The FBI received 467,361 complaints about internet and cybercrime in 2019, which the agency estimates caused more than $3.5 billion in losses, according to its annual Internet Crime Report released today.
The FBI said that nearly half of the reported losses – about $1.77 billion – came from reports of BEC (Business Email Compromise) scams, also known as EAC (Email Account Compromise) crimes.
BEC/EAC is a sophisticated scam that targets businesses and individuals who make payments via bank transfers.
“BEC relies on the oldest trick of all: deception,” the FBI said in 2017, when it began receiving a higher number of reports of BEC scams.
A typical BEC scam occurs after hackers either compromise or spoof an email for a legitimate person/company. They use this email to send fake invoices or business agreements. These are sent to employees at the same company or to business partners. The idea is to trick the counterparties into depositing money into the wrong bank accounts.
BEC scams are popular because they are incredibly simple to execute and do not require advanced coding skills or complex malware. According to the FBI’s 2019 Internet Crime Report, BEC scams were by far the most damaging and effective type of cybercrime in 2019. Just 23,775 BEC victims accounted for $1.77 billion in losses, which is an average of $75,000 per complaint.
In comparison, phishing /smishing/vishing accounted for $500 in losses per complaint, while ransomware had losses of $4,400 per complaint.
“In 2019, IC3 monitored an increase in the number of BEC/EAC complaints related to payroll fund diversion,” the FBI said.
“In this type of scam, a company’s human resources or payroll department receives an email purporting to be from an employee asking to update account for the current pay period. The new direct deposit information is routed to a prepaid card account.”
Ransomware status
Another area of interest in the FBI's 2019 Cybercrime Report was ransomware. Last year, we saw a decrease in the number of complaints and an increase in the amount of damage caused by ransomware incidents.
This year, losses continued to rise, but the number of ransomware incidents decreased. Overall, the report's findings are surprising.
2019 was a year filled with news about various ransomware incidents. Private sector businesses, service providers, schools, and municipalities have been hit the hardest.
According to reports from Armor and Emsisoft, it was observed that many American businesses or organizations faced a ransomware incident. Emsisoft specifically reported that ransomware incidents faced in 2019:
- 113 state and municipal authorities and services.
- 764 healthcare providers.
- 89 universities, colleges and school complexes, with activities at up to 1,233 individual schools potentially affected.
The FBI report reflects what we have seen from independent third-party reports.
2018 was a year in which there was a shift in tactics from mass emails to individual attacks targeting a few, but high-profile targets, so consequently we saw an increase in ransomware attacks.
According to many experts, BEC and ransomware attacks are expected to continue to increase in 2020, as there are few measures in place to prevent cybercrime .
