Business email compromise drains an average of $129,000 per incident — yet most organisations still treat it as an IT problem rather than a financial emergency. Attackers don’t hack systems; they hack trust, impersonating executives and vendors to silently redirect wire transfers before anyone notices. The difference between recovering stolen funds and writing them off permanently comes down to what your team does in the first 60 minutes. Most get it wrong.
Why BEC Attacks Drain £129,000 Per Incident
Business email compromise drained an average of $129,000 per incident in 2024, a 3% increase from the $125,612 average recorded in 2022.
Total reported losses reached $3.05 billion across 24,768 complaints in 2025. These figures confirm corporate financial fraud through compromised email channels as a serious and growing financial threat.
Wire transfer fraud consistently ranks as the highest-value cybercrime category tracked by the FBI. Single attacks frequently target multiple payment authorisations, compounding total losses beyond initial estimates.
Recovery prospects depend heavily on response timing. Funds become virtually unrecoverable after 72 hours. Organisations that act immediately preserve meaningful recovery options. Those that delay rarely regain full losses.
Mid-market and enterprise organisations absorb disproportionately higher average losses, making structured incident response a financial necessity rather than an optional precaution. Rapid forensic rapid deployment secures volatile electronic information and preserves critical evidence before it is destroyed or overwritten during the chaos of an active incident. BEC attacks are extensively researched operations, with criminals spending weeks or months studying company communications, payment workflows, and vendor relationships before initiating contact.
Contain the Breach in Your First 60 Minutes
Within the first 60 minutes of detecting a business email compromise, every action taken directly determines whether stolen funds are recoverable. Wire recall probability drops sharply after 24 hours, making immediate response critical. Three priorities govern this window.
Within the first 60 minutes of a business email compromise, every action taken determines whether stolen funds are recoverable.
- Stop payment and contact financial institution — Call the bank immediately using a verified number to request wire recall through the fraud department. Document the bank case number with exact timestamps.
- Secure affected email accounts — Revoke all active sessions and reset passwords with mandatory MFA re-registration. Disable suspicious forwarding rules and OAuth grants before full restoration.
- Pause all financial transactions — Halt invoice processing, vendor-master changes, and disbursement workflows immediately. A qualified digital forensics team can conduct mobile device forensics to extract critical evidence from company smartphones that may have been used to intercept or redirect financial communications.
These three actions, executed in sequence, establish containment and preserve recovery options. Assign one incident owner with the authority to escalate directly to the CFO, CIO, general counsel, insurer, bank, and any external responders as the situation develops.
Recover Your Stolen Wire Transfer Before the 72-Hour Window Closes
Containment buys time, but recovering stolen funds demands immediate escalation through the right financial and legal channels. Corporate email fraud victims operate within a precise 72-hour recovery window before fragmented funds become untraceable.
Call the bank’s dedicated fraud line within the first hour. Provide the wire confirmation number, recipient account details, and transaction timestamp. Request an immediate wire recall.
File an IC3 complaint at ic3.gov within 72 hours. Spoofed email tracing data, including fraudulent email headers and recipient account numbers, strengthens the FBI Recovery Asset Team’s freeze request.
Four conditions must be met for intervention:
- Minimum $50,000 wire transfer
- Transaction within 72 hours
- US correspondent bank traceability
- Verified IC3 complaint filed
Every hour matters. Once funds leave the initial receiving account, they are rapidly distributed across mule accounts or converted to cryptocurrency, compressing the recovery window to near zero. Engaging electronic discovery services early in the investigation preserves critical email metadata, fraudulent communication patterns, and chain of custody documentation required to support financial recovery and regulatory compliance proceedings.
Use Email Headers and Audit Logs to Build Your FBI Case
Email headers and audit logs form the technical backbone of any FBI Internet Crime Complaint Center filing following a business email compromise. These technical artefacts establish chain of custody, authenticate communications, and reconstruct attacker behaviour with precision. A BEC investigation demands immediate log extraction before evidence degrades. Retention windows vary by licence tier, with E3 environments storing 90 days of logs and E5 environments retaining 365 days.
Three critical evidence categories investigators secure:
- Email headers — reveal transmission path, spoofing indicators, and whether messages originated from legitimate or look-alike domains
- Unified Audit Log — captures 76+ Office 365 event categories, documenting every mailbox action during the compromise window
- Forwarding and inbox rules — demonstrate financial intent through keyword-targeted filters, providing highly probative identity theft forensics evidence
Investigators who control this evidence early control the investigation’s outcome. Timestamp data, IP addresses, and geolocation anomalies collectively build a persuasive, court-ready case file. Engaging an independent forensic laboratory ensures evidence is processed using write-blocking hardware during acquisition, eliminating procedural vulnerabilities that could invalidate recovered data in legal proceedings.
Block the Next BEC Attack with MFA, DMARC, and Out-of-Band Verification
After securing forensic evidence, organisations must implement layered technical controls to prevent attackers from repeating a successful business email compromise. Multi-factor authentication (#MultiFactorAuthentication) blocks unauthorised mailbox access even when credentials are stolen. Legacy authentication protocols must be disabled, as attackers exploit them to bypass #AccountSecurity controls entirely.
#DMARC rollout at p=reject eliminates domain spoofing, the foundational technique in most BEC attacks. #DomainAuthentication requires SPF and DKIM alignment before enforcing reject policy. Organisations should progress from p=none monitoring through p=quarantine before reaching full #SPFAlignment enforcement.
Out-of-band verification adds a great result-producing final control layer. Any payment instruction changes received by email must be confirmed by phone using independently verified numbers. This single procedure circumvents purely email-based attack vectors with the highest confidence. Filing a complaint at ic3.gov within the first 24 hours gives the FBI Recovery Asset Team the best chance to intercept funds before conversion. Conducting digital risk assessments across network architectures further strengthens defences by identifying structural weaknesses that attackers may exploit before, during, or after a BEC incident.
