# Payment Fraud by Industry: FBI, FinCEN and ACFE Data | RankShield Financial > Which industries lose the most to payment fraud? FBI IC3, FinCEN, ACFE, and AFP figures ranked by sector, and the verification gap that explains the losses. > > Source: https://rankshieldfinancial.com/resources/payment-fraud-by-industry-data/ · RankShield Financial (verifiable pre-settlement payment security) RankShield Network · Financial · Fraud Data # Payment Fraud by Industry: What FBI, FinCEN, and ACFE Data Show About Who Loses the Most Fraud losses are not evenly distributed. Here is the industry league table built from FBI, FinCEN, ACFE, and AFP data: who loses the most per case, which sectors BEC actors target first, and the verification gap that explains the pattern. By Jamie Kloncz Founder, RankShield Financial July 21, 2026 · 13 min read Key takeaways - Per-case losses vary by more than 10x across industries: ACFE’s 2026 study puts mining at a $300,000 median, wholesale trade at $256,000, and real estate at $250,000, against $59,000 for retail and $30,000 for education. - FinCEN’s sector analysis ranked manufacturing and construction as the top BEC target, accounting for a quarter of analyzed BEC transactions, with attempted thefts averaging $301 million per month by 2018 and vendor impersonation overtaking CEO impersonation as the leading method. - The heavy-loss sectors share three traits: money leaves by wire or ACH in large irregular amounts, the payment chain is public and fragmented, and nobody at the paying desk owns fraud. The 2026 AFP survey found 76 percent of organizations were hit and 74 percent saw BEC. - Some high-fraud industries do not belong on this table at all: convenience stores and fuel retailers lose to card skimming, which the FBI puts at over $1 billion a year. That is card-side fraud, and it needs a different control class than payment-side fraud. - The schemes that dominate the league table (billing schemes, vendor impersonation, BEC wires) are all authorized payments to the wrong payee, which is why the control that fits the loss pattern is verifying the payee and the approval before settlement. That is what RankShield Financial is built to do. Payment fraud by industry is a lopsided picture: a wholesaler loses a median $256,000 per fraud case while a retailer loses $59,000, and federal investigators have ranked construction and manufacturing as the most-targeted sectors for business email compromise. The totals behind that picture keep growing. The FBI’s Internet Crime Complaint Center logged $20.877 billion in reported losses in 2025, up 26 percent in a single year 1 , and the ACFE’s 2026 global study measured $3.4 billion in occupational fraud losses across 2,402 cases 2 . What no single report shows is the combined picture, because the FBI counts crime types, the ACFE counts industries, and FinCEN ranked BEC targets in a separate analysis. This guide assembles that league table in one place: median loss by industry, the dominant scheme in each sector, which sectors the federal data says attackers hit first, and the one distinction the rankings hide, the difference between industries robbed through the payments they send and industries robbed at the card reader. One honest note up front: these are medians and reported figures, not your odds. What the table is for is matching the control you buy to the fraud your sector actually suffers. ## The league table: median fraud loss by industry The most direct answer to which industries lose the most comes from the ACFE’s Occupational Fraud 2026 report, which measured 2,402 cases across 143 countries and recorded a median loss of $104,000 and an average of $1,457,000 per case 2 , with organizations estimated to lose about five percent of revenue to fraud. The medians by industry are where the table gets interesting, because the spread is enormous and it does not track company size or glamour. Mining tops the table at $300,000. Wholesale trade, an industry nobody markets fraud controls to, is second at $256,000. Education, full of large institutions, sits at the bottom at $30,000. Case counts tell a second story. Government and public administration filed 217 cases, the second-highest count of any industry, and [manufacturing](https://rankshieldfinancial.com/industries/manufacturing/) filed 193. The FBI’s complaint data adds the crime-type view for 2025: real estate fraud alone drew 12,368 complaints and $275.1 million in reported losses 1 . Read the columns together and the league table stops being trivia: the sectors that lose the most per case are the ones that move large, irregular business payments, and the dominant scheme in almost every one of them is a payment the victim organization authorized. | Industry | Median loss per case | Cases in study | Where the loss concentrates | | --- | --- | --- | --- | | Mining | $300,000 | Small sample | Large payments, remote operations, thin oversight | | Wholesale trade | $256,000 | 18 | Supplier payments; vendor impersonation | | Real estate | $250,000 | 38 | Wire-heavy closings and payoffs | | Transportation and warehousing | $200,000 | 77 | Carrier and freight payment diversion | | Manufacturing | $170,000 | 193 | Supplier invoice impersonation; FinCEN’s top BEC sector | | Construction | $120,000 | 93 | Billing schemes in 35% of cases; draw and sub payments | | Government and public administration | $100,000 | 217 | Vendor BEC against public funds | | Health care | $100,000 | 140 | AP-side vendor fraud, separate from billing fraud | | Religious, charitable, and social services | $76,000 | 82 | Weak controls; one person touching every payment | | Retail | $59,000 | Among the lowest | Occupational only; the big retail losses are card-side | ## What FinCEN found when it ranked BEC targets The Treasury’s Financial Crimes Enforcement Network is the only federal agency that has ranked industries by how often BEC actors actually hit them, using the suspicious activity reports banks must file. Its finding was blunt: manufacturing and construction were the number one target, accounting for 20 percent of analyzed BEC transactions in 2017 and 25 percent in 2018 3 , with attempted thefts climbing from an average of $110 million per month in 2016 to $301 million per month in 2018. FinCEN attributed the exposure to frequent wire use and publicly available client information, and it called out construction and renovation projects at institutions as particularly attractive to attackers. Two details in that analysis matter more than the ranking. First, the method shifted: impersonating an outside vendor or client overtook impersonating the CEO, with executive impersonation falling from 33 percent of reports to 12 percent while vendor and client impersonation rose to 20 percent. The con moved from the corner office to the vendor file. Second, real estate had the highest average fraudulent transaction of any sector at $179,001 per attempt. That analysis is the most recent federal sector ranking, and the totals have only grown since: the FBI reported $3.046 billion in BEC losses in 2025, with 86 percent of the money moving by wire or ACH 1 . The public sector shows what a single hit looks like: in April 2025 an Oregon city office wired more than $6 million to a fraudster posing as a vendor, and the Justice Department had to file a forfeiture action to claw back $6.7 million 5 . FinCEN’s institutional finding deserves more attention than it gets. The analysis specifically flagged large construction and renovation projects at institutions as attractive to BEC actors, and the recent public loss cases fit that template exactly: [school districts and city governments losing seven figures](https://rankshieldfinancial.com/resources/school-district-vendor-payment-fraud/) on payments tied to building programs, where the project, the contractor, and the payment schedule were all public record before the first fraudulent email was sent. If your organization funds construction, the sector ranking applies to you twice: once as the payer of a top-targeted industry, and once as an institution whose projects are advertised. The verification burden lands on whoever releases the payment, not on whoever designed the building. ## The three traits that make a sector a target Lay the ACFE medians over the FinCEN ranking and the AFP’s survey data, and the heavy-loss sectors stop looking random. They share three traits. First, money leaves in large, irregular amounts on rails built for speed: the 2026 AFP survey found 76 percent of organizations experienced attempted or actual payments fraud in 2025, with checks targeted at 58 percent of them, ACH debits at 30 percent, and wires at 25 percent 4 . A [wholesaler](https://rankshieldfinancial.com/industries/wholesale-distribution/) or a [general contractor](https://rankshieldfinancial.com/industries/construction/) pays six and seven figures to counterparties whose banking details change legitimately often enough that a fraudulent change does not stand out. Second, the payment chain is public and fragmented. A school district’s construction program is announced in board minutes. A GC’s subcontractors are on the permit filings. A freight broker books carriers it met yesterday. The attacker does not need to breach anyone to know exactly who owes whom and when; the sector publishes its own target list. Third, nobody at the paying desk owns fraud. In my conversations building RankShield Financial, the pattern repeats: the person updating a vendor record and the person releasing the payment are the same overworked human, and 74 percent of organizations saw BEC attempts against exactly that seam. Sectors with all three traits cluster at the top of the table. That is not a coincidence; it is a mechanism. One more reading note, because it changes what you do with these numbers. The ACFE average loss of $1,457,000 is fourteen times the $104,000 median, which means the average is being dragged up by a small number of catastrophic cases. Plan against the median, insure against the average. And notice who finds the fraud: the ACFE data shows 43 percent of cases are caught by tips, not by controls, and the median scheme runs a full 12 months before detection. A year of undetected payments is the real cost of having no verification step at the point of release; the tip that eventually surfaces the fraud arrives long after the money settled. ## The industries whose fraud is card-side, not payment-side One correction the league table needs: some famously high-fraud industries barely appear in it, and the reason is instructive. Retail’s occupational median is just $59,000, yet convenience stores and gas stations are among the most defrauded businesses in America. The difference is fraud class. The FBI estimates that card skimming alone costs financial institutions and consumers more than $1 billion annually 6 , and the IC3 logged $282.7 million in credit card