. We describe the empirically observed loss distribution. We study differences in the amounts attempted stolen when the attacks were successful or not. We show that money stolen and transmitted internationally is less likely to be recovered. We also find, somewhat surprisingly, that illicit transfers to in-state banks are also more likely to succeed. Finally, we study state-level differences among BEC target selection and asset recovery.