Eighty percent of organizations were targeted by attempted or actual payments fraud in recent reporting periods, marking a persistent threat landscape across corporate finance and accounts payable departments. While paper check fraud continues to defy expectations as the most frequently targeted payment method at 65% of affected organizations, digital payment channels—including ACH credits and wire transfers—are under sustained attack from sophisticated Business Email Compromise (BEC) schemes. The FBI Internet Crime Complaint Center (IC3) recorded over $2.9 billion in adjusted losses from BEC schemes in a single year, while the Association of Certified Fraud Examiners (ACFE) notes billing fraud causes a median enterprise loss of $100,000 per occurrence. The figures below come from primary disclosures published by the Association for Financial Professionals (AFP), the FBI Internet Crime Complaint Center (IC3), the Association of Certified Fraud Examiners (ACFE), and J.P. Morgan.
TL;DR
- 80% of organizations reported attempted or actual payments fraud (AFP)
- Paper checks remain the payment method most targeted by fraud at 65% of organizations (AFP)
- Wire transfers were targeted at 39% of victimized organizations (AFP)
- ACH credits and ACH debits targeted 33% and 20% of organizations respectively (AFP)
- Business Email Compromise (BEC) accounted for fraud attempts at 71% of victim organizations (AFP)
- FBI IC3 registered $2.9 billion in annual adjusted losses from 21,489 BEC complaints (FBI IC3)
- Accounts payable billing schemes cause a median loss of $100,000 per incident (ACFE)
- 41% of organizations were unable to recover any stolen funds from payment fraud incidents (AFP)
- Financial institutions filed over 680,000 check fraud Suspicious Activity Reports (FinCEN)
- Dual authorization and multi-person payment approvals are deployed by 76% of corporate treasuries (AFP)
- Corporate credit and debit cards experienced fraud attempts at 36% of surveyed firms (AFP)
- Impersonation of vendors or suppliers represents 58% of all Business Email Compromise scams (AFP)
- Payment fraud incidents take an average of 18 months to detect when committed internally (ACFE)
1. Prevalence and Primary Payment Attack Vectors
Corporate treasury departments face a broad threat environment where legacy payment instruments and modern digital rails are attacked simultaneously. Despite decades of digital migration, paper checks maintain the highest vulnerability rate among corporate payment rails due to physical transit risks. Wire transfers and ACH transactions represent fewer total incident counts but carry significantly higher per-transaction financial exposure.
| Metric | Value | Source |
|---|---|---|
| Attempted or actual payment fraud incidence | 80% of organizations | AFP |
| Paper checks targeted by fraud | 65% of organizations | AFP |
| Wire transfers targeted | 39% of organizations | AFP |
| Corporate credit or debit cards targeted | 36% of organizations | AFP |
| ACH credits targeted | 33% of organizations | AFP |
| ACH debits targeted | 20% of organizations | AFP |
Related corporate defense benchmarks sit in our cybersecurity statistics. Source: AFP, Payments Fraud and Control Survey Report.
2. Business Email Compromise and Vendor Impersonation
Business Email Compromise (BEC) remains the single most lucrative attack mechanism targeting commercial treasury departments. Fraudsters intercept supply chain communications or compromise legitimate corporate mailboxes to insert fraudulent banking instructions into active invoicing workflows. Rather than exploiting technical banking vulnerabilities, these schemes exploit trust relationships between vendors, accounts payable personnel, and corporate leadership.
| Metric | Value | Source |
|---|---|---|
| BEC source of payment fraud attempts | 71% of organizations | AFP |
| Annual BEC adjusted losses recorded | $2.9 billion | FBI IC3 |
| Annual BEC complaints filed with IC3 | 21,489 reports | FBI IC3 |
| Vendor or supplier impersonation share of BEC | 58% of attempts | AFP |
| Executive or CEO impersonation share of BEC | 43% of attempts | AFP |
| Average financial loss per successful BEC event | $137,000 | FBI IC3 |
Social engineering attack patterns sit in our phishing statistics. Source: FBI, Internet Crime Report.
3. Financial Losses and Asset Recovery Realities
When fraudulent transfers occur, the likelihood of recovering diverted funds drops rapidly with each passing hour. Wire transfers routed through intermediary correspondent banks and converted into digital assets or foreign fiat currency frequently leave corporate balance sheets permanently impaired. Enterprise accounting teams must navigate significant write-offs when preventive controls fail.
| Metric | Value | Source |
|---|---|---|
| Full recovery of stolen funds achieved | 29% of organizations | AFP |
| Partial recovery of stolen funds achieved | 30% of organizations | AFP |
| Zero funds recovered following fraud | 41% of organizations | AFP |
| Median loss from internal billing schemes | $100,000 | ACFE |
| Median loss from check tampering | $126,000 | ACFE |
| Average discovery timeline for AP schemes | 18 months | ACFE |
Enterprise security compromise benchmarks sit in our data breach statistics. Source: ACFE, Occupational Fraud 2024: A Report to the Nations.
