Business Email Compromise: IC3 Data and SOC 2 Controls
Business email compromise causes substantial reported losses, but a crime statistic does not identify which controls a particular victim lacked. SOC 2 teams should connect email and payment workflows to access, change verification, monitoring, and incident response. Use FBI complaint data as threat context and test the controls your organization actually operates.
Key Takeaways
- •IC3 measures reported complaints and associated losses.
- •Threat data does not reveal whether a victim held a SOC report.
- •Test account, payment verification, monitoring, and incident-response responsibilities.
For implementation support, review SOC 2 compliance for startups and policies needed for SOC 2. Confirm scope and operating responsibilities before choosing an engagement.
What does the latest full-year FBI report show?
The FBI’s IC3 annual report records 24,768 business email compromise complaints and $3,046,598,558 in associated reported losses for 2025, on pages 7–8. These are reports received by IC3, not a census of all business email compromise incidents.
The report’s definitions and data limitations matter. Reported complaints and losses cannot establish a particular company’s expected loss or the effectiveness of buying a specific compliance service. They also do not reveal which of the victims held SOC reports.
Which operating controls should teams examine?
Examine the paths by which an attacker can impersonate a trusted person, obtain account access, or change a payment instruction. Translate the identified risks into control owners and reviewable evidence. The NIST Cybersecurity Framework offers a risk-management structure for that discussion.
| Risk path | Operating question | Example evidence |
|---|---|---|
| Compromised account | Who can access privileged and finance accounts? | Access reviews and authentication configuration |
| Changed payment details | How are changes independently verified? | Approved verification and change records |
| Suspicious account behavior | Who reviews alerts and investigates? | Alert triage and escalation records |
| Fraud attempt | Who can stop a payment and coordinate response? | Incident procedures, contacts, and exercises |
These are implementation examples. Design the controls for your actual accounts, payment workflows, and service commitments rather than treating an illustrative table as an audit requirement.
How does this relate to SOC 2 evidence?
A SOC assurance engagement concerns the described system and applicable criteria. Keep evidence of control operation, exceptions, and corrective action where the risks are in scope. The report does not guarantee the absence of fraud.
For operating support, review managed compliance services and Agency MDR. Clarify how monitoring, incident response, and payment-process controls divide between your teams and providers.
What should a security leader measure?
Track whether verification steps occur, whether alerts are reviewed, and whether response responsibilities work in an exercise or incident. Keep the period, population, and exceptions with the measurement.
Do not convert national complaint losses into a promised reduction in your company’s losses. Build a business case using your documented exposure, operating gaps, and planned controls.
Frequently Asked Questions
Do IC3 losses establish the ROI of SOC 2?
Does a SOC 2 report guarantee protection against email fraud?
What should a team test in its payment process?
Tyler Carbone
Managing Director and Cofounder
Tyler Carbone is a Managing Director and Cofounder of Agency and one of the industry's leading voices on governance, risk, and compliance. He holds degrees from Harvard and a JD/MBA from the University of Virginia, and previously worked in cybersecurity at Deloitte. Tyler has helped hundreds of companies operate SOC 2, ISO 27001, HIPAA, and GDPR programs.
LinkedIn
