Invoice Fraud 2026: 76% of US Firms Hit [Data]

76% of US organizations experienced attempted or actual payment fraud in 2025, according to the 2026 AFP Payments Fraud and Control Survey. Invoice-based fraud, fake vendors, spoofed payment instructions, and doctored bank details, sits at the center of that number: business email compromise alone affected 74% of organizations and cost US victims $2.77 billion in 2024. This report gathers the 2026 data on how often invoice and payment fraud actually happens, what a typical case costs, and how the trend compares across the US, UK, and Australia.

How many businesses experience invoice and payment fraud?

Most of them, and the share is close to three in four. 76% of US organizations reported attempted or actual payment fraud in 2025, according to the 2026 AFP Payments Fraud and Control Survey Report, based on responses from 465 corporate treasury and finance practitioners and published in April 2026. That is not a niche problem affecting a handful of unlucky companies; it is close to the default experience for a finance team over a full year.

Figure 1: 76% of US organizations experienced attempted or actual payment fraud in 2025. Source: AFP (Association for Financial Professionals), 2026 Payments Fraud and Control Survey Report (n=465), published April 2026.

Financial losses were unevenly distributed by company size: 48% of organizations with revenue under $1 billion reported an actual dollar loss from a fraud attempt in 2025, compared with 66% of organizations above that threshold. Larger companies get targeted more often and lose money more often in raw counts, but smaller companies typically lack the dedicated fraud teams, insurance, and banking relationships that larger firms use to claw losses back, so a single successful attack does proportionally more damage to a small business’s cash position. Unlike late payment, where a real customer simply pays a legitimate invoice past its due date, invoice fraud means the money goes to someone who was never supposed to receive it at all; see Late Payment 2026 for the far more common, non-criminal side of getting paid late, and B2B Payment Practices 2026 for why legitimate customers pay late in the first place.

What kind of fraud hits businesses most often?

Business email compromise, not stolen card numbers or hacked bank logins, is the leading method. 74% of organizations were affected by BEC in 2025, per the same AFP survey, making it the single most common avenue for payment fraud. Checks remain surprisingly exposed too: 58% of organizations reported check fraud, ahead of ACH debits (30%) and wire transfers (25%).

Figure 2: Business email compromise is the leading fraud vector, well ahead of checks, ACH debits, and wire transfers. Source: AFP 2026 Payments Fraud and Control Survey Report.

The pattern matters for anyone worried specifically about invoice fraud, since BEC is largely how it happens in practice: a scammer impersonates a vendor or executive by email and asks for an urgent payment or a bank detail change on an existing invoice, rather than breaking into a payment system directly. Only 17% of organizations currently use AI to help detect or stop payments fraud, according to AFP, even as attack volume keeps climbing.

How much does invoice fraud actually cost per incident?

When invoice and billing fraud succeeds, the median cost is a five-figure sum that keeps climbing. Occupational fraud cases overall, spanning billing schemes, check tampering, and corruption, cost a median $104,000 per case in the newest global data, drawn from 2,402 cases across 143 countries, according to the Association of Certified Fraud Examiners’ Occupational Fraud 2026: A Report to the Nations, published May 2026. Total losses across those cases topped $3.4 billion, and the average case, skewed upward by a handful of very large frauds, exceeded $1.4 million.

Figure 3: Small organizations lose less per case than large enterprises in raw dollars, but the gap is narrower than headcount alone would suggest. Source: ACFE Occupational Fraud 2024: A Report to the Nations.

Organization size does not offer much protection. In ACFE’s prior 2024 study, businesses with fewer than 100 employees, 21% of all cases studied, lost a median $141,000 per case, not far behind the $200,000 median at organizations with more than 10,000 employees, despite having a fraction of the revenue to absorb it. Business email compromise specifically carried an even higher per-incident average in the US: $137,000, according to the FBI’s Internet Crime Complaint Center, up 83% from $74,723 in 2019.

Is invoice and payment fraud getting worse each year?

Yes, at least in aggregate US dollar terms. Total losses reported to the FBI’s Internet Crime Complaint Center climbed from $10.3 billion in 2022 to $12.5 billion in 2023 to $16.6 billion in 2024, a 33% jump in the most recent year alone, according to the FBI’s annual Internet Crime Reports. Business email compromise, the mechanism behind most invoice and vendor-impersonation fraud, was the second-highest-dollar crime category in 2024 at $2.77 billion across 21,442 complaints.

Figure 4: Total US cybercrime losses reported to the FBI have climbed every year since 2022, with business email compromise among the largest contributing categories. Source: FBI IC3 Annual Internet Crime Reports, 2022-2024.

The trend is not universal at the country level, which is the more encouraging half of the picture; the UK and Australia move in opposite directions from each other, and from the US total.

How does invoice fraud show up in the UK and Australia?

