Run it with less chaos · Every business
What Scams and Cyberattacks Cost Small Businesses
Victims reported $20.9 billion in internet crime losses to the FBI in 2025, and the most expensive scheme aimed at businesses, a fake request to redirect a payment, averaged about $123,000 per complaint.
At a glance
- The FBI's Internet Crime Complaint Center received 1,008,597 complaints in 2025 with reported losses of $20.877 billion, an average of $20,699 per complaint.
- Business email compromise, in which a criminal poses as a supplier, client or colleague to redirect a payment, accounted for $3.05 billion of those losses across 24,768 complaints, or about $123,000 each.
- For an illustrative business with $40,000 a month in outflows, a single redirected $8,000 payment would use up about six days of spending and nearly a quarter of a typical small firm's cash cushion.
The number and where it comes from
The FBI's Internet Crime Complaint Center (IC3) publishes an annual count of the complaints it receives from individuals and businesses, along with the losses they report. Its 2025 report counted just over a million complaints and $20.877 billion in losses; investment fraud was the largest category at $8.65 billion, much of it aimed at individuals, while the schemes that most often reach a small business's inbox or front desk made up several billion more.
Business email compromise stands out because each case is large. The IC3 counted 24,768 complaints with $3,046,598,558 in losses, about $123,000 per complaint, and complaints have risen from 21,442 in 2024. A typical version for a service business is an email that appears to come from a supplier or subcontractor with new bank details, or from a customer's real estate agent or property manager asking where to send a deposit.
Ransomware shows a small loss figure in the IC3 count, $32.3 million across 3,611 complaints, because the count reflects what complainants reported. Verizon's 2025 Data Breach Investigations Report, based on more than 22,000 security incidents and 12,195 confirmed breaches, found ransomware present in 88% of breaches at smaller organizations and a median ransom payment of $115,000, while 64% of victims declined to pay, up from 50% two years earlier.
Scams also reach a business's customers under its name. The Federal Trade Commission reported that consumers lost nearly $1 billion in 2025 to people impersonating businesses, out of $15.9 billion in total reported fraud losses, which is one reason to tell customers plainly how your business will and won't ask for payment.
The calculation
The $123,000 average pools losses at organizations of every size, so a small business learns more by modeling one redirected invoice of its own size against the cash it keeps on hand. The JPMorgan Chase Institute, studying 597,000 small businesses, found that the median firm held 27 days of cash buffer, and a quarter held fewer than 13.
| Monthly outflows (rent, payroll, supplies) (Assumption) | $40,000 |
|---|---|
| Daily outflows (Calculated ($40,000 × 12 ÷ 365)) | $1,315 |
| Cash buffer days, median small business (JPMorgan Chase Institute) | 27 |
| Cash cushion (Calculated (27 × $1,315)) | $35,507 |
| Payment redirected by a fake email (Assumption) | $8,000 |
| Days of spending lost (Calculated ($8,000 ÷ $1,315)) | About 6 |
| Share of the cushion lost (Calculated ($8,000 ÷ $35,507)) | 23% |
Illustrative example; replace every assumption with your own numbers.
Speed after the fact matters too. The FBI's Recovery Asset Team, which works with banks to freeze funds when a fraudulent transfer is reported quickly, reported a 58% success rate in 2025, freezing $679 million of $1.16 billion in attempted theft. Reporting a suspicious transfer to your bank and at ic3.gov the same day gives the money the best chance of being stopped.
How you compare
- Your cushion: the median small business in the JPMorgan Chase Institute study held 27 days of cash, and repair and maintenance businesses held 18; divide your bank balance by your average daily spending to find yours.
- Your payment habit: count how many payments last month went out on instructions received only by email; each is a case where a phone call to a number you already have would have confirmed it.
- Your sign-ins: list the accounts that hold money or customer data and note which have two-factor sign-in turned on; the security checklist in our related reading covers the rest.
General information, not legal or financial advice; talk to a licensed professional about your situation.
Sources
- Federal Bureau of Investigation, Internet Crime Complaint Center. 2025 Internet Crime Report. 2026. 1,008,597 complaints.
- Verizon. 2025 Data Breach Investigations Report. 2025. More than 22,000 incidents, 12,195 confirmed breaches.
- Federal Trade Commission. FTC Data Show People Reported Losing $3.5 Billion to Imposter Scams in 2025. June 2026.
- Federal Trade Commission. FTC Testifies Before Joint Economic Committee on Agency's Efforts to Combat Fraud. March 2026.
- JPMorgan Chase Institute. Cash is King: Flows, Balances, and Buffer Days. 2016. 597,000 small businesses.
Related reading: Customer Data Privacy Basics for Small Service Businesses · Cash Flow, Not Sales, Is Why Many Small Businesses Fail · The 30-Minute Weekly Money Check: Invoices, Bills, Tax Savings and Payroll · The Ten-Minute Security Checklist: Passwords, Two-Factor and Backups
Work with osNOVA on payment and sign-in habits that protect your cash
We help owner-run service businesses set the simple habits that keep money and customer data safe, such as confirming payment changes by phone, turning on two-factor sign-in and checking backups, so the cash you earn stays available for payroll, supplies and steadier weeks.
Email hello@osnovaops.com about your business
Or leave your email and we will reach out
Tell us what kind of business you run and what you want more of.
Not ready to talk? osNOVA runs free live events for owners.