toolbox
Home / AI, Data & Technology / Business Email Compromise Expected Loss Estimator

Business Email Compromise Expected Loss Estimator

This estimator calculates expected annual loss from business email compromise by combining targeted payment requests, fraud success, transfer size, recoveries, and response expense. It is designed for finance, treasury, security, and risk teams that need a transparent scenario for payment-diversion fraud.

The model distinguishes the amount transferred from the amount ultimately lost, then adds the operational cost of each successful event. It does not estimate every form of BEC, such as sensitive-data disclosure or payroll diversion, unless those consequences are represented in the selected inputs. Separate scenarios are often clearer when attack types have different loss profiles.

Enter your assumptions

requests
%
USD
%
USD
Result
—
Annual expected loss
Expected successful events—
Gross fraudulent transfer—
Expected funds recovered—

1. Enter targeted request volume

Use the number of credible BEC payment attempts or high-risk requests expected each year.

2. Set fraud success rate

Estimate the percentage that result in an unauthorized transfer.

3. Enter transfer size

Use the average value sent in a successful event.

4. Estimate funds recovery

Enter the average percentage recovered through bank recall, freezing, insurance, or restitution.

5. Add response cost

Include investigation, legal, forensic, communication, and process-restoration costs per successful event.

6. Review expected loss

Compare successful events, gross transfers, recovered funds, and net expected loss.

Expected successful events = Targeted requests × Fraud success rate Gross fraudulent transfer = Successful events × Average transfer Recovered funds = Gross transfer × Recovery rate Expected loss = Gross transfer − Recovered funds + (Successful events × Response cost)

The model uses expected values, so the event count may be fractional. Recovery should represent the share of transferred funds actually returned.

What the result means

Use the result as a scenario-based planning estimate. Compare several plausible inputs rather than relying on one point value.

This calculator does not replace a formal risk assessment, incident analysis, legal advice, or financial advice.

Given: 180 targeted requests, 1.2% success, $85,000 average transfer, 35% recovery, and $12,000 response cost.

Calculation: Successful events = 180 × 0.012 = 2.16. Gross transfer = 2.16 × $85,000 = $183,600. Recovered funds = $64,260. Response cost = 2.16 × $12,000 = $25,920. Expected loss = $183,600 − $64,260 + $25,920 = $145,260.

Result: Estimated annual expected loss is $145,260.

Why can expected events be fractional?

Expected value represents the long-run average across repeated periods. Actual annual events will be whole numbers and can vary widely.

Should insurance recovery be included?

Include it only when coverage, limits, deductibles, and payment likelihood support the assumption. Keep bank recovery and insurance recovery from overlapping.

Does the transfer amount include response cost?

No. Transfer loss and response expense are modeled separately so each assumption can be reviewed.

Can this model payroll or invoice fraud?

Yes, when request volume, success rate, transfer size, recovery, and response cost are calibrated to that specific BEC scenario.

What other impacts may be missing?

Reputational harm, supplier disruption, litigation, privacy obligations, and control remediation may require separate estimates.