The FBI's 2025 figures show how large business email compromise is nationwide, and here is what that means for a law office that moves client money and what stops it.
The message looks ordinary. It seems to come from a client, a title company or opposing counsel, and it says payment details have changed. Someone busy and helpful acts on it, and by the time anyone notices, the money has moved.
What the FBI reports
Business email compromise (BEC) is a scam in which a criminal poses as someone you trust by email in order to redirect a payment. In its 2025 Annual Report, the FBI's Internet Crime Complaint Center (IC3) recorded 24,768 BEC complaints and $3,046,598,558 in reported losses. Its real estate category had 12,368 complaints and $275,110,419 in reported losses, and total reported losses to IC3 in 2025 were $20.877 billion.
These are nationwide complaint figures across all victims, and they are not law firm figures. Firms that handle property transactions will still recognize the pattern in the real estate numbers. What the figures tell you is scale: this is a large, ongoing problem for organizations of every kind, measured in billions.
Why a law office should care
In twenty years of auditing, I have found that this scam works because it fits the normal rhythm of a legal office: email from outside parties, money held for others, and a habit of answering quickly and politely. Staff expect instructions by email, clients expect fast replies, and the person who receives the message may not know the payment history. None of that is carelessness, and it is simply how the work runs. That is why the defense belongs in the process, so that no single person has to rely on instinct late on a busy afternoon.
What I would do first
No habit makes a firm immune, and good email filtering helps, but these steps make the scam much harder to complete. First, any change to payment instructions is confirmed by calling a number you already had on file, never one that appears in the email. Second, a second person approves every outgoing transfer and every change to who is being paid. Third, multi-factor authentication is switched on for email, and someone checks for mailbox forwarding rules that nobody remembers creating. Fourth, I would tell clients early, in plain language, how your firm will and will not communicate payment details, and give staff an easy way to flag a message that feels wrong without anyone being embarrassed for using it. Finally, I would decide in advance who calls the bank and who gathers the evidence if a payment has already gone to the wrong place. I would also write the payment-change rule in a single paragraph and hand it to everyone who touches money, from the person who opens the mail to the partner who signs off.
If you would like me to review how payment requests move through your firm, you can book a call with AssureRidge Cyber.