Payment Fraud Index: United States 2026

Yes, and the FBI IC3's 2025 data makes the scale visible for the first time. More than 22,000 AI-related fraud complaints were filed in 2025, with US$893 million in associated losses. Within that, over US$30 million was lost specifically to BEC scams that used AI. The concern for finance teams is that AI removes the low-quality signals that previously made fraudulent payment requests easier to spot, including poor grammar, unfamiliar formatting and implausible sender details. Controls that relied on human recognition of those signals need to be supplemented with independent verification.

In 2025, total losses reported to the FBI's IC3 reached US$20.877 billion, up 26% from US$16.6 billion in 2024. That figure covers all cybercrime categories, of which 85% were cyber-enabled fraud. BEC was the second-largest loss category at US$3.05 billion, behind investment fraud at US$8.65 billion. These figures represent reported losses only; actual losses are likely higher given known under-reporting.

The FBI's IC3 received 1,008,597 complaints in 2025, averaging around 3,000 per day. That is the first time annual complaint volume has crossed one million. Total reported losses reached US$20.877 billion, up 26% on 2024. The IC3 has tracked internet crime since 2000, and the 2025 figures represent the highest single-year loss total in its history. These figures cover reported losses only. The IC3 notes that internet crime is significantly under-reported, meaning actual losses are likely higher.

AI tools are being used to generate convincing phishing emails, clone executive voices for phone-based fraud, and produce deepfake video used in verification calls. The FBI IC3 recorded more than 22,000 AI-related fraud complaints in 2025, with US$893 million in associated losses, including over US$30 million lost specifically to AI-assisted BEC. The concern for finance teams is that AI lowers the cost of producing a convincing impersonation, removing the grammatical and formatting errors that previously flagged suspicious payment requests.

Preventing BEC requires an independent verification step that sits outside the email channel the attacker has compromised. The most effective controls are: confirming bank account changes through a verified phone number on file (not contact details supplied in the request), verifying vendor payment details against an authoritative third-party source before processing, and requiring dual approval for any payment above a defined threshold. Eftsure's payment verification platform automates the bank account verification step, checking supplier details against authoritative data sources before payment is released.