and check fraud complaints in 2025 1 . Those losses hit at the pump and the register, where the store is the merchant, not the payer. That distinction is the practical takeaway of this whole table. Card-side fraud is fought with inspections, EMV and tap acceptance, law enforcement sweeps, and a [defensible evidence trail when a device or a fraud pattern is found](https://rankshieldfinancial.com/resources/gas-station-convenience-store-skimming-fraud/). Payment-side fraud, the kind that dominates every sector above, is fought by verifying the payee and the approval before an authorized payment is released. Buying the wrong class of control is how a company ends up well defended against the fraud it does not have. A wholesaler with pristine card security still wires $256,000 to an impostor; a [fuel and convenience chain](https://rankshieldfinancial.com/industries/fuel-and-convenience/) with perfect payee verification still bleeds at a skimmed pump. ## The control that fits the loss pattern Look at what actually dominates the top of the table: [billing schemes in 35 percent of construction cases](https://rankshieldfinancial.com/resources/construction-payment-fraud-bec/), [supplier impersonation in manufacturing](https://rankshieldfinancial.com/resources/supplier-impersonation-fraud-controls-compared/), carrier payment diversion in [trucking and logistics](https://rankshieldfinancial.com/industries/trucking-logistics/), vendor BEC against districts and cities. Every one of these is an authorized payment to the wrong payee. No credential is stolen and no account is hacked; a real approver releases a real payment based on a false identity, a false authority, or a false account. Regulation has caught up to that reading: Nacha’s fraud-monitoring rules, whose second phase took effect in June 2026 7 , now require every business that originates ACH credits to screen for payments initiated under false pretenses. The control that fits this pattern is [pre-settlement payment verification](https://rankshieldfinancial.com/pre-settlement-payment-verification/): checking who is paying, who is being paid, how much, and why against records you already trust, and requiring proof that an authorized person approved this specific payee and amount before release. This is where RankShield Financial sits. It is a verification and attestation layer in the authorization path, not a wallet or a processor, and it never takes custody of funds. It holds a changed or unverified payee before the money moves and seals a signed, tamper-evident record of who approved what, a verdict that an examiner, an insurer, or a partner can independently check rather than take on faith. That shared signal compounds as members join, rather than claiming a scale we have not yet reached, and the signing is quantum-safe by construction, not quantum-proof. If your industry sits in the top half of this table, the honest question is not whether you have [fraud prevention](https://rankshieldfinancial.com/transaction-fraud-prevention/), but whether any of it fires before settlement. You can [see how it works](https://rankshieldfinancial.com/how-it-works/). ## What to do with your industry’s number Use the median, not the average, and use it as a budget argument. If you run finance in a sector with a six-figure median loss, that number is what one successful vendor swap or diverted draw costs a business like yours, and it is the cheapest justification you will ever get for putting one control before the wire leaves instead of after. Pull your last twelve months of payments, count how many went to a payee whose banking details changed inside that window, and ask who verified each change and how. In most organizations the honest answer is an email thread. The league table says your sector is already priced into the attackers’ planning. The only question left is whether a changed payee at your company gets verified before the money moves, or explained after it is gone. Operate it ## Verify a payment before it settles Compose a payment and the conditions around it, then run the same check the product runs on a live rail. The verdict comes back before the money would move. Pay to Amount (USD) Conditions around this payment Bank details changed by email First-time payee Amount over approval policy Approver signature verifies PRE-SETTLEMENT VERDICT RANKSHIELD NETWORK Compose a payment on the left and run the check. The verdict is returned before the money moves, the way the product returns it on a live rail. Sandbox demo · reproduces the product’s verdict logic and signing metadata · not a live network call Downloadable · SVG Median occupational fraud loss per case by industry (ACFE Occupational Fraud 2026). Coral marks the sectors FinCEN ranked as the top BEC targets, manufacturing and construction, which drew a quarter of analyzed BEC transactions. Retail sits low here because its heaviest losses are card-side, outside occupational scope. FAQ ## Frequently asked questions Every question buyers ask before they trust a payment-security platform, answered directly. JAMIE KLONCZ · RANKSHIELD FINANCIAL ONLINE Pick a question on the left, or search above. You will get the direct answer, the way an answer engine would give it. REQUEST ACCESS → Self-check ## How exposed are your payments? Five controls decide whether an authorized-payment scam gets through on a fast rail. Answer them honestly to see where you stand. - 01 Do you send payments on instant