The FBI's Internet Crime Complaint Center published its 2025 report earlier this year. Two numbers from it belong on your wall.
| Measure | Complaints | Losses |
|---|---|---|
| Real estate fraud | 12,368 | $275.1M |
| Business email compromise | 24,768 | $3.046B — second across all internet crime |
| Complaints referencing AI | 22,000+ | $893M+ |
| All cyber-enabled crime | 1,008,597 | $20.8B, up 26% YoY |
86% of reported BEC transactions moved by wire transfer or ACH. That is the number that decides outcomes. Wire and ACH are fast and largely unrecoverable by the time anybody notices, which is usually at the table.
The report includes a Missouri senior closing on a property who received a compromised email from what read as the title company, carrying wire instructions for more than $1.3 million.
What changed, and why the standard advice quietly stopped working
For a decade the guidance was: look for red flags. Bad grammar. Stilted phrasing. A display name that doesn't match the domain. Train the staff to notice.
The IC3 logged more than 22,000 complaints referencing AI in 2025, with adjusted losses over $893 million. The grammar is fixed. The tone matches the sender's real emails, because the attacker has been sitting in the thread reading them. The signature block is right. The reply lands mid-conversation, on the day funds are due.
Nobody can spot that. Detection was never really a skill — it was luck against sloppy attackers, and that luck has been automated away.
What still works is dull enough that most shops never wrote it down
One required step: an out-of-band verbal confirmation of wire instructions — a phone call, to a number obtained before the transaction began, never a number that appears in the email. No exceptions for repeat parties. No exceptions for Friday.
Attorney review means instructions routinely travel across four parties — agent, buyer's attorney, title, lender — and each handoff is a fresh place to insert a lookalike thread. More parties, more surface, and the funds move out of a trust account.
Almost every operator I speak to tells me some version of "we always call."
Very few can tell me where that step is written, who owns it when the person who always calls is on vacation, or what the rule is when instructions change mid-file.
"We always call" is a habit. A habit held by one careful person is not a control — it is a control with a single point of failure and no audit trail.
The test. Twenty minutes.
Take your last three closings. For each one, answer:
- Who sent the final wire instructions, and through what channel?
- Who verified them — by calling what number, obtained from where?
- Where is that verification recorded?
If the answers vary file to file, you don't have a process. You have three people being careful, which works right up until the day one of them is rushed.
That check costs you an afternoon and no money at all. Run it before you think about anything else on this list.
Sources
- FBI Internet Crime Complaint Center, 2025 Internet Crime Report. 1,008,597 complaints; reported losses above $20.8 billion, up 26% year over year. Report (PDF).
- Real estate fraud: 12,368 complaints and $275,110,419 in losses, 2025 — up from $173,586,820 (2024) and $145,243,348 (2023). Verified against the IC3 report itself; coverage.
- Business email compromise: $3.04 billion across 24,768 complaints, second in total losses across all categories; 86% of reported BEC transactions by wire transfer or ACH; the $1.3M Missouri closing incident. Analysis.
- AI-referencing complaints: 22,000+, with adjusted losses exceeding $893 million. Analysis.
- Three-year BEC losses approaching $8.5 billion. Nacha.