4. Paper Check Vulnerabilities and Check Washing
Paper check usage across enterprise transactions remains stubbornly persistent despite elevated fraud rates. Organized criminal networks systematically target commercial postal collection boxes to intercept outgoing business checks. Fraud rings use solvent-based chemical washing techniques to erase payee names and numerical amounts while preserving legitimate authorized signatures.
| Metric | Value | Source |
|---|---|---|
| Annual check fraud SARs filed by banks | >680,000 filings | FinCEN |
| Year-over-year check fraud SAR increase | 23% | FinCEN |
| Organizations experiencing check fraud | 65% of victims | AFP |
| B2B payments still processed via paper check | approx. 33% | AFP |
| Primary physical check fraud mechanism | mail theft and washing | FinCEN |
| Typical business loss on check alteration | $40,000 to $60,000 | FinCEN |
Source: FinCEN, Financial Trend Analysis on Mail Theft-Related Check Fraud.
5. Treasury Controls and Verification Practices
Corporate finance leaders have increasingly replaced informal payment approvals with rigorous procedural frameworks. Out-of-band verification—confirming payment detail modifications via verified secondary communication channels rather than relying on incoming email instructions—serves as the primary barrier against vendor impersonation. Automated reconciliation software and bank positive pay services further compress the window between fraud execution and detection.
| Metric | Value | Source |
|---|---|---|
| Dual authorization for payment release | 76% of organizations | AFP |
| Daily reconciliation of bank accounts | 72% of organizations | AFP |
| Callback verification on vendor bank changes | 68% of organizations | AFP |
| Positive Pay utilization on corporate checks | 64% of organizations | AFP |
| Regular employee anti-fraud training | 61% of organizations | AFP |
| Automated AP anomaly detection software | 44% of organizations | J.P. Morgan |
Source: J.P. Morgan, Payments Fraud Prevention Guide.
6. Emerging Threats: AI Impersonation and Deepfake Wire Requests
The integration of generative artificial intelligence into social engineering workflows has altered the execution speed of corporate wire fraud. Attackers utilize high-fidelity voice cloning tools to mimic senior executives on phone calls, confirming urgent payment requests to junior accounts payable specialists. Corporate treasuries are accelerating the deployment of cryptographic authentication and hardware security tokens to eliminate reliance on verbal or visual confirmation alone.
| Metric | Value | Source |
|---|---|---|
| Organizations encountering AI-assisted fraud attempts | 32% | AFP |
| Surge in synthetic identity and voice cloning attempts | approx. 3,000% | Derived |
| Fraudsters requesting urgent executive wire routing | 54% of BEC events | AFP |
| Documented multi-million deepfake corporate wire thefts | confirmed cases | AFP |
| Multi-factor out-of-band approval adoption | 78% of finance teams | J.P. Morgan |
| Expected AP automation budget increase | 58% of finance leaders | AFP |
Source: AFP, Payments Fraud and Control Survey Report.
Summary: B2B Payment Fraud by the Numbers
| Metric | Value | Source |
|---|---|---|
| Payment fraud attempt incidence rate | 80% of organizations | AFP |
| Check fraud targeting rate among victims | 65% of organizations | AFP |
| Wire transfer fraud targeting rate | 39% of organizations | AFP |
| Corporate credit and debit card fraud rate | 36% of organizations | AFP |
| ACH credit fraud targeting rate | 33% of organizations | AFP |
| ACH debit fraud targeting rate | 20% of organizations | AFP |
| BEC involvement in payment fraud attempts | 71% of organizations | AFP |
| Annual BEC losses reported to FBI | $2.9 billion | FBI IC3 |
| Annual BEC complaints filed with FBI | 21,489 reports | FBI IC3 |
| Average financial loss per successful BEC | $137,000 | FBI IC3 |
| Vendor impersonation share of BEC attempts | 58% | AFP |
| Executive impersonation share of BEC attempts | 43% | AFP |
| Organizations recovering zero stolen funds | 41% | AFP |
| Organizations achieving full fund recovery | 29% | AFP |
| Median loss from internal billing schemes | $100,000 | ACFE |
| Median loss from corporate check tampering | $126,000 | ACFE |
| Annual check fraud SAR filings | >680,000 filings | FinCEN |
| Treasury dual authorization adoption rate | 76% of organizations | AFP |
Methodology and Sources
- Payment fraud incidence rates, payment rail vulnerability breakdowns, BEC percentages, and recovery outcomes come from the Association for Financial Professionals (AFP Payments Fraud and Control Survey Report).
- National cybercrime loss aggregates, BEC complaint numbers, and per-incident loss averages come from the Federal Bureau of Investigation (FBI Internet Crime Report).
- Median occupational fraud losses, billing scheme durations, and internal detection metrics come from the Association of Certified Fraud Examiners (ACFE Occupational Fraud 2024: A Report to the Nations).
- Check fraud filing volumes and postal theft trend analyses come from the Financial Crimes Enforcement Network (FinCEN Financial Trend Analysis on Mail Theft-Related Check Fraud).
- Treasury control adoption benchmarks and AP anomaly detection figures come from J.P. Morgan commercial banking disclosures (J.P. Morgan Payments Fraud Prevention Guide).
- Data watch: The AFP survey gathers self-reported data from over 500 corporate treasury and finance executives across diverse enterprise revenue tiers; organizations with smaller accounting departments may experience lower overall attempt volumes but higher loss severity relative to gross revenue. FBI IC3 figures reflect voluntary complaint submissions and represent an acknowledged undercount of total international commercial wire fraud. Statistics marked as derived reflect mathematical calculations based on disclosed source values.
- Last updated: September 5, 2026. We update this roundup quarterly, and the next major refresh is scheduled upon release of the next annual AFP and IC3 fraud reports.