The picture outside the US is more mixed than the FBI’s climbing totals suggest. In the UK, invoice and mandate fraud, the term UK Finance uses for scams involving fake invoices and manipulated bank details, actually fell to a record low of £41.3 million in 2025, down 4% year over year across 2,305 reported cases, even as the country’s overall payment fraud losses rose 4% to £1.28 billion, according to UK Finance’s Annual Fraud Report 2026.

In Australia, the National Anti-Scam Centre’s term is payment redirection, and the trend runs the opposite direction: losses rose to $166.8 million in 2025, up from $152.6 million in 2024, keeping it among the two largest scam categories by dollar loss nationally both years, according to Scamwatch’s Targeting Scams Report, published March 2026. Total Australian scam losses hit $2.18 billion in 2025, up 7.8% year over year.

Figure 5: Payment redirection, Australia’s term for invoice and BEC fraud, made up an estimated 7.7% of all reported scam losses in 2025. Source: National Anti-Scam Centre (Scamwatch), Targeting Scams Report, March 2026.

That divergence, a record low in the UK against a rising trend in Australia, tracks with how much each country’s banks have specifically hardened invoice and mandate-fraud controls, rather than payments fraud broadly; the UK’s overall fraud bill still climbed even as this one category fell.

Country	Fraud category	2025 figure	Source
United States	Organizations hit by payment fraud	76% of organizations	AFP 2026 Payments Fraud and Control Survey
United States	Business email compromise losses	$2.77 billion (2024)	FBI IC3, 2024 Internet Crime Report
United Kingdom	Invoice and mandate scam losses	£41.3 million (record low)	UK Finance Annual Fraud Report 2026
Australia	Payment redirection scam losses	$166.8 million	Scamwatch, Targeting Scams Report 2026

Table 1: These figures use different currencies, categories, and reporting scopes, so they should not be summed or directly compared. Each stands on its own as evidence that invoice fraud is a real, ongoing cost, moving in different directions by country.

The Bottom Line

Invoice fraud is not a fringe risk reserved for large enterprises with big treasury departments; it is close to the default experience for most businesses, with 76% of US organizations reporting an attempted or actual attack in 2025 and smaller companies bearing a disproportionate share of the damage once an attack succeeds. Business email compromise, not exotic hacking, drives most of it: a scammer impersonates a vendor or executive and asks for a bank detail change or an urgent payment, and 74% of organizations have faced exactly that. The trend line does not move the same direction everywhere; UK invoice and mandate fraud sits at a record low even as the country’s overall fraud bill grows, while Australia’s version of the same scam is climbing. What holds across every country studied is that the fraud almost always depends on a payment detail changing outside the original document. A BillyPaid invoice keeps a single payable link tied to the original document, rather than a bank detail that can be swapped in a follow-up email, closing off the exact substitution step most invoice fraud relies on.

Frequently Asked Questions

What percentage of businesses experience payment fraud?

76% of US organizations experienced attempted or actual payment fraud in 2025, according to the 2026 AFP Payments Fraud and Control Survey Report, based on a survey of 465 treasury and finance practitioners published in April 2026.

What is business email compromise and how much does it cost?

Business email compromise, or BEC, is a scam where a fraudster impersonates a vendor, executive, or trusted contact by email to redirect a payment or change bank details on file. It affected 74% of US organizations in 2025 (AFP) and cost victims $2.77 billion across 21,442 reported incidents in 2024, an average of $137,000 per incident, according to the FBI’s Internet Crime Complaint Center.

How much does a typical invoice or billing fraud case cost?

The median occupational fraud case, spanning billing schemes, check tampering, and related categories, cost $104,000 in the newest global data, drawn from 2,402 cases across 143 countries, according to the Association of Certified Fraud Examiners’ Occupational Fraud 2026: A Report to the Nations. Small organizations with fewer than 100 employees are not spared: they lost a median $141,000 per case in ACFE’s prior 2024 study, not far behind the $200,000 median at organizations with more than 10,000 employees.

Is invoice fraud getting worse?

It depends on the country. Total US cybercrime losses reported to the FBI climbed from $10.3 billion in 2022 to $16.6 billion in 2024. In the UK, invoice and mandate fraud losses actually fell to a record low of £41.3 million in 2025, according to UK Finance, while Australia’s equivalent, payment redirection scams, rose to $166.8 million in 2025, up from $152.6 million in 2024, according to Scamwatch’s Targeting Scams Report.

Sources and References

1. AFP (Association for Financial Professionals): 2026 Payments Fraud and Control Survey Report (n=465, published April 2026)
2. FBI Internet Crime Complaint Center (IC3): 2024 Internet Crime Report
3. FBI: Annual Internet Crime Report press release (2022-2024 loss trend)
4. Association of Certified Fraud Examiners (ACFE): Occupational Fraud 2026: A Report to the Nations (2,402 cases, 143 countries, published May 2026)
5. ACFE: Occupational Fraud 2024: A Report to the Nations
6. UK Finance: Annual Fraud Report 2026
7. National Anti-Scam Centre (Scamwatch): Targeting Scams Report (published March 2026)

Note: All figures verified as of August 2026.