The $21 Billion Receipt: What the FBI's Latest Cybercrime Numbers Say About Small Business Risk

The FBI’s Internet Crime Complaint Center (IC3) recorded nearly $21 billion in reported cybercrime losses in 2025, a 26% increase from the $16.6 billion reported the year before. Complaints surpassed one million, up from 859,000.

Those national totals include individuals and organizations of all sizes. They are not a forecast of what a small business will lose. But the report points to a risk that owners should examine closely: money and data can be lost because someone trusts a convincing message and acts under pressure.

For small businesses, that makes phishing and business email compromise (BEC) important to address. These schemes can succeed without an attacker exploiting a technical flaw. A message that appears to come from a vendor, executive, customer, bank, or IT provider may be enough to prompt a payment or disclosure.

The FBI’s IC3 report findings, summarized by BleepingComputer, make the scale clear. The practical question for a business owner is what happens inside your own company when a request looks urgent and familiar.

What stands out in the numbers

Phishing was the most frequently reported complaint type, at about 191,000 complaints. The FBI also recorded about 24,700 business email compromise complaints and 3,900 data breach complaints. Meanwhile, cyber-enabled fraud appeared in approximately 453,000 complaints and accounted for $17.7 billion in reported losses.

That last figure needs context. The fraud total covers many kinds of victims and scams, not just small businesses or BEC. Likewise, the complaint counts do not tell us how many small businesses were targeted or how much they lost. But together, they underline why a company’s payment and communication processes deserve attention alongside its technical safeguards.

The report also includes a dedicated section on AI-related scams for the first time: about 22,300 complaints and $893 million in reported losses. The FBI describes schemes involving voice cloning, fake profiles, forged documents, and deepfake videos. That matters because familiar cues, including a recognizable voice, may no longer be enough to verify a request.

The FBI’s press release on cryptocurrency and AI scams recommends not rushing in response to urgency or pressure and using every available means to confirm a communication before sending money or data. For a business, that guidance works best as a written process, not a reminder to “be careful.”

Identify: Find the requests that can move money or data

Start by mapping where your business acts on a request received by email, text, or phone. Consider:

• A vendor asking you to change bank or payment details
• A request to change payroll or direct deposit instructions
• An urgent payment, wire transfer, or gift-card request supposedly from an executive
• A client email asking you to redirect a payment
• A caller claiming to be from your bank, IT provider, or another trusted organization

For each type of request, identify who receives it and who has authority to act. If one person can receive a message, change a payment destination, and approve the transfer, that is a process worth reviewing.

A short conversation with the people who handle invoices, payroll, and customer payments can reveal where the rules are unclear. Ask what they would do if a familiar contact requested a last-minute change, and what they would need before acting.

Quantify: Put the national figures in the right context

The IC3 figures are reported losses, not a complete count of all incidents. Some victims do not report, and the national data combines individuals and organizations. Treat the totals as an indication of the scale and nature of reported cybercrime, not as a precise forecast for your company or your local market.

Then bring the question closer to home: What is the largest single payment your business could be tricked into making, and who besides you could authorize it?

Consider the likely business impact as well as the amount. A fraudulent payment can affect cash flow, delay payroll or vendor payments, consume management time, and strain important relationships. If customer or employee information is involved, the impact may extend to notification duties and trust.

The goal is not to assume every unusual email is a crisis. It is to understand which decisions carry the greatest consequences and whether your current approval steps are strong enough for them.

Mitigate: Make verification part of the transaction

The FBI’s advice to slow down and verify is straightforward. Turning it into a repeatable business practice is the harder, more valuable step. Set written rules for requests involving payments, banking details, payroll, sensitive data, or changes to account access.

• Call back using a trusted number. Use a phone number from your own records, such as a previously verified contact or official account statement. Do not use a number supplied in the message you are checking.
• Require two-person approval for payment changes. A second authorized person should independently confirm any new or changed payment instructions before money moves.
• Make the rule apply even when the request is urgent. “The vendor says it must be done today” is precisely when the verification step matters. No one should be pressured into bypassing it.
• Verify through a separate channel. If a request arrives by email, confirm by calling a known number or using another established contact method. Do not rely on a reply to the original message.
• Assume voices and video can be imitated. A familiar voice or a convincing video call should not override payment controls. Follow the same independent verification and approval steps.
• Make reporting safe and immediate. Staff should know they can report a suspicious message even if they clicked, replied, shared information, or sent money. A quick report gives the business and its bank a chance to respond.

The FBI says it initiated 3,900 Financial Fraud Kill Chain interventions and froze $679 million of the $1.16 billion targeted. That is not a guarantee that funds can be recovered. It does show why speed matters after a suspected payment scam: notify your bank and the appropriate authorities promptly, and preserve the message and transaction details.

Monitor: Check whether the process works in practice

A written rule is only useful if employees can find it and follow it under pressure. Review which employees received suspicious messages this quarter, whether anyone encountered a payment-change request, and whether staff knew how to verify and report it.

Track near-misses as useful information, not as a reason to blame the person who raised the alert. A reported attempt can show where the process is working and where a rule needs clarification. Revisit your procedures whenever a new employee takes on payment responsibilities or your business adds a payment channel.

Keep the verification instructions somewhere staff can quickly access them. A short checklist is often more useful in the moment than a long policy document.

Make the next payment harder to divert

The FBI’s latest figures are national, but the underlying business question is local and practical: Can someone in your company verify a high-impact request independently, without being rushed into an exception?

B&R Computers’ resource hub offers practical materials for business owners reviewing their cyber risk. For help evaluating how your current safeguards and procedures fit your business, request a free Business Review / Strategy Session at businessrisk.bandrcomputers.com.