or same-day rails (RTP, FedNow, same-day ACH)? - 02 Can one person both change a vendor’s bank details and approve the payment? - 03 Do you always confirm a bank-detail change on a number from your own files, not the request? - 04 Is the first payment to a new or changed payee held for verification before it goes out? - 05 Do you keep a signed record of exactly who approved each payment? Answer all five to see where you stand · 0/5 References - [FBI IC3, 2025 Internet Crime Report ($20.877B total, BEC $3.046B, real estate $275.1M, card/check $282.7M)](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) - [ACFE, Occupational Fraud 2026: A Report to the Nations (industry medians, 2,402 cases)](https://www.acfe.com/-/media/files/acfe/pdfs/rttn/2026/2026-report-to-the-nations.pdf) - [FinCEN, Financial Trend Analysis: Manufacturing and Construction Top Targets for BEC (July 2019)](https://www.fincen.gov/system/files/shared/FinCEN_Financial_Trend_Analysis_FINAL_508.pdf) - [AFP, 2026 Payments Fraud and Control Survey (76% hit; 74% BEC; checks 58%)](https://www.financialprofessionals.org/training-resources/resources/survey-research-economic-data/details/payments-fraud) - [U.S. DOJ, District of Oregon, forfeiture action to recover $6.7M stolen from a city office (2025)](https://www.justice.gov/usao-or/pr/united-states-files-forfeiture-action-recover-67-million-stolen-funds) - [FBI, Skimming (Scams and Safety): more than $1 billion in annual losses](https://www.fbi.gov/how-we-can-help-you/scams-and-safety/common-frauds-and-scams/skimming) - [Nacha, Risk Management Topics: Fraud Monitoring Phase 2 (effective June 2026)](https://www.nacha.org/rules/risk-management-topics-fraud-monitoring-phase-2) About the author ## [Jamie Kloncz](https://rankshieldfinancial.com/about/) Founder, RankShield Financial Jamie founded RankShield Financial to verify a payment’s intent and authority before it settles on instant and tokenized rails. These guides are written from building that product and reading the primary sources directly: every statistic here links to its original filing or report, never a secondhand summary. - Primary sources only: each figure links to the original filing - Honest boundaries: what verification can and cannot do is stated plainly - Last verified July 24, 2026 How RankShield Financial verifies → Request access → Verify, then settle ## See your payments verified before they settle. RankShield Financial is rolling out with design partners on instant and tokenized rails. Request access and we’ll map it to your settlement flow. Request access How it works ## Frequently asked questions ### Which industry has the most payment fraud? It depends on how you count. By median loss per case, the ACFE’s 2026 study ranks mining first at $300,000, then wholesale trade at $256,000 and real estate at $250,000. By case volume, government and public administration filed 217 cases, the second-highest of any industry, with manufacturing at 193 and health care at 140. By BEC targeting, FinCEN’s sector analysis of bank suspicious activity reports ranked manufacturing and construction first, at a quarter of analyzed BEC transactions. The consistent pattern across all three measures is that industries moving large, irregular business payments by wire or ACH dominate every ranking. ### Which industries do BEC scammers target the most? FinCEN’s financial trend analysis, built from suspicious activity reports, found manufacturing and construction were the top BEC target, rising from 20 percent of analyzed BEC transactions in 2017 to 25 percent in 2018, and it flagged construction and renovation projects at institutions like schools as particularly attractive. Real estate had the highest average fraudulent transaction at $179,001. The method has shifted toward vendor impersonation: posing as an outside supplier or client overtook posing as the CEO. The dollar scale keeps growing, with the FBI reporting $3.046 billion in BEC losses in 2025 and 86 percent of the funds moving by wire or ACH. ### How much does the average company lose to payments fraud? The ACFE’s 2026 global study puts the median occupational fraud loss at $104,000 per case and the average at $1,457,000, with the average pulled up by a small number of catastrophic cases. The same study estimates organizations lose about five percent of revenue to fraud. Exposure is nearly universal even when losses are not: the 2026 AFP Payments Fraud and Control Survey found 76 percent of organizations experienced attempted or actual payments fraud in 2025, and 74 percent faced business email compromise specifically. Your industry’s median is a better planning number than any cross-industry average, which is what the league table in this guide is for. ### Why are some industries targeted more than others? Three traits explain most of the ranking. First, the money moves in large, irregular amounts by wire and ACH, so a fraudulent payment does not look unusual. Second, the payment chain is public and fragmented: construction draws, freight bookings, and public-sector vendor lists effectively publish who owes whom and when, so attackers can research targets without breaching anyone. Third, the paying desk has no dedicated fraud owner, so a convincing bank-change email meets no structural resistance. Industries with all three traits, like construction, wholesale, transportation, and local government, cluster at the top of every federal measure of payment fraud.